Services

Scoped to your obligations, not our menu.

We don't sell a list of audits. You bring the requirement, whether it's a regulation, a statute, a contract clause, an industry standard, an accreditation, or a funder's conditions. We bring the same standard of evidence to every one of them, and we never hand you a proposal to do the remediation ourselves.

01Assess 02Audit 03Verify 04Advise 05Train

01 · Readiness & gap assessments

Know exactly where you stand before someone else tells you.

A readiness assessment answers one question: if the examiner, certifier, customer, or regulator showed up today, what would they find? We score every requirement in scope against evidence we've actually examined, not a questionnaire you filled out, and hand you a prioritized gap list your team or vendor can execute.

Typical triggers: an upcoming certification or accreditation, a new regulation with a deadline, a customer or prime contractor questionnaire, a board or council asking "are we compliant?", or a self-assessment you're about to affirm and want checked first.

What we assess against

Whatever you're held to. We've worked across cybersecurity, privacy, accessibility, AI governance, records, and operational compliance requirements for government and commercial clients, and we scope each engagement to the specific standard, clause, or rule you name. If a requirement is outside our competence, we'll say so on the scoping call and point you to someone who fits.

You receive

Scored gap report organized the way the requirement itself is organized
Severity-rated risk register, with evidence references for every item
Prioritized gap list, ready for any remediation team
Executive briefing for leadership, the board, or the council

Audit scopes

Control audits of policies, processes, and technical safeguards against a named standard
Content and product audits of websites, applications, documents, and services against accessibility and usability requirements
Program audits of governance, oversight, and accountability for a function such as AI use, records, or risk management
Contract compliance audits against clauses, flow-downs, and grant conditions
Conformance reports and statements written from tested evidence, in the format your buyer or regulator expects

You receive

Finding-level detail: what we tested, what we found, the evidence, the severity, what it means
Results mapped to the requirement and, where useful, cross-walked to related standards
A report written to survive scrutiny from an oversight body, an opposing expert, or a contracting officer
Management response log capturing your team's input from the review

02 · Compliance audits

Tested by people, not just scanned by tools.

An audit is a formal, evidence-based examination of whether something meets the standard it's held to. Automated tooling supports our work where it helps; it never replaces examination, interviews, and hands-on testing, because the people who will read your report won't accept a scanner's opinion either.

We do not remediate what we audit. Your web team, your MSP, your counsel, or your internal staff do the fixing, and that separation is exactly what makes the report credible to whoever asked for it.

03 · Independent verification

Fixed isn't fixed until it's verified.

After your team or vendor remediates, we re-test the open findings and issue a verification report. Because we had no hand in the remediation, the closure means something. We also verify other people's claims: another firm's assessment, a self-assessment you're about to sign, or a vendor's conformance report.

Verification options

Findings re-test of open items from a prior JCS report, with updated evidence and closure status
Annual or recurring re-assessment on a fixed cadence, producing a year-over-year trend your board and customers can see
Independent second opinion on another firm's assessment or a self-assessment before you rely on it
Vendor claim verification: we test whether a supplier's conformance report says what the product actually does

Advisory formats

Requirement mapping: which rules, clauses, and standards actually apply to you, and which don't
Governance reviews of policies, ownership, oversight, and reporting for a compliance program
Pre-procurement reviews of a vendor's compliance posture before you sign
Board, council, and leadership briefings in plain English
Independent advisor on retainer for organizations that want an auditor's read on decisions as they happen

Advisory means telling you what "compliant" looks like and what the evidence would need to show. It never means building, configuring, or writing it for you.

04 · Governance advisory

An auditor's read, before the audit.

Sometimes the question isn't "do we pass?" but "what are we even held to, and who owns it?" We help leadership map their obligations, judge whether the governance around them is real, and decide what to assess first, without ever taking on the work we'd later have to grade.

05 · Compliance training

Teach the people who own the controls what the auditor looks for.

The cheapest finding is the one that never gets written. We train control owners, content authors, and leadership on the requirements they're held to, using the same evidence standard we apply when we assess.

Formats

Executive briefings (60 to 90 minutes) for leadership, boards, and councils
Role-based workshops (half day) for control owners, authors, and technical staff
Audit-readiness sessions: what the assessor will ask for and how to show it
Organization-wide awareness training tailored to your requirement and your sector

Delivered remotely or on site in the DFW metroplex. Training is knowledge transfer, not implementation; we teach your team what "compliant" looks like and leave the building to them.

Ready for a report you can stand behind?

Book a 30-minute scoping call. We'll confirm the framework, the boundary, and the evidence you already have, and you'll leave with a fixed-scope proposal. No pitch for services we don't offer.

Book a scoping call → Send a request