Compliance Evidence and Audit Readiness Retainer

A complete cycle for one agreed framework on your Microsoft 365 and Azure controls: a scheduled evidence refresh filed against each control, a drift check of the live tenant against your baseline with every difference decided and recorded, the policy review calendar worked with review packs and filed approvals, security-questionnaire support within the allowance in your service order, a framework watch, a continuously maintained audit binder in your own SharePoint, and a monthly compliance report with a review call. The price is a flat $950 per month with no long-term commitment.

It is the honest version of it. The market uses that phrase for anything from a dashboard subscription to a fractional compliance officer. This retainer is specifically the recurring labor between assessments: collecting evidence, catching drift, running the policy calendar, answering questionnaires, and keeping the binder current — continuous evidence instead of an annual scramble. What it is not is an auditor, a certification, or a promise about the outcome, and we say that on every page rather than in the small print.

One agreed framework per retainer, chosen from the HIPAA Security Rule, CMMC and NIST SP 800-171, SOC 2, CIS Controls v8.1, or the control requirements in your cyber-insurance carrier's application. Each has its own control-to-evidence map — the artifacts an OCR investigator, a C3PAO, a SOC 2 auditor, a CIS self-assessment, and an underwriter each expect are related but not identical. Other frameworks we assess, such as ISO 27001, NIST CSF, FINRA and SEC 17a-4, and ISO/IEC 42001, can be quoted after we review how much of their evidence your existing map already produces.

The fee covers one framework; the second is quoted, not doubled. Overlap between frameworks is real — MFA enforcement, audit logging, access reviews, encryption at rest, and vulnerability management evidence the same way for most of them — so we review the existing control-to-evidence map, identify the controls the second framework adds, and quote the increment. The binder then carries both mappings against one set of artifacts.

The vCISO owns the security program: strategy, the risk register, policy governance, incident-readiness planning, security metrics, and executive reporting — the decisions about what the program requires. This retainer is the operational layer below it: the evidence that the Microsoft controls the program calls for exist and keep operating, month after month. Run together, the vCISO sets the policy calendar's content and this retainer runs it; the vCISO decides a drift finding's risk treatment and this retainer records it. If you have no security leadership at all, the vCISO is the first conversation, and this retainer is the second.

No, and no — and any Microsoft partner who answers differently should be asked which accreditation they hold. IT Partner is not a CPA firm, a C3PAO, an ISO certification body, or an assessor. SOC 2 reports come from licensed CPA firms, CMMC certification from an authorized C3PAO, ISO certificates from accredited bodies, and there is no such thing as HIPAA or CIS certification at all. What we do is make sure that when those parties examine your Microsoft 365 and Azure controls, the evidence is complete, current, and honest, and that the people answering their questions have it in front of them.

Yes — the retainer starts from a baseline, and the assessment is what produces one: the gap report, the roadmap or plan of action, and a documented control state to check drift against. IT Partner's HIPAA, CIS Controls v8.1, CMMC and NIST 800-171, SOC pre-audit, and Cyber Insurance Readiness assessments each end in exactly that; an equivalent assessment done elsewhere works too. Starting a retainer without one would mean filing evidence against controls nobody has defined, which is how binders end up telling comforting stories rather than true ones.

No. The retainer runs on Business Premium and E3 tenants; licensing changes evidence depth, not whether the program works. Compliance Manager's Data Protection Baseline is included with Microsoft 365, and we use Compliance Manager's automatically tested improvement actions as an input where they help; the regulatory templates for HIPAA, NIST SP 800-171, CIS, and SOC 2 are premium templates Microsoft licenses separately, with a limited number included in E5-family suites at the time of writing. Audit (Premium) extends audit-log retention from 180 days to one year by default. We verify what your tenant surfaces at onboarding, tell you plainly what a license would add, and quote any Microsoft purchase at Microsoft's published list price — never inside this fee.

Three reasons. Auditors and assessors want exportable artifacts organized by their control identifiers, not a vendor dashboard they cannot navigate. A binder in your tenant is covered by your retention and access controls, which is itself evidence. And because it is yours: if you stop the retainer, every artifact, narrative, and report stays exactly where it is. Compliance Manager remains a useful input — we record improvement-action status and use its automated tests where licensed — but the system of record is the one you own.

Questionnaire support is drafting the technical answers, with the supporting artifact attached, for documents addressed to your organization: customer due-diligence questionnaires such as SIG and CAIQ or bespoke ones, cyber-insurance applications and renewals, and evidence-request lists from auditors and assessors. The allowance is recorded in your service order at onboarding, sized to your customer and carrier load, and reported against every month. A request that will exceed it is flagged before we begin and quoted at our published cloud engineer hourly rate or as a fixed package — no silent absorption, no surprise invoice. You review and sign every answer; we never submit on your behalf.

It is raised with a recommendation, not silently fixed. If someone switched a Conditional Access policy to report-only, shortened a retention policy, or added a global administrator, you decide: revert to the baseline, or approve the change into it. Reverting a baseline setting is executed with your approval as part of the cycle; designing a new control or a larger change is scoped as project work. Either way the decision is recorded in the binder, which is what an auditor asking 'how do you manage change?' actually wants to see.

No — we review and evidence the ones you have. The calendar gives every policy an owner and a review date; ahead of each date we prepare a pack showing what changed technically since the last signature, and after the review we file the approval and the signed version. Writing a new policy set, or restructuring one, is the vCISO's work or a separately scoped engagement, because a policy is a management commitment and should be authored by the people who own it.

Every framework reaches beyond Microsoft 365 — HIPAA's risk analysis is organization-wide, a CMMC boundary may include on-premises assets, SOC 2 covers HR and vendor management. The binder is structured for the whole framework so the auditor sees one coherent picture, and we file the evidence you supply for non-Microsoft controls in their place. What we collect ourselves is the Microsoft 365 and Azure evidence; we do not operate or extract from other platforms, and we say so instead of implying coverage we do not have.

It is built for exactly that audience — organized by their control identifiers, dated, attributed, and exportable — and clients use it to answer evidence-request lists without a reconstruction week. What we will not do is promise their verdict. An auditor may want a sample we did not anticipate, a C3PAO applies the assessment guide as they read it, a carrier's underwriting is their business. The retainer makes the evidence complete and honest; the conclusion is theirs, and we will never tell you otherwise to close a sale.

They are why the rhythm is monthly. A SOC 2 Type II report tests controls across an observation period that commonly runs six to twelve months, so the auditor samples evidence from throughout it — an artifact that exists only in audit week fails the sample. CMMC Level 2 keeps a score and an affirmation current in SPRS, and the plan of action has deadlines. A cyber-insurance renewal is an annual attestation whose questions rarely get easier. The monthly cycle means that whichever window opens, the last twelve months of evidence already exist.

Onboarding: we import your readiness assessment's outputs as the baseline, build the control-to-evidence map for the agreed framework, record the tenant's control state, verify what your licensing surfaces, create the binder in your SharePoint, and record the scope, policy calendar, questionnaire allowance, and report recipients in the service order. If the tenant has changed materially since the assessment, the first cycle re-verifies the baseline before anything is filed against it. The regular monthly cycle starts in the second month.

A flat $950 per month per tenant for one framework, invoiced monthly, with no long-term contract: stop any month, and all we ask is payment of previously approved invoices. The binder, the control-to-evidence map, the policy calendar, and every monthly report live in your SharePoint and stay there — the retainer was built so that leaving it costs you nothing but the labor it was doing.