DOJ Data Security Program annual independent audit
Any U.S. person engaging in restricted transactions under the Data Security Program must have a comprehensive, independent and objective audit once for each calendar year in which it does so, covering the preceding 12 months (28 C.F.R. § 202.1002). We conduct that audit: your data compliance program, your compliance with CISA’s security requirements, and your restricted transactions, with findings you can act on before the next one.
Who it is for
- Companies with vendor, employment or non-passive investment agreements involving covered persons and bulk sensitive personal data.
- Companies whose existing audits (ISO 27001, SOC 2) do not yet expressly address the Data Security Program.
- Boards and officers who must certify the data compliance program each year.
What we assess
- Your data compliance program: risk-based procedures, due diligence and verification of counterparties, written policies, training and the annual certification.
- CISA’s security requirements for each restricted transaction, tested against evidence: organizational and system-level controls and the data-level controls that deny covered persons access.
- Auditable logging and recordkeeping, including the ten-year retention the rule requires.
- Reporting: rejected prohibited transactions (to DOJ within 14 days) and annual reports where they apply.
- Reuse of your other audits where possible: DOJ allows audits done for other purposes, provided they expressly address the Data Security Program’s requirements.
What you receive
- An independent audit report covering the 12 months before the restricted transaction, with findings ranked and evidenced.
- A remediation plan with an owner and a price range for every finding.
- An evidence pack your officer can rely on for the annual certification.
Every engagement has a fixed fee agreed in writing before we start, and we take no referral fee or commission on any product we recommend. Typically three to five weeks of fieldwork, once a year.
Common questions
Who has to have this audit?
Every U.S. person that engages in restricted transactions under the Data Security Program, for each calendar year in which it does so. The audit covers the 12 months preceding the restricted transaction.
Can our SOC 2 or ISO 27001 audit count?
DOJ’s Compliance Guide says companies may use audits completed for other purposes, but the audit must specifically, sufficiently and expressly address the Data Security Program’s requirements. We can scope the work to extend your existing audit rather than duplicate it.
Are you independent?
Yes. We do not sell security products and take no commission on anything we recommend, and we will not audit controls we built for you in the same period.
Book a scoping call
Tell us what is in scope and any deadline. You get a fixed-fee proposal in writing before any work starts, and a mutual NDA before you share anything sensitive.
DOJ DSP annual independent audit
We reply within one business day.
Nothing you send is shared outside Calibre.