Compliance assessment helps reveal and close gaps in a company’s policies, procedures, software, and IT infrastructure that fall under industry-specific or commonly applicable regulations. Compliance assessment may include:

Reviewing the security and/or quality assurance policies and procedures.
Security testing of software and/or IT networks.
Evaluating the employees’ awareness of applicable standards and regulations.
Remediation aid to close compliance gaps.

Standards We Work With and Companies We Serve

ScienceSoft helps enterprises in 30+ industries check and improve their compliance with mandatory and voluntary regulations and standards. To software vendors, we offer the evaluation of their products, development processes, and IT environments against quality and security standards.

ISO 9001 (voluntary)

For software product companies and other IT businesses aiming to establish mature quality management systems.

ISO 27001 (voluntary)

For companies that need to protect sensitive data they collect, store, process or transmit, including:

IT companies.
Businesses in the financial industry.
Government agencies.
Telecom service providers, etc.

ISO 13485:2016 (voluntary)

For companies interested in establishing quality management systems for designing, producing, installing and servicing medical devices:

Medical device manufacturers.
Healthcare software vendors.

HIPAA (mandatory)

For companies involved in storing, processing or transmitting personal health information:

Healthcare providers.
Healthcare companies’ business associates.
Medical device manufacturers.
Healthcare software vendors.

PCI DSS (mandatory)

For businesses accepting payment cards of American Express, Discover, JCB, MasterCard and Visa or directly involved in the processing, storage, or transmission of cardholder data:

Merchants.
Service providers.

PCI Software Security Framework (voluntary)

For software product companies delivering payment solutions.

GDPR (mandatory)

For companies involved in collecting, storing, processing and transmitting personal data of EU residents:

Any entity dealing with personal data of EU residents in the course of their business activities.
Software vendors, delivering software that will operate with EU residents’ personal data.

NIST Security Framework (mandatory)

For US federal agencies and their contractors:

Businesses that provide services to the federal agencies.
Vendors developing software products for the federal agencies.

NYDFS Cybersecurity Regulation (mandatory)

For all the DFS-regulated entities operating in New York state and their third-party service providers.

Banking institutions.
Insurance providers.
Other financial services companies.

SOC 2 (voluntary)

For any service providers that want to ensure and prove their customers’ data security, including:

Cloud services providers.
SaaS companies.
Managed IT services providers
Financial services companies.
Government agencies, etc.

Our Compliance Assessment Service Scope

Compliance scope outline

Defining mandatory standards and voluntary standards that will bring competitive advantage to a business or software product.
Outlining the compliance requirements applicable to the company’s business activities or software specifics.
Identifying the components of the IT environment and the staff members that the compliance requirements apply to.

Reviewing policies and procedures on security and quality management

Scrutinizing the existing policies, procedures, processes.
Evaluating how well the documented policies and procedures are integrated in the routine business activities.

Assessing the employees' compliance awareness

Interviewing the staff members on the applicable standards and regulations.
Applying social engineering to check the employees’ security awareness.
Reviewing the training process and materials.

Security testing of the IT infrastructure and software

Vulnerability assessment.
Black box, white box, gray box penetration testing.
Software architecture and source code review.

Compliance gap analysis

Compliance risk assessment based on the detected compliance gaps.
Prioritizing the detected compliance gaps by their criticality.

Developing a remediation plan to achieve compliance

Advising on how to eliminate the gaps in policies and procedures for assured compliance with the required standards.
Recommendations for promoting compliance awareness of the staff.
Suggesting measures to eliminate vulnerabilities in software and IT infrastructure.

ScienceSoft brings in expertise in cybersecurity, software development and IT consulting to perform any required remediation activities. They may include:

For all companies

Designing a secure network architecture.

Installing and configuring firewalls, anti-malware, IDS/IPS.
Ensuring email security.
Deploying a SIEM solution to monitor user activity within the network.
Building a quality management system.

Specific for software vendors

Installing and configuring security components in the development infrastructure.
Designing secure and efficient software architecture.
Implementing software features required by the applicable standards.

Compliance Assessment Service Deliverables

ScienceSoft’s compliance team prepares a series of reports to offer a clear insight into the assessment process and discovered incompliances. To address them, we deliver a roadmap on compliance breach remediation. Depending on a specific project, we can provide:

Assessment deliverables

Compliance scope report (contains the inventory of data, software, and network components subject to compliance).
Compliance risk report.
Report on the existing gaps in the IT policies and procedures.
Report on the staff’s compliance awareness.
Report on the state of compliance training materials.
Network configuration diagrams.
Software architecture and source code review reports.
Penetration testing and VA reports describing and prioritizing the vulnerabilities that lead to incompliance.

