# Governance, Risk, Compliance and Audit Readiness > Gap assessments against HIPAA, PCI DSS, CMMC, SOC 2 and NIST. Trybus Solutions builds the technical controls, writes the policy and assembles the evidence. *Source: https://trybussolutions.com/governance-risk-compliance/ · Trybus Solutions · Chattanooga, TN · 423-633-1817 · info@trybussolutions.com* ## What We Do Trybus Solutions works out what a framework requires of your technical environment, builds the controls that satisfy it, writes the policy and procedure set describing them, and assembles the evidence an assessor asks to see. Most of this work starts for one of a few reasons. A customer or an insurer has sent a questionnaire the environment cannot answer honestly. A contract has arrived with a compliance clause flowed down through it. An auditor has left findings with dates attached. Our clients usually have their own IT team, and often somebody who owns compliance as part of a wider job. We are there for the technical half of the work, and for the writing nobody in a busy team gets to. ## Why Clients Bring Us In - **We are framework-independent.** We do not sell a framework and we do not resell a governance platform, so the scope is set by the obligation you carry. Where two frameworks overlap, we map the control once and use the evidence twice. - **We are engineers who also write the documentation.** Compliance work comes apart in one of two places: the control was never built, or nobody described it in the language an assessor reads. We cover both halves. - **We start from what is running now.** Documentation drifts away from the environment it describes, usually inside a year of being written. The distance between the two is where most findings come from. - **We work alongside whoever audits you.** We do not sit in the assessor's seat, which keeps the relationship straightforward. We prepare the environment and the evidence, sit in the sessions, and answer the technical questions your team should not have to field alone. - **Design and procurement in one place.** Where closing a finding needs hardware or licensing, we design it and supply it, and our procurement works with your purchasing system rather than outside it. - **We will tell you what does not need doing.** A compliance program is easy to inflate. Some gaps are worth closing this quarter, some are worth scheduling, and some are worth writing down as accepted risk. We say which is which, even when it costs us work. [Start a conversation](https://trybussolutions.com/contact-us/?service_solution=governance-risk-compliance) ## What You Get Scope varies, and a first examination at a two-hundred-person company does not need the documentation a defense contract flow-down does. Below is what we produce on a typical mid-size engagement, and we agree which of it you need at scoping. Everything we produce is yours, and complete enough for another firm to work from if you take it elsewhere. - **Scope definition:** Which systems, sites, people and data the framework actually reaches, agreed before anything is assessed. A boundary drawn loosely at the start is the most expensive mistake in this work. - **Gap assessment against the control set:** Every control read against the environment as it runs today, with a plain statement of whether it is met, partly met or open. - **Findings and remediation plan:** What is open, ordered by exposure and by how long it takes to close, with an owner and a date against each item. - **Policy and procedure set:** Policies and procedures mapped to the control each one answers, in language your staff can follow rather than file. - **Technical control implementation:** Access control, multi-factor authentication, encryption, logging, segmentation and backup configured in the environment, so the control exists in the system as well as the document. - **Evidence package:** Configuration exports, logs, tickets and approvals labeled against the control they support, in the shape an assessor expects them. - **Risk register and accepted risks:** What you decided against fixing, the reasoning, who signed it and when it comes back up for review. - **Handover pack and maintenance calendar:** Who owns each control, what has to happen monthly, quarterly and annually to keep it alive, and where the evidence is kept. ## The Frameworks We Work Against Trybus is framework-independent. We do not sell a framework, we do not resell a governance platform, and we have no reason to steer you toward one control set over another. Which one applies is settled by your contracts, your regulator and your customers. What we do with it is mapping: taking the control set as written, working out which of your systems it actually reaches, and showing where each requirement is met and where it is not. ### HIPAA The Security Rule is written as safeguards rather than a product list. Mapping means showing where protected health information sits, who can reach it, and how access is granted, removed and encrypted. Clinical equipment nobody can patch, and business associates holding part of your evidence, are the awkward parts. ### PCI DSS Scope decides everything here: which systems store, process or transmit cardholder data, and which can reach those. The evidence has to show that segmentation holds, that access carries multi-factor authentication, that logging is retained and reviewed, and that scanning happens on schedule. Estates with many small sites are where it gets expensive. ### CMMC and the Underlying NIST Requirements The obligation arrives through a contract clause and reaches every system touching Controlled Unclassified Information. The work starts by drawing a boundary around those systems, then assesses each requirement against them, writes a system security plan describing how each is met, and keeps a dated plan of action for the rest. The boundary drives everything downstream, so it is the first conversation we have. ### SOC 2 SOC 2 is an examination against criteria you help select, which is why organizations underestimate it. You decide which trust services criteria belong in scope, and then have to evidence that the controls operated across a period of months rather than on the day. Access reviews performed on time, and consistent onboarding and offboarding, decide that outcome. ### The NIST Cybersecurity Framework The framework is voluntary, which makes it a useful organizing structure when nothing has been mandated. Here the exercise is scoring the current state across the framework functions, agreeing a target proportionate to the organization, and turning the distance between the two into a roadmap with dates against it. ### When More Than One Applies Most mid-size organizations carry two or three obligations at once, and the control sets overlap heavily. Multi-factor authentication, logging, access