Compliance and assurance in the United States
Support for organisations preparing for SOC 2, meeting enterprise security expectations and governing AI and personal data under requirements that apply in the United States.
US enterprise customers commonly ask their suppliers for a SOC 2 report, evidence of security governance aligned to recognised frameworks, and increasingly an account of how AI is governed. Those requests often arrive during a sales process and need a structured response.
We help organisations prepare for independent examination, build governance around the NIST frameworks where customers expect them, and put privacy and AI governance on a sound footing.
Typical organisations
- SaaS and technology companies
- AI companies
- B2B organisations selling to enterprise customers
- Growth companies entering enterprise procurement for the first time
Relevant services
SOC 2 readiness
Readiness for Type 1 and Type 2 examinations by a licensed CPA firm.
ISO 27001 & information security
For customers who ask for international certification, often alongside SOC 2.
vCISO & GRC advisory
Security leadership, NIST-aligned cyber governance and ongoing GRC support.
AI governance & ISO 42001
AI governance, NIST AI RMF alignment and ISO 42001 readiness.
Privacy & data governance
Privacy programme support for applicable state requirements.
Frameworks US customers commonly reference
NIST Cybersecurity Framework 2.0
Published by NIST in February 2024 and widely used as a reference for security governance.
NIST AI Risk Management Framework
A voluntary framework for managing AI risk, published by NIST in January 2023.
ISO/IEC 42001
An international management system standard for AI, certifiable by an independent certification body.
SOC 2 independence
A SOC 2 examination is performed, and the report issued, by an appropriately licensed CPA firm. Pixelette Certified provides readiness, implementation and coordination support, and does not issue SOC 2 reports.
Legal advice
We do not provide US legal advice. Where a privacy or regulatory question requires legal interpretation, appropriately qualified US counsel should be involved.
Discuss your requirements
Tell us what you need to achieve and where the requirement applies. We will establish the appropriate route and expertise for the engagement.