United States · Compliance for growth
Clear US Enterprise Security Reviews and Questionnaires Fast
A US buyer asked for SOC 2, ISO 27001 or AI governance evidence? Get the right report, done for you, on a dated plan.
Did you know SOC 2 or ISO 27001 can cost less than US$10,000, all-inclusive? If you've been quoted more, talk to us before you sign.
100% success, on time: the Sterling Promise
We stay with you until your agreed outcome is achieved, through consulting, audit preparation and the resolution of audit findings. The engagement defines the standard, scope, outcome and responsibilities; your organization puts the agreed controls into use; a US-licensed CPA firm issues the SOC 2 report; an accredited certification body issues the certificate, and that decision stays independent.
Done for you, end to end
We write the policies, set up the controls and evidence, run the internal audit and coordinate the independent audit. You deal with one team from first call to final report.
Simple and quick
A free gap assessment, then one plan with dates from day one. Effivity, our GRC automation platform, is included to keep the evidence moving.
8,100+ client engagements
In 60+ countries over 20+ years, with experts who bring 30+ years of experience.
Under US$10,000, all-inclusive
For most start-ups and SMEs: SOC 2, ISO 27001, ISO 42001, HIPAA or ISO 9001, including the independent audit. A fixed quote follows a free gap assessment.
How Sterling clears US enterprise reviews, done for you
The outcome. You deal with Sterling from first call to finished report. Tools store evidence; they do not write your policies or run your audit. Our consulting does.
1. Free gap assessment. Your product, hosting and documents measured against the standard the buyer named. 2. Policies and controls. Written for how your company really works, then put in place with your team. 3. Evidence. Collected in Effivity, Sterling's GRC automation platform, as a by-product of normal work. 4. Internal audit. Consulting and auditing are always separated: the people who consult never audit you. 5. External body. We coordinate scoping, scheduling and examiner questions. For SOC 2 the report is issued by a US-licensed CPA firm, as AICPA standards require[1]; for ISO, an accredited certification body certifies; for PCI DSS, a QSA performs the assessment and Report on Compliance where one is required, and for SAQ-eligible merchants and service providers we prepare and support the SAQ[2].
See our hubs for SOC 2, ISO 27001, ISO 42001, PCI DSS and HIPAA.
Included in every engagement
Every Sterling consulting engagement comes with the following, so you are not buying extras to get to the finish line:
- Effivity, Sterling's GRC automation platform, with a full-year subscription, to run your controls, evidence, tasks and audits in one place.
- Sterling Academy: preferential course access, with complimentary awareness training for your people.
- Internal auditor training for your audit team, as applicable to your standard.
- For information-security engagements, a vulnerability assessment.
These are part of the engagement, not a separate purchase. The details depend on the standard you are working toward, which we confirm during the free gap assessment.
Consulting and auditing are always separated: the people who consult never audit you. That keeps your internal audit objective and protects the independence of the CPA firm, Qualified Security Assessor or certification body that performs the final step.
Behind this are 8,100+ client engagements in 60+ countries over 20+ years, led by experts with 30+ years of experience.
All-inclusive pricing for start-ups and SMEs
Did you know SOC 2 or ISO 27001 can cost less than US$10,000, all-inclusive? If you've been quoted more, talk to us before you sign.
Sterling's all-inclusive fee for SOC 2, ISO 27001, ISO 42001, HIPAA or ISO 9001 is under US$10,000 for most start-ups and SMEs. It covers our done-for-you consulting and the independent audit: the SOC 2 report from a US-licensed CPA firm, as AICPA standards require, or the certification audit by an accredited certification body. For HIPAA, it covers HIPAA compliance consulting and an independent HIPAA assessment. Effivity, training and a vulnerability assessment are included. That's less than a month's cost of an in-house security hire: the US Bureau of Labor Statistics puts the national median annual wage for information security analysts at $129,180 (May 2025), about $10,765 a month in pay alone[1].
A fixed quote follows a free gap assessment.
What the fee covers, and what it doesn't:
- It is the fee for your first SOC 2 report or your first certification only.
- Annual work is always additional and billed the following year: later SOC 2 report periods, and ISO surveillance and recertification audits.
- It assumes a typical start-up or SME scope: one product or service and one main location.
- Larger or multi-site scopes get a fixed quote after the gap assessment.
- PCI DSS is quoted separately: a fixed quote follows a free gap assessment.
[1] Occupational Employment and Wage Statistics, May 2025: 15-1212 Information Security Analysts, national annual median wage. US Bureau of Labor Statistics. accessed October 23, 2026.