reviews and encryption appear in all of them under different numbering. We build one control set, map it out to each framework, and collect the evidence once. ## How a Project Runs Broadly the same shape whether it is a first examination at one site or a flow-down across an estate. Timescales depend on the scope, the state of the documentation, and how quickly your own people get to their part. - **Scoping and kickoff:** Agree which framework applies, what date is driving it, and how decisions get made. This is also where we set the change process, so a later surprise has a route through it. - **Drawing the boundary:** A working session with the people who know where data actually goes, rather than where the diagram says it goes. Moving the boundary here is cheaper than moving it during an examination. - **Gap assessment:** Interviews with the people who run the environment now, plus configuration pulled from the live systems. It usually turns something up, and where that changes the scope we price it and you decide. - **Remediation and documentation:** Controls built and configured while the policies are written against them. The two run in parallel because a document written months after the build rarely matches it. - **Evidence collection:** Evidence gathered and labeled as the controls go in. Assembling it at the end, from memory, is how a well-run environment ends up with findings against it. - **Readiness review:** A rehearsal with the people your assessor will interview. On a small scope with a team that has been through this before, the stage often is not worth the time, and we will say so. - **Assessment support and handover:** We work alongside your assessor while the examination runs, answering technical questions and producing evidence. Afterward we hand over documentation, training, and a maintenance calendar so the evidence stays current. ## What Is Quoted Separately Most of what is below is work we do. It is not part of a compliance engagement by default, because each piece carries its own scope, its own schedule and its own cost. If you want any of it included, say so at scoping and we will quote it in. The last item is different: it is work we do not do at all. - [Large remediation builds. Closing a finding sometimes means replacing a firewall estate or rolling multi-factor authentication out across the organization. We do that work, and it is priced as its own project because it runs to a different schedule.](https://trybussolutions.com/cybersecurity/) - [Network design and segmentation work. Reducing what falls inside the boundary is usually the cheapest way to make a payment or clinical environment compliant, and it is a network project underneath.](https://trybussolutions.com/networking-connectivity/) - [Backup, recovery and data residency work. Retention periods, restoration testing and where data is allowed to live are controls in every framework here. Rebuilding the platform underneath them has its own scope.](https://trybussolutions.com/cloud-and-infrastructure/) - [Ongoing operation and evidence collection. Running the controls after handover and keeping documentation current is a separate agreement. Plenty of clients keep it in house, and the maintenance calendar is written so that they can.](https://trybussolutions.com/managed-services-and-support/) - [Custom development and integration. Pulling evidence automatically out of an application, a service desk or an identity source, past what documented connectors cover. That work gets its own scope and testing.](https://trybussolutions.com/architecture-solution-design/) - **Audit, certification and attestation.** Certificates, attestations and audit opinions come from an independent assessor, because such a document carries weight only where the party signing it did not build the environment. We produce the controls and the evidence, and work alongside whoever examines them. [Start a conversation](https://trybussolutions.com/contact-us/?service_solution=governance-risk-compliance) ## Industries We Work In The control sets do not change much between sectors. What changes is which obligation arrives first, who owns it, and how much of the evidence sits with somebody else. ### [Healthcare →](https://trybussolutions.com/healthcare/) Clinical systems and connected equipment that cannot be patched or taken offline at will, and business associates holding part of your evidence. ### [Public Sector →](https://trybussolutions.com/public-sector/) Records retention, procurement rules, criminal justice data wherever law enforcement is involved, and disclosure obligations that shape what gets written down. ### [Tribal Government and Enterprises →](https://trybussolutions.com/tribal-organization/) Sovereignty over data and systems, funding cycles outside the commercial year, and government, health, education and gaming obligations carried at once. ### [Financial Services →](https://trybussolutions.com/financial-services/) Examinations that recur on a schedule, supervision and retention duties, and third-party risk questions asked about every vendor with access. ### [Education →](https://trybussolutions.com/education/) Student records, filtering obligations tied to funding programs, research data with its own terms, and accounts that turn over every year. ### [Retail →](https://trybussolutions.com/retail/) Payment obligations across many small sites with no local IT, where reducing what falls inside the boundary beats any control you can buy. ### [Enterprise →](https://trybussolutions.com/enterprise/) Several frameworks at once, security questionnaires arriving continuously, and estates still carrying whatever an acquisition brought with it. ## The Technology We Build Controls In We do not sell a governance platform and we do not resell one. A control has to exist in the environment before it can be evidenced, and most of them end up in identity, access, network and logging products. These are the ones our engineers build them in most often, and they also work in platforms we do not sell. We do not publish comparisons between manufacturers. Which platform suits an organization is something an assessment works out, not something a website should decide. [See all technology partners →](https://trybussolutions.com/partners/) ## Talk to Us About a Project Tell us which framework you are being held to, what prompted the conversation and what date is driving it. We will tell you what we think needs doing and what does not, and put a scope and a number against it. [Start a conversation](https://trybussolutions.com/contact-us/?service_solution=governance-risk-compliance) [Insights and guides](https://trybussolutions.com/resources/) ## Related guides - [Network segmentation without stopping the business](https://trybussolutions.com/network-segmentation-without-stopping-the-business/)