Compliance Support

Testing evidence for your SOC 2, ISO 27001 or HIPAA audit

Technical testing and remediation that produces evidence for your SOC 2, ISO 27001 or HIPAA audit. We work alongside your consultant or auditor. Our contribution is entirely on the technical side.

DeepDefence is a security testing firm. We are not an auditor, CPA firm, certification body or GRC consultancy, and we do not issue certifications or attestation opinions.

Talk to us about your audit

What Our Testing Supports

We test the technical security controls your SOC 2, ISO 27001 and HIPAA audit looks at — and map our findings to them so they become usable audit evidence.

Our serviceTechnical control areas we provide evidence forFrameworks
AI systems security testingSecure development & testing, vulnerability management, logging & monitoringSOC 2 · ISO 27001 · HIPAA
Cloud security assessmentAccess control & authentication, configuration management, network security, cloud service securitySOC 2 · ISO 27001 · HIPAA
Web application & API testingAccess control, secure development, vulnerability management, data integritySOC 2 · ISO 27001 · HIPAA
Remediation guidance & supportVulnerability remediation, change managementSOC 2 · ISO 27001 · HIPAA
Retest & verificationVulnerability management, monitoring & evaluationSOC 2 · ISO 27001 · HIPAA

Our testing provides evidence for these technical controls. It does not, on its own, satisfy a framework in full — policy, process and organizational controls remain your responsibility with your consultant or auditor.

The technical controls our testing and configuration/design review typically provide evidence for. We confirm the exact references and evidence expectations with you and your auditor for each engagement.

ISO/IEC 27001:2022 Annex A

5.23 · 8.1 · 8.2 · 8.3 · 8.4 · 8.5 · 8.6 · 8.7 · 8.8 · 8.9 · 8.10 · 8.11 · 8.12 · 8.13 · 8.14 · 8.15 · 8.16 · 8.17 · 8.18 · 8.19 · 8.20–8.24 · 8.25–8.29 · 8.31 · 8.32

SOC 2 Trust Services Criteria (Security)

CC4 · CC5 · CC6 · CC7 · CC8

HIPAA Security Rule

§164.308(a)(1) · §164.308(a)(7) · §164.308(a)(8) · §164.312(a) · §164.312(b) · §164.312(c) · §164.312(d) · §164.312(e)

Some of these controls need input or implementation from your IT or engineering team — for example backup and recovery, logging, change management or endpoint configuration. We assess them, provide evidence from testing and configuration review, and implement or support the fixes where included in scope. Governance, policy, physical and documentation controls — such as ISO organizational controls, SOC 2 CC1–CC3 and CC9, and HIPAA §164.310 and §164.316 — sit outside this technical scope and remain with your consultant or auditor.

What We Deliver

Evidence your auditor and your developers can both use.

  • Control-mapped report — findings referenced to the relevant ISO 27001, SOC 2 and HIPAA technical controls.
  • Developer-ready findings — clear reproduction steps, evidence and severity for each issue.
  • Remediation guidance — practical, prioritised fixes your team can act on.
  • Remediation support (where included in scope) and retest confirmation — we help close technical gaps where agreed, then re-test fixed issues and document the outcome.
  • Auditor Q&A support — we answer technical questions about our testing and findings for your auditor.
  • Reusable evidence — a report structured so it drops cleanly into your audit evidence.

Gaps need fixing, not just finding. Testing identifies technical gaps; fixes and retest evidence are needed before your audit and, for SOC 2 Type II, generally before the observation period begins. Testing alone does not make you compliant or certified.

What We Don't Do

Knowing the boundary keeps your audit on track. These stay with your consultant or auditor.

  • ISMS or SOC 2 program design
  • Policies and procedures
  • Risk assessment
  • Statement of Applicability
  • Internal audit
  • Readiness consulting
  • Audit coordination
  • The audit itself, or any certification or attestation opinion
  • Any guarantee of your audit outcome

How We Work With Your Auditor or Consultant

We fit into your audit process rather than replacing it.

1

Confirm expectations

Before testing, we confirm with you and your auditor which controls and evidence the engagement needs to support.

2

Scope the testing

We define scope so our testing lines up with the technical controls your framework expects evidence for.

3

Test and report

We test by hand, then deliver a control-mapped report with developer-ready findings and remediation guidance.

4

Retest and support

We retest fixes and answer your auditor's technical questions about our testing and findings.

We recommend confirming evidence expectations with your auditor before testing begins.

Compliance FAQ

Common questions about how our testing fits your audit

No. We are not a certification body or auditor and cannot issue a certification or attestation. We provide the technical testing and evidence that supports your audit, and we can refer you to partners who handle readiness and certification.

No. Policies, procedures and other program documentation stay with you and your consultant. We focus on technical security testing and remediation.

Yes. Our control-mapped report is structured to support the technical controls your SOC 2, ISO 27001 or HIPAA audit looks at. We recommend confirming the exact evidence your auditor expects before testing begins.

No. Testing provides evidence for specific technical controls, but a framework also covers policy, process and organizational controls that sit outside testing. Those remain your responsibility with your consultant or auditor.

We do both, depending on what is agreed in the scope of your engagement. Testing identifies the technical gaps that could cause problems in a SOC 2, ISO 27001 or HIPAA audit. Where remediation is included in the agreed scope, we help close them, covering technical controls such as cloud access and configuration, logging and monitoring, application and API fixes, and secure pipeline settings. Every engagement includes developer-ready fix guidance. Once fixes are in place, we retest and provide dated evidence your auditor can review. Remediation work is scoped and quoted separately from testing, so you only pay for what you need. We do not write policies, run your risk assessment or act as your auditor, so for those we work with your consultant or can refer you to one. No one can guarantee an audit outcome, but closing and evidencing technical gaps before the audit puts you in the best position.

Yes, when it is included in the agreed scope. We work through your change process, make changes only with your written approval, and document each change so it can be reviewed and rolled back if needed. If you prefer to make the changes yourself, we provide step-by-step guidance and retest afterwards.

Yes. Our testing provides evidence for technical safeguards under the HIPAA Security Rule, such as access control and transmission security. We do not provide legal or compliance opinions on HIPAA.

Need testing evidence for your audit?

Tell us which framework you're working toward and we'll help you scope testing that produces the evidence your auditor needs.

Request a Security Assessment View Services