Services · Compliance and vCISO
Walk into every audit already prepared.
AlignASSURE is our governance, risk, and compliance program. Leadership gets a clear picture of your real risks, evidence is ready before anyone asks, and compliance becomes a steady rhythm instead of a fire drill.
Risk assessment in as soon as 30 days
Works with any IT provider
HIPAA, CMMC, NIST, SOC 2, and more
Sound familiar?
Compliance shouldn’t be a once-a-year scramble.
The audit is the only deadline
Evidence gets pulled together in a panic, then the program goes quiet until next year.
No one owns security at the top
A full-time CISO isn’t realistic, so risk decisions get made by default.
Questionnaires keep getting harder
Customers, insurers, and contracts ask for policies and proof that aren’t in one place.
Leadership can’t see the risk
Technical reports don’t translate into decisions the board can make.
What changes
What the program delivers.
Governance, risk, and compliance leadership that runs all year, without the cost of a full-time hire.
01
You know your real risks, and what they’d cost
A calibrated picture of the three to five scenarios that could actually hurt you, with loss estimates in ranges and a plan ordered by risk reduced per dollar.
02
Risk decisions on the record
Exceptions and policies carry a named owner and an expiry, and recommendations you decline are recorded as accepted risk, so every risk decision is documented.
03
Proof ready when anyone asks
When an insurer, customer, auditor, or board member asks how secure you are, the evidence is already organized and current.
04
Ready when something goes wrong
Leadership knows who does what in an incident, in what order, and by when, and critical systems have a documented recovery order.
05
Vendors and AI under control
The vendors that hold your data are screened before and after adoption, and AI tools are inventoried, vetted, and governed by a policy your staff have signed.
06
Leadership sees the investment working
Every quarter answers “what are we paying for” with a scorecard, a roadmap, and closure on what was promised last quarter.
How the program works
From a clear picture of risk to a program that keeps running.
1
Security Risk Assessment
We find the handful of scenarios that could actually hurt you, estimate what they’d cost, compare your controls against the standard you need, and deliver a costed roadmap. As soon as 30 days after we receive your inputs.
2
Program stand-up
The assessment becomes a running program: a governance platform, a risk register with named owners, an incident response plan, a program charter, and a cadence calendar. Targeted for 60 to 90 days after the read-out.
3
Ongoing program
Quarterly security briefings, a living risk register, incident readiness with an annual tabletop, vendor and AI governance, threat advisories, and an evidence library that stays current, re-baselined every year.
Frameworks we align with
Built for the requirements you actually face.
Select a framework to see what it covers, who it applies to, and how we help.
HIPAA
The federal rules for protecting patient health information.
Who it applies to
Health plans, healthcare clearinghouses, and healthcare providers that conduct standard transactions electronically, plus the business associates that handle protected health information on their behalf.
How we help
A documented risk analysis, administrative, physical, and technical safeguards put into daily practice, current policies and training records, and evidence ready when an auditor or partner asks.
AlignLayerNine helps you build, run, and demonstrate alignment with these frameworks. We do not act as an assessor, provide compliance attestation or certification, or make affirmations on your behalf.
The details
What’s included in AlignASSURE
Everything behind the outcomes above, for the people who want the full list.
Phase 1: Security Risk Assessment
A calibrated picture of the three to five scenarios that could actually hurt your organization, with loss estimates in ranges. An external review of your public footprint and an internal vulnerability and asset baseline. A vendor and third-party screen, plus an inventory of AI tools and unsanctioned apps. Compliance applicability, a control-gap crosswalk, and a cyber insurance alignment review. A prioritized, costed roadmap sequenced by risk reduced per dollar, presented in a read-out for leadership. Delivered as soon as 30 days after we receive your inputs.
Phase 2: Program stand-up
A governance platform of record with your framework baseline, risk register, and evidence library. A risk register with named owners and a signed risk appetite statement. A plan of action and milestones with owners and dates. An incident response plan with escalation paths and a recovery order for each critical system. A program charter, cadence calendar, and launch roadmap. Targeted for 60 to 90 days after the risk assessment read-out.
Phase 3: Ongoing program
Quarterly security briefings with a program scorecard and a board-format view where applicable. A living risk register, with every risk acceptance signed and reviewed before it expires. Incident readiness, including an annual tabletop walkthrough with leadership. Third-party risk management and AI governance with an attested acceptable-use policy. Client-specific threat advisories. An evidence library with freshness tracking. Human-risk metrics from your awareness platform. Audit readiness with an annual pre-audit gap check, and an annual re-baseline.
Frameworks
Built around one primary framework, such as CIS Controls, NIST CSF, HIPAA, SOC 2, ISO 27001, GDPR, or CMMC Level 1, with more added one at a time. A dedicated federal track covers CMMC Level 2, NIST SP 800-171, and NIST SP 800-53. The governance platform and policy development are included, and every document, register, and evidence export the program produces is yours to keep.
What’s not included
Compliance attestation, certification, or acting as an assessor or auditor. Legal advice and insurance coverage advice. Incident response execution and forensics. Remediation labor, which is tracked on your plan and carried out by your IT provider, or by us under AlignCORE.
How it fits together
One partner, built to fit together.
AlignCORE is the foundation, and AlignSHIELD builds on it. AlignASSURE and IT Strategy work on their own or alongside either.
The foundation
AlignCORE
Fully managed or co-managed IT: support, monitoring, and protection for every user and device.
Learn more →
Add-on to AlignCORE
AlignSHIELD
Advanced defense and financial protection, built on top of AlignCORE.
Learn more →
Stands on its own
AlignASSURE
vCISO leadership and a compliance program, with or without AlignCORE.
You are here
Direction
IT Strategy
A roadmap and a budget your leadership can act on.
Learn more →
Questions
What people ask first.
Do you certify that we’re compliant?
No. We help you build, run, and demonstrate alignment. Certification and attestation come from independent assessors and auditors, and we help you prepare for them.
Do we have to use AlignLayerNine for managed IT?
No. AlignASSURE serves as the governance authority for your environment, whoever provides your day-to-day IT. Remediation items are tracked on your plan and handed to your IT provider.
What do you need from our leadership?
Time and decisions. Risk appetite, policy approval, and risk acceptance belong to your executive team, so the program needs a named executive sponsor who takes part in the assessment read-out and the quarterly briefings.
We had a risk assessment done recently. Do we start over?
No. If you’ve had a third-party security risk assessment in the past twelve months, or you’re already an AlignLayerNine managed services client, we build on it, complete what it doesn’t cover, and move to stand-up.
What if a new requirement comes up?
A material change, such as a new regulatory or contractual obligation, an acquisition, a new critical system, an insurer or customer demand, or an incident, triggers a re-evaluation and a roadmap update.
Turn compliance into a business advantage.
Let’s start with where you are today and where you need to be.