Thank you for visiting

Prescient Security and Assurance Audit

We need some information to get started

Select Audits

Please pick the type of audits you are interested in

Type 1 Compliance Report (For example, SOC 1/2/3 or HIPAA or GDPR report etc at a point in time )
Type 2 Compliance Report (For example, SOC 1/2/3 or HIPAA or GDPR report etc. over a period of time)
Non-SOC
ISO Standards
PCI
HITRUST
  • Legal Entity
  • Signatory Contact
  • Project Contact
  • Type 1
  • Type 2
  • Non-SOC
  • ISO Standards
  • PCI
  • HiTrust
  • Scoping Information
  • Confirmation

Legal Entity

Please fill in the following

Fields marked with * are required

* Are you a Delaware C Corp? Or have you claimed your R&D Tax credits yet? Would you like to learn more about how you can get startup tax credits from our CPA partner?
** By opting in, you hereby give us consent to share your contact information with our CPA partners providing tax credit services. This consent can be revoked at any time by emailing privacy@prescientsecurity.com.

Signatory Contact Details

Please provide the following

Project Contact Details

Please provide the following

Type 1 "As of Date" Report

Please provide the following information

*When will you be ready for Type 1 audit?

*Name of the system(s) to be audited

CIS Controls Attestation

IG1

IG2

IG3

Choose a SOC Report Type or skip if you just need a Compliance Report from the following control framework list

SOC 1

SOC 2

Would you like to add additional controls to your SOC report for a fee or get a stand-alone compliance report on any of these frameworks (for Type 1)?

C5

HIPAA

PHIPA

GDPR

CSA STAR

NIST 800-53

FERPA

FISMA

NIST 800-171

NIST CSF

SWIFT CSP

CCPA

HITRUST

Microsoft SSPA

Google CASA

Google MASA

PIPEDA

GLBA

Nacha ACH Audit

Nacha Web Debit Account Validation Rule Audit

NIST RMF AI Assessment

FAIR Risk Assessment

ESG Attestation

FTG Consent Order Data Security

Fedramp

CMMC

CPRA

COPPA

CIS IG1

CIS IG2

CIS IG3

NIS 2 Directive

DORA

EU AI Act

Type 2 "Audit Period" Report

Please provide the following information

*What is the start date of your Type 2 Observation Window?

Please choose a tentative Type 2 Observation End Date

*Name of the system(s) to be audited

Choose a SOC Report Type or skip if you just need a Compliance Report from the following control framework list

SOC 1

SOC 2

Would you like to add additional controls to your SOC report for a fee or get a stand-alone compliance report on any of these frameworks (for Type 2)?

C5

HIPAA

PHIPA

GDPR

CSA STAR

NIST 800-53

FERPA

FISMA

NIST 800-171

NIST CSF

SWIFT CSP

CCPA

HITRUST

Microsoft SSPA

Google CASA

Google MASA

PIPEDA

GLBA

Nacha ACH Audit

Nacha Web Debit Account Validation Rule Audit

NIST RMF AI Assessment

FAIR Risk Assessment

ESG Attestation

FTG Consent Order Data Security

Fedramp

CMMC

CPRA

COPPA

CIS IG1

CIS IG2

CIS IG3

NIS 2 Directive

DORA

EU AI Act

NON SOC Report

Please provide the following information

*When will you be ready for the audit?

*Name of the system(s) to be audited

Please select relevant controls from the following?

C5

HIPAA

PHIPA

GDPR

CSA STAR

NIST 800-53

FERPA

FISMA

NIST 800-171

NIST CSF

SWIFT CSP

CCPA

HITRUST

Microsoft SSPA

Google CASA

Google MASA

PIPEDA

GLBA

Nacha ACH Audit

Nacha Web Debit Account Validation Rule Audit

NIST RMF AI Assessment

FAIR Risk Assessment

ESG Attestation

FTG Consent Order Data Security

Fedramp

CMMC

CPRA

COPPA

CIS IG1

CIS IG2

CIS IG3

NIS 2 Directive

DORA

EU AI Act

ISO Standards

Please provide the following information

Have you hired an internal auditor?

Yes

No

Select ISO Version:

ISO/IEC 27001:2013 - Information Security Management System (ISMS)

ISO/IEC 27001:2022 - Information Security Management System (ISMS)

ISO Additional Controls

ISO/IEC 27701:2019 - Privacy Information Management System (PIMS)

ISO/IEC 27017:2015 - Cloud Service Security

ISO/IEC 27018:2019 - Protection of PII in Public Clouds

ISO 9001:2015 - Quality Management System (QMS)

ISO/IEC 22301:2019 - Business Continuity Management Systems (BCMS)

ISO/IEC 42001:2023 Information technology - Artificial intelligence - Management system

ISO 31700-1:2023 Privacy by Design

ISO 27799 Health informatics — Information security management in health using ISO/IEC 27002

1.

