Free service guide · PDF

The SOC 2, HIPAA and NIST CSF Readiness Roadmap

A practical path from the first questionnaire to audit-ready evidence, whichever framework your customers or regulators expect.

How to tell which framework you need from the requests you're receiving
A six-stage roadmap from scoping to audit and beyond
A control map showing where one control serves SOC 2, HIPAA and NIST CSF
A readiness checklist, partner questions and a 90-day plan

12 pages27-item checklist30/60/90-day plan

Cover of The SOC 2, HIPAA and NIST CSF Readiness Roadmap

Get your free copy

Instant PDF download. No sales pitch inside.

Cover and two sample pages of The SOC 2, HIPAA and NIST CSF Readiness Roadmap, a free 12-page PDF guide from Alpiba with a 27-point checklist — A look inside: the cover and two pages from the 12-page PDF.

What's inside

Inside the guide.

SOC 2, HIPAA and NIST CSF look like three different projects. In practice they ask for many of the same things: named accounts with MFA, reviewed access, encrypted devices, monitored systems, tested backups, a rehearsed incident plan, vetted vendors and trained staff. The differences lie in who asks, who checks and what the finished result looks like.

This roadmap is written for founders, practice owners, operations leads and IT managers facing their first framework or tidying up after a rushed one. Use the first section to choose a starting point, treat the roadmap and control map as your working plan, and score yourself with the checklist. One reminder applies throughout: auditors and assessors reach their own conclusions, and your organization remains responsible for its compliance.

Start with who is asking
The six-stage readiness roadmap
One control, three frameworks
What good evidence looks like
Keeping it running after the audit
The checklist27 items in 5 groups
Questions to ask any IT provider10 questions
Your 30/60/90-day plan3 phases, step by step
Plain-English glossary8 terms

Read Part 1 free

The opening chapter of the guide, in full. The rest of the guide, the checklist and the 90-day plan are in the PDF.

Start with who is asking

The fastest way to pick a framework is to look closely at the request in front of you. The wording usually tells you what will satisfy the person asking.

What the request usually means
If you hear	You probably need	First move
“Please send us your SOC 2 report.”	SOC 2, usually Type II	A readiness assessment, then a decision on Type I or Type II and the review period
“We need you to sign a business associate agreement.”	HIPAA safeguards, as a business associate	A HIPAA risk analysis and a review of how you handle patient data
“Please complete our security questionnaire.”	Often no specific framework	A NIST CSF baseline, so your answers are consistent and true
“Your renewal requires MFA, EDR and offline backups.”	Your insurer's list of controls	Close those controls first and keep the evidence
“Which SAQ do you file?”	PCI DSS	Confirm your questionnaire type with your acquiring bank and map where card data flows

If you hear several of these, start with the one tied to the most revenue or the nearest deadline, then reuse its controls for the rest.

Get the full guide

A preview

A sample from the guide.

Here's the first checklist group and a few of the questions. The full guide has all 27 checklist items, 10 questions and the 90-day plan.

Scope and governance

We know which framework we need and who is asking for it
Scope is written down: systems, locations, people and data
A data flow diagram shows where sensitive data enters, lives and leaves
A named person owns the compliance program
A risk assessment was completed or updated in the last year
Core policies are approved and match how we actually work

Questions to ask any IT provider

1Will you work alongside an audit firm we choose, while keeping your readiness work separate from the audit?
2Which framework would you recommend for us, and why that one first?
3How will you define our scope, and what would you leave out?
4Who implements the technical controls, and who writes the documentation?

+ 6 more questions in the full guide

Get the full guide Related: Compliance Readiness

Compliance Readiness at a glance. Included: Gap assessment, Control implementation, Evidence & audit trails, Policy support, Continuity documentation and Ongoing control monitoring. How it works: Discovery & Analysis, Solution Design, Implement and Protect & Optimize. — Compliance Readiness at a glance: what is included and how we roll it out.

Your first 30 days

Where to start this month.

The guide's 30/60/90-day plan begins with these steps. Assign an owner to each and review progress every two weeks.

1Identify who is asking and choose the framework
2Write down the scope and draw the sensitive data flow
3Run a gap assessment and rank the gaps
4Turn on MFA everywhere it's missing

Key terms in plain English

Attestation report: A formal opinion from an independent auditor about your controls. A SOC 2 report is an attestation, not a certification.
SOC 2 Type II: A SOC 2 report that tests whether controls operated effectively over a review period, rather than at a single point in time.
Risk analysis: Under HIPAA, a documented assessment of the risks to electronic patient data and how they are addressed. It is the starting point for the Security Rule.
Business associate agreement (BAA): A contract HIPAA requires when a vendor creates, receives, keeps or transmits protected health information for a covered entity.
Current and target profile: In NIST CSF, a description of how you perform today and where you want to be, used to plan improvements.
Control: A specific safeguard, such as MFA or a quarterly access review, that reduces a risk and can be tested.
Evidence: Records that prove a control exists and operated, such as dated exports, tickets, logs and sign-offs.
Scope: The systems, locations, people and data an audit or assessment covers. Getting scope right shapes the whole project.