dataSMC
01Services

Compliance & resilience

Be prepared. Keep moving.

Auditors, insurers and customers increasingly ask the same questions: what are your controls, can you prove them, and what happens on a bad day? We turn policy into everyday practice, build continuity plans people can actually use, and keep the evidence ready before anyone asks.

  1. Standards
  2. Contracts
  3. Insurers
  4. One set of controlsPlain rules, named owners
  5. EvidenceCollected as you go
  6. Continuity planRehearsed
What you must show, shown.Every obligation becomes a control. The controls produce their own evidence, and the continuity plan behind them is rehearsed — so the answer to an audit is already on file.

01.1Without it

What usually goes wrong.

  • Policies nobody follows.Documents written for an audit, filed away and forgotten by the people they describe.
  • Evidence gathered in a panic.Every audit or insurance renewal turns into weeks of screenshots and spreadsheets.
  • A continuity plan nobody has read.When the bad day comes, the plan is out of date, or can’t be found.

01.2What it covers

Four parts of one job.

  • Policy & governancePlain rules, clear owners and regular reviews.
  • Continuity planningHow the business keeps going when a system, a site or a supplier doesn’t.
  • Recovery readinessTested recovery for the systems that matter most.
  • Audit evidenceProof of your controls, collected as a matter of course.

Works to the frameworks you answer to

  • PCI DSS
  • SOC 2
  • ISO/IEC 27001
  • GDPR
  • HIPAA
  • Cyber insurance

Where it hands over

01.3How it runs

Four steps, then it keeps running.

Scoped and priced before it starts: a fixed fee for the first phase, then a monthly fee for what carries on. Stop after the first phase and you keep everything.

  1. 01Start from what you must showThe standards, contracts and insurers that apply to you, turned into one list of controls.
  2. 02Make policy practicalShort, plain rules built into how people and systems already work.
  3. 03Collect evidence as you goRecords gathered from the systems themselves, not assembled before each audit.
  4. 04Plan and test for the bad dayContinuity plans for the scenarios that would hurt most, rehearsed with the people who would run them.

After the first phaseTypically 8–12 weeks

  • Your obligations turned into one list of controls, each with an owner.
  • Short, plain policies people can follow.
  • Evidence collected from the systems themselves.
  • A continuity plan for the scenarios that would hurt most.

Then, every month

  • Evidence kept current, ready for the next audit or questionnaire.
  • The continuity plan rehearsed, and updated when the business changes.
  • A hand through each audit and insurance renewal.

What we need from you

  • The standards, contracts and insurance terms that apply to you.
  • A sponsor who can approve policy.
  • Time with the people who would run the business on a bad day.

01.4What you get

What is different afterwards.

  • Evidence ready before anyone asks.Audits and questionnaires answered from records you already keep.
  • A continuity plan people have actually read.Short, current and rehearsed.
  • Resilience you can demonstrate.To customers, insurers and your own board.

01.5Where it matters most

Where it carries the most weight.

A case · HospitalityWhen the line drops, guests still check in.A second route that takes over on its own.A field note · 24 Sept 2026The first hour of an incident decides the next month.4 min read

01.6Straight answers

What people ask about it.