Please provide an overview of your organization.

Min 0 characters. 0 remaining.

2.

Please provide a list of all locations where your organization operates. Include addresses and the main activities carried out at each location (if the organization is not fully virtual with no physical locations).

Min 0 characters. 0 remaining.

3.

Are there multiple entities within your organization that fall under the scope of the management system certification? Please specify their names and locations.

Min 0 characters. 0 remaining.

4.

How many and which geographic locations are included within the scope of your management system? Are there any specific locations it does not cover?

Min 0 characters. 0 remaining.

5.

What is the scope of your ISMS? Are there any specific parts of your organization or certain types of information it does not cover?

Min 0 characters. 0 remaining.

6.

Describe the different products or services (i.e. offerings) that are included within the scope of your management system.

Min 0 characters. 0 remaining.

7.

Please provide details about the departments within your organization that fall under the management system.

Min 0 characters. 0 remaining.

8.

Please provide an overview of your organization's IT infrastructure. How many and what types of systems, servers, networks, and devices are in use?

Min 0 characters. 0 remaining.

9.

What are the primary operating systems, databases, applications, and technologies used within your IT environment?

Min 0 characters. 0 remaining.

10.

Please list and briefly describe the main processes and operations that your organization has outsourced.

Min 0 characters. 0 remaining.

11.

Does your organization currently have a valid ISO 27001 certificate? If so, what is the expiration date?

Min 0 characters. 0 remaining.

12.

Did you perform an internal audit as required by Clause 9 of the ISO/IEC 27001 standard?

Min 0 characters. 0 remaining.

13.

Have you used a management systems consultancy to assist in designing or implementing your information security management system? If yes, please provide details.

Min 0 characters. 0 remaining.

14.

Do you have any ISMS related information (i.e., records) that cannot be made available for review by the audit team because it contains confidential or sensitive information? If yes, please state the reason for the sensitivity and how it is protected.

Min 0 characters. 0 remaining.

Target stage 1 date

Target stage 2 date

Hard Deadline

Please check off any legal or regulatory requirements that apply to your company.

General

GDPR (General Data Protection Regulation) - EU

CCPA (California Consumer Privacy Act) - California, US

PIPEDA (Personal Information Protection and Electronic Documents Act) - Canada

Healthcare

HIPAA (Health Insurance Portability and Accountability Act) - US

HITECH (Health Information Technology for Economic and Clinical Health Act) - US

GDPR (General Data Protection Regulation) - EU

Financial Services

SOX (Sarbanes-Oxley Act) - US

PCI DSS (Payment Card Industry Data Security Standard)

Gramm-Leach-Bliley Act (GLBA) - US

European Market Infrastructure Regulation (EMIR)

PSD2 (Payment Services Directive) - EU

Information Technology

ISO 27001 - International

NIST - Cybersecurity Framework

CIS - Center for Internet Security Controls

Telecommunications

FCC Regulations (Federal Communications Commission) - US

GDPR (General Data Protection Regulation) - EU

Others

Please specify here:

PCI

Please provide the following information

1-

Company Name & Country

2-

Contact

3-

What Payment Channels are supported?

4-

Do you Transmit CHD? Provide a brief description

5-

Do you Process CHD? Provide a brief description

6-

Do you Store CHD?

7-

Other Impact to the security of CHD? Provide a brief description

8-

Do you need to complete a Level 1 ROC or a Level 2 SAQ?

9-

Are you a Merchant or Service Provider?

11-

What was your total credit / debit card transaction count for the prior 12 months?

12-

Is this a 1st Year Assessment?

13-

Do you have any on-premise (company-managed) hardware & software within your cardholder data environment?

14-

IaaS - How many geographic locations are your production systems deployed?

15-

IaaS - How many accounts / projects / subscriptions are in scope?

16-

How many VPCs are your production systems deployed?

17-

How many production sub-networks are in scope?

18-

Listing of Network Security Controls deployed - Firewalls / Security Groups:

19-

Listing of Network Security Controls deployed - Web App Firewalls:

20-

Listing of Network Security Controls deployed - Network Load Balancer:

21-

Listing of Network Security Controls deployed - Application Load Balancer:

22-

Listing of serverless (Lambda, Cloud Run, etc) deployed.

23-

Listing of storage resources deployed - Relational Databases services.