Recommendation deliverables

Recommendations on scope reduction: limiting the number of IT assets or employees with access to sensitive data, etc.
Compliance risk mitigation plan.
Recommendations on improving policies and procedures.
Secure network architecture design.
Recommendations on software features required by applicable standards.
Recommendations on training process and materials to raise the staff’s compliance awareness.
Recommendations on corrective measures needed to remediate the revealed vulnerabilities.

Our Customers Say

"ScienceSoft provided an excellent level of service in:

Code assessment of our existing healthcare application for life science research;
Consulting on best practices and standards in healthcare and life science software development;
Research on medical devices (functionality, safety classes, registration, etc.) to be used in the future project;
Preparation activities for a planned platform development project: architecture planning, verification planning, software development lifecycle processes, risk management processes.

They bring top quality talents and deep knowledge of IT technologies and approaches in accordance with ISO13485 and IEC62304 standards."

Sergey Shleev, Prof. Dr. Department of Biomedical Science, Malmo University

read original

Why Choose ScienceSoft

In IT since 1989.
20 years in information security services.
15 years in establishing effective quality management systems.
Hands-on experience with regulatory standards for 10+ industries, including healthcare, banking, insurance, retail, manufacturing, and professional services.
Certified Internal Auditors for ISO 9001, 13485, 27001 on the team.
Certified Ethical Hackers on board, recognized as Top Penetration Testing Company by Clutch.
A top HIPAA consulting provider in 2022, according to Atlantic.net.
For the second straight year, ScienceSoft USA Corporation is listed among The Americas’ Fastest-Growing Companies by the Financial Times.

Compliance Assessment Challenges We Handle

Challenge #1

It may be hard to find a compliance assessment vendor well versed in several standards applying for a specific industry or software type.

Solution

Solution

With 33 years in IT and hands-on experience in 30+ industries, our compliance consultants and security experts are knowledgeable in various standards and business domains.

Hide

Challenge #2

A high-level assessment of compliance gaps is just one little step — it is crucial to competently remediate them.

Solution

Solution

Our assessment is followed by actionable recommendations on how to achieve compliance on the strategic and technical levels. If needed, ScienceSoft can proceed with the remediation of the incompliances revealed during the assessment.

Hide

ScienceSoft as a Compliance Assessment Vendor: Success Stories

Quality Assessment and HIPAA Compliance Evaluation of a Patient Portal for a US Healthcare Service Provider

To check if the patient portal complies with HIPAA Security Rule, ScienceSoft conducted vulnerability scanning, malware detection, penetration testing, and source code review.

Project details

ISO 27001 Pre-Audit for an International Financial Technology Company

ScienceSoft's IT security consultants performed the gap analysis of the Customer’s information security management system to help them prepare for the ISO 27001 compliance audit.

Project details

Network Vulnerability Assessment Focusing on PCI DSS for a US Mobile Services Provider

ScienceSoft revealed over 300 security issues in the Customer’s internal IT infrastructure, including the critical ones that could endanger cardholder data. After fixing these vulnerabilities, the Customer successfully passed PCI DSS validation.

Project details

Penetration Testing for Reconice to Improve ePHI Security

ScienceSoft’s cybersecurity experts imitated a real-life hacking attack on the application to provide a medical speech recognition software vendor with a list of vulnerabilities and a thorough mitigation plan to protect ePHIs as required by HIPAA.

Project details

Magento Support, Upgrade, and PCI Compliance Evaluation for an Enterprise Safety Provider

ScienceSoft upgraded the Magento website and helped make it PCI -compliant. We fixed the security issues detected during the previous PCI DSS audit and performed a new compliance assessment to be sure that all PCI requirements were met.

Project details

Choose Your Service Option

Compliance assessment

We offer one-time or continuous compliance assessment to check how well your company or software meets the required cybersecurity or quality assurance standards.

I need this

Compliance assessment and remediation advice

If we detect compliance gaps, we provide remediation guidance to manage compliance risks and ensure your company or software meets the applicable standards.

I need this

Compliance assessment and breach remediation

Our compliance consultants work together with cybersecurity experts and software engineers to remediate any compliance breaches detected during the compliance assessment.

I need this