Why US enterprise buyers send a security questionnaire mid-deal
The outcome. You get the evidence your buyer's vendor review needs, on a dated plan, with the deal kept alive meanwhile. Sterling brings 20+ years of practice, 8,100+ client engagements in 60+ countries and a 100% success and on-time completion record.
In US deals the stall usually takes one of four forms:
- Security questionnaire. Access control, encryption, incident response, continuity and vendor questions.
- SOC 2 report request. Often with an ask for the months since the report date.
- ISO/IEC 27001 certificate request. Common when the buyer sells or operates abroad.
- AI governance evidence. How you manage the AI features inside your product.
Each has its own fix and its own clock. The playbook for the first is in our guide to answering security questionnaires.
Which evidence US buyers expect for each request
The outcome. You know exactly which document closes each request, and who issues it.
- SOC 2. The SOC 2 report is issued by a US-licensed CPA firm, as AICPA standards require[1]. We prepare you and coordinate the engagement end to end.
- ISO/IEC 27001 and 42001. An accredited certification body certifies. Sterling does not.
- PCI DSS. A Qualified Security Assessor (QSA) performs the assessment and Report on Compliance where one is required; for SAQ-eligible merchants and service providers we prepare and support the SAQ[2].
- HIPAA. There is no certificate. Buyers review your safeguards and a business associate agreement.
| The US buyer asks | What answers it | Who issues it |
|---|---|---|
| "Send your SOC 2 report" | SOC 2, Type 1 first, then Type 2 | A US-licensed CPA firm |
| "Provide your ISO 27001 certificate" | ISO/IEC 27001 | An accredited certification body |
| "How do you govern your AI?" | ISO/IEC 42001 | An accredited certification body |
| "Confirm PCI DSS compliance" | SAQ or Report on Compliance | A QSA where a ROC is required |
| "Will you sign a BAA?" | HIPAA Security Rule program | No certificate; the buyer reviews your evidence |
What we recommend for most US start-ups (Sterling's recommendation)
The outcome. One control set, mapped to every standard your buyers name, so you never run separate projects.
1. Ask the buyer first. "Would your vendor risk team accept a SOC 2 report, an ISO 27001 certificate, or both?" 2. Selling mainly to US enterprises. Start with SOC 2 Type 1 to unblock the first deals, then Type 2. See SOC 2 Type 1 vs Type 2. 3. Selling beyond the US. Add ISO 27001. See SOC 2 vs ISO 27001. 4. Selling AI to US enterprises. Add ISO/IEC 42001 on top of the security evidence. See the ISO/IEC 42001 hub. 5. Touching card data or patient data. PCI DSS and HIPAA duties apply whatever else you hold.
The US rules behind your buyer's questions
The outcome. You answer a regulated buyer's questions knowing why they ask. Their duties flow down to vendors by contract.
- Non-bank financial institutions. The FTC Safeguards Rule requires covered institutions to select capable service providers, require safeguards by contract and periodically assess them[3].
- US public companies. SEC Regulation S-K Item 106 requires a description of processes to oversee cybersecurity risks from third-party service providers[4].
- US healthcare. The HIPAA Security Rule sets administrative safeguards, and business associate contracts must require compliance and incident reporting[5][6].
- New York financial services. 23 NYCRR Part 500 applies to entities regulated by the state's Department of Financial Services; check the department's published text for your customer.
This page is informational and not legal advice.
How quickly a US team can have evidence in hand
The outcome. A dated plan within days, and an interim package for your buyer while the work runs. These are Sterling's planning ranges for a typical technology company with one product in the cloud, not guarantees.
Interim package. Send a completed questionnaire, your policies under NDA, a recent penetration test summary and a dated statement of the scheduled examination. Never promise a report date you do not control.
| Phase | What you get | Planning range |
|---|---|---|
| Free gap assessment | Prioritized gap list, dated plan, interim buyer response | About 1 to 2 weeks |
| Policies and controls | Policies, risk assessment, controls live, evidence flowing in Effivity | About 4 to 8 weeks |
| Internal audit | Readiness review by people who did not consult on your program | About 2 to 4 weeks |
| SOC 2 Type 1 | CPA firm tests control design and issues the report | Often a few weeks after readiness |
| SOC 2 Type 2 | CPA firm tests operation over an agreed observation period | Several months |
| ISO 27001 or 42001 | Stage 1 and Stage 2 audits, then the certificate | Several weeks after readiness |
How Sterling delivers SOC 2
A SOC 2 engagement has one deliverable that no consultant can hand you: the report. The SOC 2 report is issued by a US-licensed CPA firm, as AICPA standards require[1]. What Sterling does is make sure you get there ready, and that nothing between today and the report lands on your desk.
