Impact Managed Compliance
Keep Your Compliance Program Running.
Getting compliant is only the beginning. Policies need to stay current, risks change, controls need to operate, evidence needs to be maintained, vendors require review, and audits and customer requests continue throughout the year.
Impact Managed Compliance provides ongoing, hands-on support to help keep your compliance program operating, current, and ready.
More Than a Gap Assessment
We Don't Just Identify Gaps. We Help You Address Them.
Impact Managed Compliance is designed to provide hands-on support, not simply identify compliance gaps and leave your team with a list of things to fix.
Impact Risk Advisors helps perform risk assessments, conduct vendor diligence, develop and maintain tailored policies, monitor controls and evidence, manage remediation, prepare for audits, respond to security questionnaires, and keep the compliance program moving throughout the year.
When remediation requires technical implementation, we work with your internal IT team or technical provider to define the requirement, support the remediation process, validate implementation, and track the issue through resolution.
We don't just monitor controls. We help you operate and improve the compliance program behind them.
Impact Managed Compliance Pricing
Ongoing compliance management and support to keep your established compliance program operating, current, and audit-ready.
| Primary Framework | Managed Compliance |
|---|---|
| GLBA Safeguards Rule | Starting at $900/month |
| SOC 2 Security | Starting at $1,100/month |
| HIPAA Security Rule | Starting at $1,050/month |
| NIST 800-53 | Starting at $1,200/month |
| ISO 27001 | Starting at $1,650/month |
Pricing & Scope: Managed Compliance requires a 12-month engagement. Pricing is based on one primary framework, organizations with 1–20 employees, one primary in-scope environment, and typical small-business technology and operational complexity. Additional frameworks, larger organizations, multiple environments, or materially increased complexity are quoted separately. Independent audit, certification, penetration testing, GRC platform, and other third-party costs are separate and are not included in Managed Compliance pricing.
Managed Compliance is an optional ongoing service following implementation. Organizations that already have an established compliance program may also begin directly with Managed Compliance, subject to an initial program review.
From Implementation to Ongoing Compliance
Our implementation pricing reflects the expectation that many clients will continue working with Impact Risk Advisors for ongoing compliance support. This allows us to keep the initial implementation engagement competitively priced while building the program correctly from the outset. After implementation, Impact Managed Compliance provides ongoing support to keep the program operating, current, and audit-ready. Managed Compliance is optional and is not required as a condition of the implementation engagement.
What's Included in Managed Compliance
| Service | Included Managed Compliance Support |
|---|---|
| Compliance Program Management | Manage the compliance calendar, recurring requirements, priorities, and follow-up throughout the year |
| Control Monitoring | Monitor recurring control activities, identify gaps, provide reminders, and follow up on outstanding requirements |
| Evidence Review | Review compliance evidence throughout the year for completeness and audit readiness |
| Policy Management | Annual review and compliance-related updates to existing policies, plus updates when material requirements or the environment change |
| Risk Assessment | Annual risk assessment support, including review and updates to risks, controls, treatment actions, and documentation |
| Vendor Risk Management | Vendor security diligence and risk review for up to 10 vendors per year |
| Security Questionnaires | Completion or support for up to 6 standard customer security/compliance questionnaires per year |
| Remediation Tracking | Track identified compliance gaps, remediation activities, and outstanding action items |
| Audit Readiness | Detailed pre-audit readiness review of required documentation and evidence |
| Audit Support | Up to 30 hours per year supporting audit preparation, auditor requests, evidence questions, follow-up requests, meetings, and audit coordination |
| Compliance & vCISO Advisory | Up to 8 hours per year for compliance, governance, risk, and security advisory support |
| Quarterly Compliance Review | Quarterly 30-minute compliance review meeting covering program status, key risks, remediation, upcoming requirements, and audit readiness. |
| Ongoing Compliance Guidance | Ongoing guidance on routine compliance questions and program requirements |
Service Allowances
Managed Compliance includes the annual service allowances shown above. Annual service allowances apply to each 12-month engagement period and do not roll over. Additional audit support, security questionnaires, vendor diligence, major policy development, significant remediation projects, additional frameworks, and other work outside the defined scope can be provided separately.
Additional Security Questionnaires
Additional questionnaires beyond the annual allowance, or unusually complex questionnaires, can be supported separately based on scope.
Clear Scope. Predictable Support.
Impact Managed Compliance starting prices are based on one primary compliance framework, organizations with 1–20 employees, one primary in-scope environment, and typical small-business technology and operational complexity.
Additional frameworks, SOC 2 Trust Services Categories, entities, environments, significant increases in vendor volume, extensive security questionnaires, complex infrastructure, or other material increases in scope may require adjusted pricing.
Standard framework scope generally includes:
- SOC 2: Security Trust Services Category
- HIPAA: HIPAA Security Rule
- GLBA: FTC Safeguards Rule
- NIST: One agreed NIST SP 800-53 Rev. 5 control baseline for one defined in-scope environment
- ISO 27001: One defined ISMS and certification scope
Additional Services & Client Benefits
Additional Resources When You Need Them.
Managed Compliance clients can also access additional compliance, security testing, technology, and independent audit resources as their needs evolve.
| Additional Service | Managed Compliance Client Benefit |
|---|---|
| GRC Platform | Access to preferred partner pricing where available for supported GRC platforms. Software licensing is separate from the Managed Compliance service. GRC platform administration is available based on scope. |
| Penetration Testing | Access to penetration testing at preferred client pricing, coordinated with your broader compliance and risk requirements. |
| Independent Audits | Access to established audit firm relationships and preferred partner pricing for SOC 2, ISO 27001, and other applicable independent audits. |
| Additional Security Questionnaires | Additional questionnaires beyond the annual allowance, or unusually complex questionnaires, can be supported separately based on scope. |
| Additional Vendor Due Diligence | Additional vendor reviews beyond the included annual allowance are available based on volume and scope. |
| Additional Compliance Frameworks | Additional frameworks can be incorporated into the Managed Compliance program based on scope and complexity. |
| ISO 27001 Internal Audit | Independent ISO 27001 internal audit services are available separately for initial certification and surveillance cycles. |
Ongoing Compliance Management
Compliance Is a Continuous Process.
Impact Managed Compliance helps keep the activities behind your compliance framework moving throughout the year.
- 1
ASSESS
Evaluate requirements, risks, changes, and the current state of the compliance program.
- 2
DESIGN
Develop and improve policies, controls, processes, and supporting documentation based on your actual environment.
- 3
OPERATE
Perform scheduled compliance activities, monitor controls, maintain evidence, review vendors, and keep required documentation current.
- 4
REMEDIATE
Track identified gaps, findings, and control issues and work with responsible teams to move remediation toward completion.
- 5
VALIDATE
Review evidence, validate implementation, support audit preparation, and help address auditor or customer requests.
- 6
MAINTAIN
Keep the compliance program current as systems, vendors, risks, requirements, and the organization change.
GRC Platform Flexibility
Use Your Platform. Add One. Or Don't.
A GRC platform can make compliance management more efficient, but it should support the compliance program, not define it. Impact Managed Compliance can work with the technology approach that makes sense for your organization.
Already Have a GRC Platform?
We can work within your existing platform to manage controls, evidence, risks, policies, remediation, and other compliance activities.
Want a GRC Platform?
We can help evaluate and implement an appropriate platform and provide ongoing administration as part of your Managed Compliance engagement.
Managed Compliance clients may also have access to preferred partner pricing for supported platforms.
Software licensing is separate.
Don't Need a GRC Platform?
That's fine too.
We can manage the compliance program using a structured compliance workspace and defined processes for controls, evidence, risks, policies, vendors, remediation, and compliance activities without requiring an expensive dedicated GRC platform.
Practical Compliance Support
Built Around the Work That Actually Needs to Get Done.
Hands-On Support
We don't simply identify gaps. We help manage the compliance work needed to address them and track issues through resolution.
Tailored, Not Generic
Policies, risks, controls, and compliance activities are based on your actual organization, systems, operations, and requirements rather than a generic template library.
Experienced Guidance
Managed Compliance includes access to experienced security, audit, risk, and compliance guidance, including defined annual vCISO advisory hours.
Technology Flexible
Use your existing GRC platform, add one when it makes sense, or operate without one. The compliance program comes first.
Keep Your Compliance Program Moving.
Whether you have just completed implementation or already have an established compliance program, Impact Managed Compliance can help keep your compliance activities moving throughout the year.
Schedule a ConsultationWe'll discuss your existing compliance program, current responsibilities, framework requirements, and the ongoing support that makes sense for your organization.