Compliance and Governance Advisory
Verdict Technologies is a regulatory compliance and governance firm. We take on the compliance work for our clients and run it, across federal authorization, commercial assurance, and AI governance, and deliver it through a client portal.
About the advisory service
Verdict is engaged to run a compliance program, not to sell software for a client to run themselves. Our people build and maintain the controls, implementation statements, findings, remediation plans, and evidence references that show a program is real, using a platform we operate ourselves. There is nothing for a client team to install, configure, or staff.
Engagements begin by establishing which frameworks an organization genuinely answers to and which it does not. From there the record is built control by control: how each control is met, the statement that says so, and the evidence behind it. Where a control is not met, that becomes a finding with an owner and a remediation plan rather than a gap that goes unmentioned.
The record is maintained as an ongoing engagement rather than assembled ahead of each assessment. Systems change, baselines change, and monitoring continues, and the record has to keep pace with the environment it describes. Clients review all of it, including what is still open, through a client portal.
Advisory services offered
Three practice lanes. They answer to different regulators and different buyers, and the record each one demands looks different.
Federal Authorization
What an agency, or a company selling to one, has to satisfy before a system can operate or be bought.
Advisory support for organizations pursuing a FedRAMP Certified designation, and for the contractors and agencies operating federal systems. We prepare and maintain the security package across Certification Classes A through D, through the Initial Implementation Phase listing state, and through the continuous monitoring that follows. A provider chooses one path per cloud service offering — 20x, covering Classes A, B, and C, or Rev5, covering Classes B, C, and D — and we work across both. Assessment belongs to the independent assessor, and the Authorization to Operate decision belongs to the agency.
What we produce and maintain
- System security plans covering the applicable NIST SP 800-53 baseline
- Control implementation statements, written to be examined rather than skimmed
- Readiness review ahead of an independent assessor
- Findings and plans of action and milestones, with owners and traceability
- Certification packages prepared for agency review
- Continuous monitoring deliverables and periodic control assessments
- FISMA reporting support
- SSDF attestation records for federal software supply chain requirements
- GovRAMP (formerly StateRAMP) packages for state, local, tribal, and education government cloud services
Commercial Assurance
What a customer, partner, or procurement team asks you to produce before they will do business with you.
Advisory support for organizations whose buyers require proof before they will sign. We run the readiness work, carry it through the auditor or certification body, and keep the record current between cycles. The opinion belongs to the CPA firm and the certificate to the certification body.
What we produce and maintain
- Readiness assessment against the criteria your buyers actually invoke
- Control design, implementation statements, and the evidence behind each
- Risk assessments and, for ISO/IEC 27001, the statement of applicability
- Findings and remediation plans with owners and dates
- Evidence collection across the observation period for a SOC 2 Type II
- Internal audit and management review records for a certifiable management system
- HIPAA risk analysis, safeguard documentation, and policy set
- Support through auditor or certification body fieldwork, and the responses it generates
AI Governance
What an organization building or deploying AI has to be able to show about how those systems are governed.
Advisory support for organizations carrying obligations under the EU AI Act, the NIST AI Risk Management Framework, and ISO/IEC 42001. We inventory the AI systems an organization builds, embeds, and deploys, classify them with the reasoning recorded, and maintain the governance record as the rules move. Where third-party conformity assessment applies, it belongs to a notified body.
What we produce and maintain
- An inventory of the AI systems you build, embed, and deploy
- Role and risk classification for each system, with the reasoning recorded
- AI system impact assessments covering effects on the people subject to them
- Technical documentation and risk management records for systems in scope
- Data governance records covering provenance, quality, and fitness for purpose
- An AI policy and the management system records behind it
- Findings and remediation plans where obligations are not yet met
What we do, and what we do not
- We prepare and maintain the record. We do not assess, audit, or certify it.
- Assessment is performed by an independent assessor, and that independence is structural: the party that builds a package cannot be the party that assesses it.
- An agency Authorization to Operate is the decision of that agency’s authorizing official to accept the risk of running a service for their mission. That decision is theirs alone, and every agency makes its own.
- Certification and conformity assessment belong to accredited certification bodies and notified bodies. We build and maintain what those parties examine.
- Nothing we produce constitutes legal advice.
Contact
Inquiries about advisory engagements, scope, and availability reach us by email.