With Sterling, you deal with one team from start to finish. We coordinate:
- a readiness review and a gap assessment against the Trust Services Criteria;
- the policies, procedures and controls you need, written for how your company actually works;
- evidence collection, so the examination does not become a scramble;
- an internal audit before the examiner arrives, carried out by people who did not advise you on the controls;
- the Type 1 or Type 2 path that fits your deal timeline, and the examination itself, including scheduling, requests and follow-ups.
Our experts bring 30+ years of experience, and the firm has completed 8,100+ client engagements in 60+ countries over 20+ years. You get a single plan, a single point of contact and a clear view of what happens next.
[1] SOC (System and Organization Controls) Suite of Services. AICPA & CIMA. accessed October 23, 2026.
How Sterling delivers ISO certification
ISO management system standards such as ISO/IEC 27001, ISO/IEC 42001 and ISO 9001 are certified by an accredited certification body, not by a consultant[1]. Sterling never certifies. The certificate carries the name of the body that issued it, and that independence is what makes it credible to your buyers.
What Sterling does is prepare your company so that the certification body's audit goes smoothly. We coordinate:
- a gap assessment against the standard;
- the management system itself: scope, risk assessment, policies, procedures and records, sized for your company;
- training for your people and an internal audit before the certification audit;
- management review and corrective actions;
- the certification audit process, from choosing an accredited body to closing any findings.
Consulting and auditing are always separated. The people who consult never audit you, so the internal audit is a genuine test and the certification body's audit is independent.
Sterling has completed 8,100+ client engagements in 60+ countries over 20+ years, and our experts bring 30+ years of experience.
[1] About the IAF MLA (multilateral recognition arrangement). International Accreditation Forum (functions transferred to Global Accreditation Cooperation Inc., 1 Jan 2026). accessed October 23, 2026.
How Sterling delivers PCI DSS
PCI DSS is validated in one of two ways, depending on how you handle card data and what your acquirer or card brand requires. A Qualified Security Assessor (QSA) performs the assessment and Report on Compliance where one is required[1]; for SAQ-eligible merchants and service providers we prepare and support the SAQ.
Either way, you work with Sterling from first scoping call to final submission. We coordinate:
- scoping: where card data is stored, processed or transmitted, and how to shrink that footprint;
- a gap assessment against the current version of the standard;
- the policies, procedures and technical control improvements needed to close the gaps;
- evidence collection and an internal review before anyone external looks at your environment;
- the assessment itself, including scheduling, evidence requests and follow-up questions.
What you receive is a validation of compliance, documented in the form your acquirer or card brand accepts. Our experts bring 30+ years of experience, and Sterling has completed 8,100+ client engagements in 60+ countries over 20+ years.
[1] Become a Qualified Security Assessor (QSA). PCI Security Standards Council. accessed October 23, 2026.
Why done-for-you beats tool-only
A compliance tool is software. It can track tasks, collect evidence and show you a dashboard. What it cannot do is decide what your scope should be, write policies that match how your team really works, interview your engineers, or sit across from an examiner when a question is unexpected.
That work still has to be done by someone. With a tool-only approach, that someone is usually a founder or an engineering lead, which means a few weeks of product time quietly turns into a few months.
Done-for-you consulting changes who carries the load:
- we scope the program so you are not controlling more than you need to;
- we write the policies and procedures, and we show your team the few things they must actually do;
- we collect and check evidence, and run an internal audit before the external one;
- we coordinate the final step, so you have one plan and one contact.
Tooling still matters, which is why Effivity, our GRC automation platform, is included in every engagement. The difference is that it is run by people who have done this for 20+ years across 8,100+ client engagements in 60+ countries.
Get your US buyer's request cleared
See how we work with US teams. Get started with a short call and we will map your buyer's ask to a dated plan.
Sources
1. System and Organization Controls: SOC Suite of Services. AICPA & CIMA. accessed October 23, 2026.
2. PCI DSS and PCI Security Standards Council qualified assessors. PCI Security Standards Council. accessed October 23, 2026.
3. 16 CFR 314.4 Elements (Standards for Safeguarding Customer Information). Electronic Code of Federal Regulations (FTC Safeguards Rule). accessed October 23, 2026.
