What does compliance remediation include?
Compliance remediation turns identified control gaps into implemented technical and operational changes. Depending on scope, that can include access controls, change-management safeguards, evidence collection, data mapping, documentation, testing, and handover. The exact work is agreed from the target framework, system boundaries, existing findings, and the responsibilities retained by your team.
What does SOC 2 readiness support include?
SOC 2 readiness support can include assessing gaps against the applicable Trust Services Criteria, implementing agreed controls, establishing repeatable evidence collection, and preparing documentation for review. Your organization defines scope and owns its controls. An independent CPA firm performs the examination and determines whether it can issue a SOC report.
Does werkwerk perform the SOC examination?
No. werkwerk provides engineering remediation and readiness support but does not perform the independent SOC examination or issue a SOC report. We implement agreed changes and prepare evidence in coordination with your team and, where appropriate, the independent CPA firm responsible for the examination.
Can werkwerk certify an ISO 27001 ISMS?
No. werkwerk can support ISMS implementation, technical remediation, evidence workflows, and certification preparation. Certification is performed by an accredited certification body, which independently assesses the defined scope and decides whether to issue certification.
How do you work with legacy production systems?
We begin with the system as it operates today rather than assuming a greenfield replacement. Changes are prioritized around risk, operational constraints, and the target control. We work within existing tools and release practices, add traceability and safeguards where needed, and document decisions so the resulting controls remain maintainable.
What deliverables does an engagement produce?
Deliverables depend on scope and can include a prioritized findings register, implemented controls, evidence workflows, test assets, operating procedures, implementation records, and handover materials. The engagement definition identifies which artifacts werkwerk produces, which decisions remain with your organization, and what an auditor, certification body, or legal adviser must assess independently.
Does werkwerk provide legal advice on GDPR?
No. werkwerk supports the technical and operational implementation of agreed privacy requirements. Legal interpretation, lawful-basis decisions, and formal conclusions about GDPR compliance remain with your organization and qualified legal or privacy advisers.
Which languages and working model are available?
werkwerk works in English and German. Engagements are embedded and collaborative: work is carried out with your responsible engineering, operations, security, and privacy stakeholders in the tools and codebases relevant to the agreed scope.