Compliance that holds
between audits.
Staying compliant costs less than falling out of it. We keep SOC 2, ISO 27001, CMMC, HITRUST, HIPAA, NYDFS, and cyber insurance defensible every day, not just at audit time.
Free, no-obligation. Typically within 2 business days.
Aligned to the standards enterprise buyers ask for
12+ frameworks tracked continuously • Service-Disabled Veteran-Owned Small Business
The cost
What falling out of compliance actually costs
Three financial exits, all of them larger than the cost of staying current. Each one shows up somewhere other than your security budget, which is exactly why they get missed.
Deals stall when the certificate lapses.
Regulators price non-compliance in millions.
The policy pays out only if the controls held.
Continuous compliance is a line item. A failed audit, an enforcement action, or a denied cyber claim is an event. Events are always more expensive than line items.
The gap
What actually happens between audit cycles
There are three ways to be exposed. Most companies only prepare for one of them.
The certificate says you passed. It says nothing about the months since.
SOC 2 requires continuous evidence across a 12-month observation window. ISO 27001 runs a three-year certificate with mandatory surveillance audits in years one and two. CMMC certifies for three years but requires an SPRS affirmation every year in between. HITRUST runs one- or two-year cycles depending on tier.
You're attesting under your own name.
NYDFS Part 500 requires covered entities to file a signed Certification of Material Compliance every April 15, covering the entire prior year. The CEO and CISO both sign it personally. No auditor is in the room, and NYDFS has issued tens of millions in fines to entities that certified compliance they could not back up with evidence.
Nobody's coming to check on a schedule. That doesn't mean you're off the hook.
HIPAA, SEC Reg S-P, FTC Safeguards, GLBA, state privacy laws, and your cyber liability policy all require ongoing compliance with no routine visit to verify it. FINRA's exams are risk-based, not a fixed date. The exposure surfaces at the worst possible time: a complaint, a breach, an exam, a denied claim, or a certification you signed your own name to.
Standards
Every standard you're held to, organized by how you're actually exposed
Audited on a clock
Self-certified, personally signed
Mandated, never scheduled
Our approach
Compliance as a daily discipline, not an annual scramble
BetweenAudits puts a named Triad advisor behind your program. That is the same person your board, your carrier, and your auditor can point to when the question of ownership comes up.
- Every requirement gets an owner and a cadence, not a binder that sits on a shelf
- Evidence gets captured as the work happens, not reconstructed the week before your audit
- Gaps on the standards nobody schedules a check for get closed before they become a denied claim, a failed exam, or a certification you can't defend
- Posture gets reported in language your executives and your insurer actually use
Continuous readiness protects deal velocity
Treat every day like the week before your audit. No last-minute scramble that delays a certificate, blocks a renewal, or costs you the enterprise deal waiting on it.
Always-on evidence prevents fines and denied claims
Keep a defensible record of what was done, when, and by whom. Capture the proof a regulator, a carrier's forensic team, or your own signed certification demands as the work happens, not reconstructed under pressure.
Staying in costs a fraction of falling out
One failed audit, one enforcement action, or one denied cyber claim outruns years of continuous compliance spend. BetweenAudits is the cheaper side of that math. It protects revenue, coverage, and personal liability, not just a certificate on the wall.
FAQ
Common questions about staying compliant between audits
The standards that govern your business don't pause between audit cycles. Here's what that means in practice.
Most frameworks give you a certificate for a fixed period, then check you again later. SOC 2 Type II requires evidence across a 12-month observation window. ISO 27001 certifies for three years but demands surveillance audits in between. CMMC assesses every three years while requiring an annual SPRS affirmation. HITRUST runs one- or two-year cycles. The gap between those formal visits is where controls drift and evidence goes stale. BetweenAudits keeps your program current during that gap.
Automation platforms collect evidence and map controls, but they still expect your team to run the program: interpret findings, close gaps, coordinate with your auditor, and defend attestations under fire. BetweenAudits is the human layer that runs the program on top of whatever tooling you use. You get a named Triad InfoSec advisor who owns the cadence, closes findings, and stands behind the work when a regulator, carrier, or board member asks who is accountable. We work alongside Vanta, Drata, Secureframe, Hyperproof, or a bare-metal spreadsheet program.
Week one, we inventory the frameworks that apply to you, pull your last audit reports and attestations, and map every requirement to an owner and a cadence. Week two, we identify the highest-risk gaps and build the evidence backlog. From week three forward, your advisor runs a weekly working session, keeps evidence current in your tool of choice, and delivers a monthly posture report your executives and insurer can read. Most engagements are steady-state within 30 days.
Pricing depends on how many frameworks you carry, the size of your environment, and whether you already have a compliance tool in place. Most continuous-compliance engagements land between the cost of a single junior FTE and a fraction of a failed audit or denied cyber claim. We scope every engagement to a fixed monthly fee after a short discovery call, so you can compare it directly against the cost of doing nothing.
The audit proved you were compliant at a point in time. The framework expects you to stay compliant afterward. That means continuing the controls the auditor tested, keeping evidence current, tracking changes, reviewing access, patching systems, and documenting risk treatment. If you stop after the audit, the next assessment starts with drift already in place.
Some rules require ongoing compliance but do not send an auditor on a schedule. HIPAA, SEC Reg S-P, the FTC Safeguards Rule, GLBA, and most state privacy laws fall into this category. FINRA uses risk-based exams. Cyber insurance policies rely on your attestations. You are expected to be ready at all times, with enforcement triggered by a complaint, breach, exam, claim, or self-signed certification.
No. NYDFS Part 500 requires a signed Certification of Material Compliance filed every April 15 by the CEO and CISO, covering the entire prior year. There is no independent auditor validating your answers before you sign. NYDFS has issued tens of millions in fines against entities that certified compliance they could not substantiate with evidence.
A lapsed SOC 2, ISO 27001, CMMC, or HITRUST report can stall or kill enterprise deals, prime contractor opportunities, and channel partnerships. A missed NYDFS certification or a false attestation can trigger enforcement. A cyber claim filed while controls are out of alignment can be denied. The cost of missing usually exceeds the cost of staying ready.
BetweenAudits, a Triad InfoSec offering, turns your compliance program into a continuous practice. We track the standards that apply to you, keep evidence fresh, flag gaps before they become findings, and maintain the documentation you need for the next audit, attestation, exam, or claim.
Still have questions? Get a straight answer from a Triad advisor.
Stay compliant. It's the cheaper side of the math.
Tell us where your program stands today. We'll show you the gap between your last audit and your next one, the standards you're mandated to meet in between, and what one failed audit, one fine, or one denied claim would cost compared to staying ready.