Vorpcel / Services / Assurance
We prepare your company for a security certification or a regulation: we measure the gap against the standard, plan the work, help write the policies and gather the evidence, and stay with you until the audit.
At a glance
A certification is often requested by a large customer or required by a regulator, with a date attached. The risk is to reach that date with a pile of documents that nobody follows, and fail the next audit or, worse, an incident.
We prepare you so that the controls work in practice. Each requirement of the standard becomes a task with an owner, and each task produces the evidence the auditor will ask for.
A quick view of the four standards we prepare companies for.
| Standard | Usually required by | What you have at the end |
|---|---|---|
| ISO/IEC 27001 | International customers, tenders and regulated sectors | A certificate issued by an accredited certification body |
| SOC 2 | Customers in the United States, especially for software services | A Type I or Type II report issued by an audit firm |
| PCI DSS | Card brands and acquirers, for anyone handling card data | A self-assessment or a report on compliance from a qualified assessor |
| LGPD | Brazilian law, for anyone processing personal data in Brazil | Processes and records that show compliance to the authority and data subjects |
The international standard for an information security management system. We help define the scope, run the risk assessment, write the Statement of Applicability and prepare for the stage 1 and stage 2 audits.
The report most requested by customers in the United States. We help choose the trust criteria, design the controls and prepare the evidence for a Type I and then a Type II report.
Required for anyone who stores, processes or transmits card data. We help reduce the scope, apply version 4.0 requirements, including the controls for scripts on payment pages, and prepare the self-assessment or the assessor visit.
The Brazilian data protection law. We map personal data and its uses, review legal bases and contracts, and set up the processes for data subject requests and incident notification.
How long it takes depends on the standard and on where you start. The gap assessment gives you a realistic date before you commit to one with a customer.
We compare what you have today with each requirement of the standard and list what is missing.
Every gap becomes a task with an owner, an effort estimate and a date, in the order that makes sense.
We write policies and procedures with you, review the controls as they are built and organize the evidence.
We run an internal audit, fix what it finds and support your team during the external audit.
Each requirement, your current state and what is needed to meet it, with a realistic timeline.
Documents written for how your company actually works, approved by your leadership.
The evidence for each control, organized the way the auditor will ask for it, and a routine to keep it current.
Where Vorpcel products are in use, their reports can serve as evidence for some controls, such as vulnerability management, logging and cloud configuration. Using them is not required.
Which systems, devices and data are in scope, and who owns each one.
Proof that access is granted, reviewed and removed in time.
Evidence that flaws are found and fixed within agreed deadlines.
Records of security events and proof that someone reviews them.
A tested plan and the record of how past incidents were handled.
How you check the security of the vendors that handle your data.
No. The certificate or report is issued by an independent certification body, audit firm or qualified assessor. Keeping preparation and audit separate is what makes the result credible. We can help you choose and work with them.
The one your customers or regulator ask for. If nobody has asked yet, the gap assessment against ISO 27001 is a good base, because most other standards share a large part of its controls.
Yes. We map the requirements of each standard to a single set of controls, so the same work and the same evidence serve all of them.
Not necessarily. Many controls are processes and evidence. When a tool is needed, we explain which control it covers and you choose the product.
We reply with a few questions about scope, then send a proposal with dates and price.