Compliance preparedness for small businesses

Know what is required. Get your documentation and next steps in order.

An insurer asks how you protect business accounts. A customer sends a security questionnaire. A contract requires evidence you have never had to gather before. You need to understand the request, give accurate answers, and know what still needs work.

Edwards Consulting Group helps you review technology requirements, identify gaps, and organize practical policies and evidence. Chris Edwards works with you and the people who manage your systems. ECG provides preparation and support; formal assessment, certification, or acceptance remains with the appropriate assessor or requesting organization.

Talk through the requirement How engagements are priced

Start with the request in front of you.

Your insurance renewal asks about account security, backups, or staff training.
A customer wants answers and evidence before agreeing to work with you.
A contract includes technology or information security requirements.
You are preparing for an assessment and cannot find the supporting records.
Written policies no longer match how your team actually works.

Bring the request and deadline to the first conversation. We can start with a single questionnaire or define a broader preparation project, depending on what you need to demonstrate.

What we can help put in order

Requirements and scope.

Review the specific request, the stated standard or version, and the systems and information it covers. Identify questions that need clarification from the customer, insurer, assessor, or your legal adviser.

An honest view of the gaps.

Compare the requirements with current practices and available evidence. Separate what is supported, what needs improvement, and what has not yet been verified.

Policies people can follow.

Develop or update the agreed policies and procedures around how your business operates. Include clear responsibilities and flag where the written procedure still needs to be put into practice.

Evidence and questionnaire support.

Organize relevant records and supporting information. Help prepare accurate responses, identify missing evidence, and support review questions within the agreed engagement.

A working set of documents and next steps

Your proposal defines the requirements and deliverables included. Depending on that scope, you receive:

A list of requirements, the systems they concern, and unresolved scope questions.
A gap assessment with priorities, proposed owners, and target dates.
The policies and procedures agreed for the engagement.
An evidence index showing what is available, where it is kept, and what is missing.
Draft questionnaire responses or a preparation package for your team to review.

Documents should reflect practices you can demonstrate. When a gap needs a technical change or staff training, we identify that work and agree separately on who will handle it. A security assessment can help investigate technical gaps.

How we prepare together

1. Understand the request.

Review who is asking, what they expect, and the deadline. Confirm the scope and questions that need an authoritative answer.

2. Check the current position.

Review your practices, settings, policies, and records. Record missing information and gaps without assuming an undocumented requirement has been met.

3. Put the work in order.

Prioritize improvements, assign owners, and prepare the agreed documents. Distinguish completed work from plans that are still in progress.

4. Review the evidence.

Walk through the package with your team, note remaining gaps, and prepare for follow-up questions. Any continued support during a formal review is agreed in advance.

Questions owners ask

We only have one questionnaire. Do we need a larger project?

The work can be scoped to that questionnaire. We help you understand the questions, check the evidence, and prepare accurate answers for your approval. If the review exposes gaps or additional requirements, we explain them before proposing further work.

Which standards or requirements can you help with?

We can discuss preparation involving HIPAA, SOC 2, PCI DSS, ISO 27001, NIST guidance, and CMMC requirements, as well as customer or insurer questionnaires. We confirm the specific requirement, version, scope, and fit for the engagement before committing to the work. Formal assessment and acceptance follow the applicable program or requesting organization's process.

Can you certify us or guarantee we will pass?

No. ECG helps you prepare and address documented gaps. We do not issue certifications or replace an authorized assessor. Decisions about certification, coverage, contracts, or acceptance belong to the relevant assessor or organization reviewing your submission.

How long will it take, and what does it cost?

The scope depends on the request, the systems involved, your current practices, available evidence, and the changes still needed. We discuss the deadline at the start and agree on deliverables, timing, and price before work begins. See how engagements are priced.

Does completing the documentation mean our business is secure?

Documentation helps explain and demonstrate your practices, but it does not prevent incidents by itself. The measures described need to be implemented, checked, and maintained. A security assessment and training for your team can address related gaps when included in the plan.

Turn the request into a manageable plan.

Tell Chris who is asking, what they need, and when it is due. A brief description is enough to start; we will agree on a secure way to share sensitive documents afterward.

Discuss your preparation needs