Client Compliance Scoping Intake (Onboarding)

Client Compliance Scoping Intake (Onboarding)

1. 01

   Confirm which certification the client's buyers actually require before naming a framework

   Ask for the last three security questionnaires or lost-deal notes. A prospect demanding SOC 2 Type II is a different 6 to 12 month program than one accepting a completed CAIQ.

2. 02

   Map the client's data classes to the controls that will carry the heaviest evidence burden

   Personal health data pulls HIPAA into scope; EU customer records pull GDPR. Platforms such as Vanta and Drata both surface control overlap across frameworks, so scope the union once rather than running parallel programs.

3. 03

   Inventory the systems of record that will feed automated evidence collection

   List cloud accounts, identity providers, ticketing, HR, and code repositories. Secureframe and Sprinto both pull evidence from AWS, Okta, and GitHub style integrations, and any system missing from that list becomes a manual task on the agency's plate.

4. 04

   Assign a named evidence owner per control family inside the client org

   Access reviews, change management, and vendor risk each need a human who signs off. Agencies that absorb this work without a client-side owner end up chasing screenshots during the audit window.

5. 05

   Set the audit window and work backward to a readiness date with buffer

   A Type II observation period of 3 to 12 months means the clock starts when controls go live, not when the contract is signed. Build 4 to 6 weeks of remediation before the observation period opens.

6. 06

   Agree on the trust artifact the client will publish and who maintains it

   Drata and Vanta both ship a trust center page. Decide whether the agency maintains it under retainer or hands it to the client's ops lead, and write that into the statement of work.

7. 07

   Document the exit path for evidence exports before the first control is configured

   Confirm the client can pull raw evidence and control mappings in a portable format. Vendor framework lock-in is the category's structural risk, and a client who changes platforms mid-audit pays for it twice.