About
Security and compliance, without the heavy lifting
Lightwork Security & GRC helps growing companies prepare for and pass security audits, and builds programs that keep them audit-ready year after year.
What we do
We get you audit-ready and keep you there
We are a security and GRC (governance, risk and compliance) consultancy. We help companies earn the certifications and reports their customers ask for, and build security programs that actually work day to day.
Audit readiness
SOC 2, HITRUST, ISO 27001 and ISO 42001: from scoping and gap assessment to remediation, evidence and audit-day support.
Security leadership
vCISO services that give you an experienced security leader for strategy, customer questionnaires and board reporting.
Ongoing compliance
Support between audits so policies stay current, evidence keeps flowing and the next audit is routine.
How we simplify the audit
Audits don’t have to be painful
One clear plan
You get a prioritized roadmap with owners and dates, so everyone knows what to do and when.
We do the heavy lifting
We draft the policies, build the control matrix, map the requirements and organize the evidence. Your team focuses on the work only they can do.
Evidence collected once
We map controls across frameworks, so evidence gathered for SOC 2 also counts toward ISO 27001, HITRUST and ISO 42001.
No surprises on audit day
A readiness review (mock audit) finds gaps before the auditor does.
We sit beside you during fieldwork
We coordinate with your auditor, answer requests and help resolve findings quickly.
Plain language, always
No jargon walls. We explain what each requirement means for your business and why it matters.
Our approach
We follow the Lightwork Method: scope, assess, remediate, confirm readiness, support the audit, then maintain. Every engagement has a fixed scope, clear milestones and deliverables you keep.
What we believe
- Security should enable growth, not block it
- Right-sized controls beat 200-page binders
- Evidence should be collected once and reused
- Independence matters: we prepare you, independent auditors assess you
Frameworks we cover
SOC 2 · HITRUST CSF · ISO/IEC 27001:2022 · ISO/IEC 42001:2023 · and related frameworks including HIPAA and NIST.
We work alongside independent CPA firms, certification bodies and HITRUST assessors, and with leading compliance automation platforms.
Bring your next audit into the light.
Book a free 30-minute consultation. We will map where you are, what your customers need and the fastest path to get there.