Cybersecurity assessment in the United States
U.S. organizations answer to a mix of customer demands and federal rules: a SOC 2 report for your customers, the NIST CSF for your board and insurer, PCI DSS for your bank, and, if any of your people, vendors or investors connect to a country of concern, the Justice Department’s Data Security Program. We assess against whichever of these apply to you, once, and map each control to every framework it serves.
Who it is for
- SaaS and service providers whose customers have started asking for a SOC 2 report.
- Boards, insurers and investors who want one clear picture of cybersecurity maturity.
- Merchants and service providers facing a PCI DSS assessment against version 4.
- Companies with engineers, vendors or investors connected to China, Russia, Iran, North Korea, Cuba or Venezuela, and bulk sensitive personal data.
What we assess against
SOC 2 readiness
A SOC 2 report is issued by a CPA firm. Our work comes before that: we agree which Trust Services Criteria apply, check that a working control exists for each, and test evidence the way an auditor will, so your observation period starts with controls that hold up.
- Security (the common criteria), which every SOC 2 report includes, plus Availability, Confidentiality, Processing Integrity and Privacy where customers or contracts need them.
- Your system description and boundary, and how subservice organizations such as your cloud provider are treated.
- Physical access under CC6.4, tested on site rather than taken from a policy. See SOC 2 CC6.4.
- A recommended report type (Type I or Type II) and observation period start date.
NIST Cybersecurity Framework 2.0
NIST CSF 2.0, published in February 2024, added a sixth function, Govern, and widened the framework beyond critical infrastructure. We assess where you stand on each outcome, agree with leadership where you need to be, and price the work in between.
- All six functions, Govern, Identify, Protect, Detect, Respond and Recover, and the 22 categories and 106 subcategories, rated against evidence.
- Your current profile, an agreed target profile and the gap between them.
- Implementation tiers, from Partial to Adaptive, for how risk is actually managed.
PCI DSS v4.0.1 readiness
Most of the cost of PCI DSS comes from scope. We trace where card data actually goes, check that segmentation keeps everything else out of scope, and assess the requirements against evidence before a QSA, or your self-assessment questionnaire, does.
- Card data flows, the cardholder data environment and the systems connected to it.
- All 12 requirements, including those that became mandatory on 31 March 2025, such as multi-factor authentication for all access into the cardholder data environment and the management of payment page scripts.
- Requirement 9 physical controls, tested on site. See PCI DSS Requirement 9.
- Scope reduction options, and the right validation path: an SAQ or preparation for a Report on Compliance.
DOJ Data Security Program
The Data Security Program (Executive Order 14117, 28 C.F.R. Part 202) restricts and in some cases prohibits U.S. companies from giving countries of concern, and people and companies tied to them, access to Americans’ bulk sensitive personal data and government-related data. Prohibitions applied from April 8, 2025; due diligence, audit and reporting obligations from October 6, 2025.
- Data mapping: which of the six sensitive data categories you hold, against the bulk thresholds over the preceding 12 months, plus government-related data, which is covered at any volume.
- Counterparty analysis: which vendors, employees, contractors and investors may be covered persons, in support of your counsel’s legal determination.
- CISA’s security requirements for restricted transactions, down to the data-level controls that deny covered persons access.
- Your data compliance program: policies, due diligence, auditable logging, training and the annual officer certification.
- For engineering teams split across borders: an architecture that lets covered persons work without access to the data. See the rule, explained.
DOJ Data Security Program annual audit
Any U.S. person engaging in restricted transactions must have a comprehensive, independent and objective audit once for each calendar year in which it does so, covering the preceding 12 months (28 C.F.R. § 202.1002). We conduct that audit.
- Your data compliance program and CISA’s security requirements for each restricted transaction, tested against evidence.
- Auditable logging and recordkeeping, including the ten-year retention the rule requires, and reporting where it applies.
- Reuse of your SOC 2 or ISO 27001 work where possible: DOJ allows audits done for other purposes, provided they expressly address the Data Security Program’s requirements.
How we assess
- One assessment mapped to every framework in scope, so evidence collected for SOC 2 also counts for NIST CSF and PCI DSS.
- Controls tested against evidence and samples, not interviews alone.
- The physical controls these frameworks test, including HIPAA’s physical safeguards and CMMC’s PE domain, checked on site by our own physical security team.
- Cloud configuration where it is in scope. See cloud security audit.
What you receive
- A register for each framework in scope: control, evidence reviewed, rating, owner and fix.
- A prioritized remediation plan with a price range on every item.
- For the Data Security Program: a data and transaction map, and an annual audit report with an evidence pack your officer can rely on.
- A readout for leadership, including which gaps sit on the critical path to your audit date.
Every engagement has a fixed fee agreed in writing before we start, and we take no referral fee or commission on any product we recommend. Typically two to four weeks for one framework, three to eight weeks when several are assessed together or the Data Security Program is in scope. The annual DSP audit is usually three to five weeks of fieldwork.
Common questions
Do you issue the SOC 2 report or PCI DSS attestation?
No. Only a licensed CPA firm can issue a SOC 2 report, and only a QSA can issue a PCI DSS Report on Compliance. We are neither. We prepare you for them, and we have no referral arrangement with any audit firm.
Type I or Type II?
A Type I report covers the design of your controls at a point in time. A Type II report also covers whether they operated effectively over a period, commonly between three and twelve months. Most customers ask for Type II; a Type I can be a useful first report while the observation period runs.
Is the NIST CSF mandatory?
For most private organizations it is voluntary. It is widely used as a common language with boards, insurers and customers, and some contracts and sector regulators reference it.
Does the Data Security Program apply to us?
It applies to U.S. persons, including U.S. companies, that engage in covered data transactions with a country of concern or a covered person involving bulk sensitive personal data or government-related data. The bulk thresholds are low for some categories: human genomic data on more than 100 U.S. persons, biometric identifiers or precise geolocation on more than 1,000, health or financial data on more than 10,000, and covered personal identifiers on more than 100,000, in each case over the preceding 12 months. Data counts even if it is anonymized, pseudonymized, de-identified or encrypted.
We have engineers in China. Is that prohibited?
Not necessarily. Employment and vendor agreements with covered persons are restricted transactions, not prohibited ones. They can continue if you meet CISA’s security requirements, which in practice means the people concerned cannot access the bulk sensitive data, and you keep the due diligence, audit and records the rule requires. Whether a given arrangement is covered is a legal determination for your counsel; we build and evidence the controls.
What are the Data Security Program penalties?
The program is enforced under IEEPA. DOJ’s Compliance Guide cites civil penalties of up to the greater of $368,136 or twice the value of each violative transaction, and for willful violations up to 20 years’ imprisonment and a $1,000,000 fine.
Can you build our DSP controls and also audit them?
Not in the same period. The audit has to be independent, so we will not audit controls we built for you. We take no commission on anything we recommend and sell no security products.
Book a scoping call
Tell us what is in scope and any deadline. You get a fixed-fee proposal in writing before any work starts, and a mutual NDA before you share anything sensitive.
United States
We reply within one business day.
Nothing you send is shared outside Calibre.