24-

Listing of storage resources deployed - Storage Objects.

25-

Listing of security resources deployed - Identity Management.

26-

Listing of security resources deployed - Key Management.

27-

Listing of security resources deployed - Vulnerability Scanning.

28-

Listing of security resources deployed - Security Event Log Management.

29-

How many connections to Payment Service Providers?

30-

Do you use any card data vaulting / tokenization service providers?

31-

How many Technology Service Providers have connectivity to your CDE?

32-

Technology Service Providers - Identity Providers (Google Workspace, Okta, Azure AD, etc.)

33-

Technology Service Providers - Internal Scan Vendors (Alert Logic, Qualys, Tenable, etc.)

34-

Technology Service Providers - Log Management Service (Datadog, Splunk, etc.)

35-

How many custom E-Commerce Applications?

36-

How many Mobile Applications (apps that accept CHD)?

37-

How many API endpoints accept CHD?

38-

Do you have a current Approved Scanner Vendor (ASV) and current Attestation of Scan Compliance (AOSC) reports available?

39-

Do you have a Penetration Test completed within last 12 months that complies with PCI DSS Requirement 11.3 (External, Internal, and Network Segmentation)?

40-

Do you have an Automated web application security review completed in the last 12 months that complies with PCI DSS Requirement 6.6 (External facing web applications)?

HiTrust

Please provide the following information

Customer's Name & Website

Customer's Contact Details & Address

Please select the desired HITRUST Assessment

Please select from the following if you want to include along with e1 or i1 Validated Assessment

Is it a first time certification? If no, please add the date of the previous certification

If no, please add the total number of requirements validated in previous certification

Have you completed a readiness assessment?

Organization Type: Please choose

Do you offer Infrastructure as a Service (IaaS)?

Entity Type

Number of Records that are currently held in the systems in scope

If answer to (4) is Unknown, what are the number of Individual Records that are processed annually

If answer to (5) is Unknown, what are the total Terabytes of Data Held

Select the appropriate factor where the collection, processing, maintenance, use, sharing, dissemination, or disposition of information occurs

Is the system(s) accessible from the Internet?

Is the scoped system(s) (on premise or cloud-based) accessible by third-party personnel (e.g., business partners, vendors, cloud providers)?

Does the system(s) transmit or receive data with a third-party?

Which regulatory factors do you want to include along with r2 Validated assessment?

When will you be ready for the assessment?

When would you need the report completed by?

What is the type of HITRUST assessment you want to go for?

Have you ever had a HITRUST Audit before?

How many total unique PHI records do you hold currently?

Scoping Information

Please provide the following information

Are you a returning customer??

*Has your organization received any consultancy services related to the management system for which certification is being sought? If yes, please provide the name of the consultancy firm or consultant(s) involved.

*Name of consultancy firm or consultant(s) involved (if above is yes)

*Number of employees and contractors relevant to the scope of the certification

*Number of locations with physical servers owned by you with client data

*Cloud Service Provider

*Number of Internet facing apps and APIs that you have custom built

*Nature of sensitive data stored: PHI/PII/PCI

*Have you experienced any security incidents in last 12 months?

*Have you lost any key employees within last 6 months?

*Are you switching platforms or auditors?

Hard Deadline (for Type 1 Audit)

Hard Deadline (for Type 2 Audit)

Have you had SOC 2 audit before ? If so, what's the current compliance start and end date ?

Start Date

End Date

*Timezone

*Company Size Type

*Region Type

*What is the current readiness status for the chosen frameworks?

*Compliance Automation Platform

*MSSP

Have you hired a vciso/ consultant to support you in readiness ? If so, name them:

Type of Industry your company belongs to

Would you like to get a pen test quote on

Which communication tool do you prefer to use?

How often would you like to meet with our audit team?

* How did you hear about us?

* Who is your compliance platform customer success manager (if any)?

Who is your account manager?

Quick Review

Here is a quick summary. Just click Approve when you are ready.

Name of the Company
Primary Contact Name
Primary Contact Email
Primary Contact No.
Audit Type(s)
Type 1 Audit Start Date
Type 1 Audit Trust Services
Type 1 Audit Additional Controls
Type 2 Audit Period
Type 2 Audit Trust Services
Type 2 Audit Additional Controls
(Non Soc) Date of Audit
(Non Soc) Name of System
(Non Soc) Controls
Pen Test Tier
ISO 27001 Stage 1 date
ISO 27001 Stage 2 date
HITRUST Start date
HITRUST Deadline
HITRUST Assessment type
HITRUST Audit before
HITRUST PHI records

Thank you for your time