4. 17 CFR 229.106 (Item 106 of Regulation S-K) Cybersecurity. Electronic Code of Federal Regulations (SEC). accessed October 23, 2026.
5. 45 CFR 164.308 Administrative safeguards. Electronic Code of Federal Regulations (HHS HIPAA Security Rule). accessed October 23, 2026.
6. 45 CFR 164.314 Organizational requirements. Electronic Code of Federal Regulations (HHS HIPAA Security Rule). accessed October 23, 2026.
Information only
The information on this page is provided for general informational purposes only. It is not legal advice, and it is not a substitute for advice from a qualified attorney about your own situation.
Requirements depend on your scope, your customers' contracts, your industry and the regulations that apply to you. Two companies asking for the same standard can have very different obligations. We confirm yours during a gap assessment, and we update our content as standards change, but you should check the current text of any standard or rule that matters to you.
Sterling consults and prepares. It does not decide whether you meet a standard. That decision belongs to the independent party that performs the final step: the US-licensed CPA firm for a SOC 2 report, the Qualified Security Assessor or acquirer for PCI DSS, and the accredited certification body for ISO certificates. Timelines and outcomes depend on your readiness and on those parties.
Standards and marks named on this site belong to their respective owners.
FAQs
Frequently asked questions
Can we answer the questionnaire first and get the report later?
Yes, and you usually should. Answer accurately, attach the policies you can share under NDA, and add a dated statement describing the planned SOC 2 examination or ISO audit. Do not claim controls you have not implemented. Reviewers compare questionnaire answers with the report later, and a mismatch costs far more trust than "in progress." We draft the interim package in the first weeks of the gap assessment.
Does SOC 2 or ISO 27001 satisfy a US enterprise buyer faster?
It depends on the buyer, so ask which they accept. In Sterling's experience, US enterprise procurement teams usually name SOC 2, while international and public-sector buyers often name ISO 27001. A single control set can be mapped to both, which is how we plan the work. Our SOC 2 vs ISO 27001 guide compares the two.
What is the difference between a SOC 2 Type 1 and Type 2 report?
A Type 1 report describes whether controls were suitably designed at a point in time. A Type 2 report also tests whether they operated effectively across an observation period. Many companies start with Type 1 to unblock early deals, then follow with Type 2. The CPA firm that examines you issues either report. See the Type 1 vs Type 2 guide.
Who issues the SOC 2 report if Sterling prepares us?
The SOC 2 report is issued by a US-licensed CPA firm, as AICPA standards require. Sterling prepares your controls and evidence, runs the internal audit and coordinates the engagement so you deal with one team, but the examiner forms the opinion independently. That independence gives the report its value to your customers.
Our US buyer asked for AI governance evidence. Where do we start?
List the AI systems in your product, the data they use and who their outputs affect, then document how you assess and monitor risk. ISO/IEC 42001 gives that work a structure an accredited certification body can audit. We build it alongside your security program so evidence is shared, not duplicated.
Do we need PCI DSS if we use a payment processor?
Possibly. If card data never touches your systems, your obligations may be limited, and your acquirer or processor will tell you which Self-Assessment Questionnaire applies. If your product stores, processes or transmits card data, or affects its security, you may need a fuller assessment. Confirm your validation level with your acquirer or processor; we prepare you for it.
Our customer is a US hospital. What do they need from us?
Expect a business associate agreement and a questionnaire built on the HIPAA Security Rule safeguards. Many hospitals also request a SOC 2 report as supporting evidence, although the rule itself does not require one. We build the risk analysis, policies and technical safeguards the rule describes, then assemble the evidence the hospital's review will examine.
How do we keep this from becoming a second full-time job?
We scope narrowly, build one control set for several standards and automate evidence collection in Effivity so owners spend minutes, not days, each month. Internal auditor training for your audit team and awareness training for your staff, both included, keep the program running after the first cycle.
Keep exploring
More in Compliance for US Growth Companies, Done for You
Compliance for US Growth Companies, Done for You
Free gap assessment
Start with a free gap assessment
Not sure where you stand? Start with a free gap assessment. In one conversation, a Sterling consultant looks at what your customers, investors or contracts are asking for, compares it with what you have in place today, and tells you what is missing, in what order to fix it and how long it is likely to take.
usa@sterling-grc.com+1 201 263 4443 (global headquarters) · A Sterling consultant replies within one working day
What would you like to achieve?
Choose a starting point. The enquiry form asks for your name, work email, phone with country code and company.
Book my free gap assessmentContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice