Scope it properly, once.
Three short steps. You receive a written proposal with approach, deliverables, named roles, effort and exactly what you will hold at the end.
Tell us about the engagement.
Approximate answers are fine. Nothing here commits you to anything.
Before you ask.
Do I need to know exactly which standard applies?
No. Choose “Not sure” and describe your situation. Working out what genuinely applies is part of scoping.
Who issues the final report or certificate?
Formal opinions come from the body each scheme requires: a QSA for PCI DSS, a 3PAO for FedRAMP, a C3PAO for CMMC, a CPA firm for SOC reports and an accredited certification body for ISO. MarkTillson does the hard part before they arrive: scoping, engineering, remediation and evidence, so the assessment confirms what we already proved. We work alongside your assessor throughout.
What should I avoid sending through this form?
Credentials, cardholder data, personal data about others and details of unpatched vulnerabilities. We will agree a secure channel for sensitive material.
Will you sign an NDA before scoping?
Yes, gladly, before you share architecture, findings or other confidential detail.