Readiness reviews : One control program. Every framework you are held to.
Advice is cheap and everywhere. Proof is what survives an assessment. Each review runs the same way: scope, assess, close the gaps, assemble the evidence, walk in prepared — so when the C3PAO, the QSA, the auditor, or the biggest customer in your pipeline says “show me,” you can.
Pick the trigger that landed on your desk.
Each one is a defined engagement with a defined output. Most firms start with one and add the others from the same control program.
CMMC Level 2 readiness
CUI scoping, gap assessment against the 110 controls, SSP and POA&M, SPRS score, evidence pack, and a mock walkthrough before the C3PAO.
Assessed by a C3PAO
AI governance readiness
AI inventory, provider-versus-deployer mapping, risk classification, human oversight, and the logging that proves how your systems behave.
Certified by an accredited body
Security program readiness
A real ISMS — risk assessment, Statement of Applicability, Annex A controls, and the evidence to take you to certification. Crosswalked to SOC 2, NIST CSF, and CIS.
Certified by an accredited body
Cardholder-data readiness
Scope reduction, the twelve requirements, SAQ or Report on Compliance preparation, and QSA coordination.
Assessed by a QSA
The readiness attestation
Evidence-based proof for boards, primes, and customers when no statutory audit applies. Assessed · Ready · Maintained.
Not an accredited certification
India
DPDP Act readiness and a DPO of record.
Delivered from our India branch: SDF classification, the DPDP obligation set, an India-resident Data Protection Officer, and independent-audit readiness.
India — DPDP, DPO & RBI → ISO 27701 privacy readiness →What a readiness review delivers
- A gap assessment scored against the framework’s controls, the way the assessor scores it
- Scope and classification clarity — the CUI boundary, the cardholder-data environment, the AI inventory
- A prioritised remediation roadmap with owners, effort, and risk flags
- The remediation itself — policies, controls, and the build work, by Golonex or your existing vendor
- An organised, assessor-ready evidence pack that lives in your infrastructure, not ours
- The seat-holder’s name on the plan, and optional Golonex Ready attestation on completion
Comply once, satisfy many.
Most regulated firms carry several frameworks at once. We implement the controls once and crosswalk them, so you do not run four overlapping projects to clear the same control.
Crosswalked from the same control program
SOC 2 reports are issued by a licensed CPA firm; ISO certificates by an accredited body. We deliver readiness and coordinate; we do not issue the report.
Sector security (data-security scope only)
Safeguards for PHI only — not the Privacy Rule or clinical compliance.
Regulations the above help you satisfy
Adjacent and sector-specific frameworks (e.g. ISO 27799 for health, ISO/IEC 23894 for AI risk, FedRAMP alignment) mapped on request.
Frequently asked questions
Does Golonex issue the certification or the assessment result? +
No. We deliver readiness and coordinate the engagement. CMMC assessments are performed by a C3PAO, PCI DSS by a QSA, ISO certificates by an accredited certification body, SOC 2 reports by a licensed CPA firm. Golonex is the preparing side, never the assessing side. We get you ready and stand behind the evidence.
What is in the evidence pack? +
An organised, defensible set of artefacts mapped to the framework’s controls — the System Security Plan or Statement of Applicability, policies, risk assessments, control evidence, and logging records — built so it lives in your infrastructure, not a vendor’s. The seat-holder’s name is on it.
We carry several frameworks at once. Do we run a project for each? +
No. We implement one control program and crosswalk it across every framework you are held to — 800-171, ISO 27001, PCI DSS, SOC 2, CIS. Comply once, satisfy many.
What happens after the review? +
You leave with a scope, a scored gap list, a roadmap, and a name. Most firms then either run the remediation as a fixed project or move into the seat, where the same person who assessed you owns the program, closes the gaps, and keeps you ready between assessments.
Start with a readiness review.
Pick the framework, or bring the trigger. Thirty minutes tells you what you owe and what it takes.