GRC & COMPLIANCE

One Vendor.
Full Compliance Outcome.

ThreeShield delivers the whole compliance outcome: automated evidence collection in Lavawall®, expert remediation guidance, and a CISSP/CISA-executed audit. You no longer buy the platform from one vendor, the guidance from another, and the audit from a third.

The Fragmented Compliance Model Is Costing You More Than You Think

Most compliance programs involve 4 separate vendors, 3 contract renewals, and a year of work that starts over every 12 months.

⚠️ The Typical Fragmented Approach

Vendor 1 Compliance Platform Drata, Vanta: $15K-$40K/yr
→
Vendor 2 Compliance Consultant Gap analysis, guidance: $10K-$30K
→
Vendor 3 External Auditor Audit execution: $20K-$80K
→
Vendor 4 MSP / Support Ongoing maintenance: recurring $$$

Total: $45K-$150K+ annually · Four contracts · Zero continuity

✅ The ThreeShield Way

Platform Lavawall® GRC Automated evidence collection, 70+ frameworks
+
Expertise CISSP/CISA Guidance Gap analysis, remediation, policy creation
+
Audit Executed Audit 200+ findings, government/Fortune 50 experience
+
Support Ongoing Augmentation Monitoring, next year's evidence, Tier 3 support

One vendor · Continuous evidence · Lower total cost

How Lavawall® Makes Evidence Collection Automatic

Traditional compliance means screenshots, manual interviews, and spreadsheet trackers. Lavawall® removes most of that work.

🔄

Continuous Control Monitoring

Lavawall® checks your controls against selected frameworks daily, not once a year. Drift is caught in hours, not discovered at audit time.

📎

Automated Evidence Collection

Lavawall® collects patch logs, MFA status, access control configurations, encryption state, and 100+ other data points automatically, and timestamps each one as audit evidence.

🗺️

Multi-Framework Mapping

One control set maps to several frameworks at once. Satisfy a CIS IG2 control and the corresponding HIPAA and SOC 2 requirements are met automatically.

📊

Compliance Score Dashboard

A real-time compliance score for each selected framework. Business leaders see a simple number; technical staff see the control gaps to fix.

🤖

AI-Powered Reports

Lavawall®'s LLM drafts compliance status reports, remediation summaries, and board-ready security briefings, and a person reviews each one before delivery.

📅

Year-Round Readiness

Evidence is collected continuously, so you're prepared when audit time arrives. There's no month-long evidence scramble before each assessment.

Supported Compliance Frameworks

Lavawall® GRC covers all major frameworks. Click any framework to see details.

Healthcare

HIPAA: Health Insurance Portability and Accountability Act

For US-facing healthcare organizations and Canadian companies with US business relationships or data processing. ThreeShield covers the Security Rule, Privacy Rule, and Breach Notification Rule. Lavawall® monitors the technical safeguards automatically, and we document the administrative and physical safeguards in full.

  • Technical, administrative, and physical safeguard assessment
  • Business Associate Agreement (BAA) review and template library
  • PHI data flow mapping and risk analysis (required §164.308(a)(1))
  • Workforce training documentation
  • Breach notification procedure development
Get HIPAA Assessment →
Canadian Healthcare

Alberta Health Information Act (HIA) & BC PIPA

For Alberta healthcare custodians: physicians, clinics, PCNs, pharmacy groups, and health tech companies. The Alberta HIA sets specific technical safeguard requirements that many generic compliance platforms don't handle. BC PIPA is also supported for BC-based health organizations.

  • HIA custodian vs. affiliate obligations analysis
  • Privacy Impact Assessment (PIA) support
  • Safeguard requirements (§60) compliance mapping
  • Breach reporting obligations (§60.1)
  • Cloud and US data residency analysis for PHI
Get HIA Assessment →
SaaS / Tech

SOC 2 Type I & Type II

For SaaS companies, health tech vendors, and any service organization handling client data. Lavawall® monitors the technical controls continuously while ThreeShield's CISSP/CISA team prepares you for the formal AICPA Trust Services Criteria assessment. Type II readiness comes much faster when evidence is collected automatically all year.

  • Trust Services Criteria gap assessment (Security, Availability, Confidentiality, PI, Privacy)
  • Continuous automated evidence collection for Type II periods
  • Policy and procedure development (25+ documents)
  • Vendor management and sub-processor documentation
  • Audit readiness review and pre-audit testing
Get SOC 2 Readiness Assessment →
Payments

PCI DSS v4.0.1: All SAQ Types

Payment Card Industry compliance for merchants, service providers, and healthcare organizations that process payments. ThreeShield supports all SAQ types (A, A-EP, B, B-IP, C, C-VT, and D) with full QSA-equivalent scoping analysis, and Lavawall® monitors your cardholder data environment continuously.

  • Cardholder Data Environment (CDE) scoping and segmentation
  • SAQ type determination and requirement gap analysis
  • Network segmentation validation
  • Automated technical control monitoring (Requirements 6, 10, 11)
  • Vulnerability scan coordination (ASV-equivalent process)
Get PCI Scoping →
Best Practice

CIS Controls v8.1: IG1, IG2, IG3

CIS Controls are the most practical starting point for most organizations. Lavawall® was built with CIS in mind and continuously monitors IG1 basic hygiene through IG3 advanced controls. Implementing CIS also meets the baseline requirements of most cyber insurance policies, and clients have reported premiums 12% lower.

  • IG1: Essential Cyber Hygiene (56 safeguards)
  • IG2: for organizations with IT staff (additional 74 safeguards)
  • IG3: for organizations handling sensitive data or facing advanced threats
  • Cyber insurance alignment documentation
  • Lavawall® continuous IG score tracking
Get CIS Assessment →
Risk Framework

NIST Cybersecurity Framework (CSF 2.0)

NIST CSF gives you the "govern, identify, protect, detect, respond, recover" structure for tying security spending to business risk. Many organizations use it as their primary governance framework and map it to specific compliance requirements. Lavawall® tracks CSF controls continuously.

  • NIST CSF 2.0 maturity assessment (tiers 1-4)
  • Function-level gap analysis and prioritized roadmap
  • Cross-mapping to HIPAA, SOC 2, CIS, or ISO 27001
  • Risk register development
  • Board-level risk reporting
Get NIST Assessment →
Defense Industrial Base

CMMC 2.0: Levels 1, 2 & 3

For US Department of Defense contractors and Canadian companies in the defence supply chain (NORAD, NATO, DND). CMMC 2.0 aligns to NIST SP 800-171 at Level 2 and NIST SP 800-172 at Level 3. ThreeShield has government and defence audit experience at the Fortune 50 and federal level.

  • CUI (Controlled Unclassified Information) scoping and inventory
  • NIST SP 800-171 gap assessment (110 controls)
  • System Security Plan (SSP) and POAM development
  • Level 2 self-assessment support and documentation
  • Level 2/3 C3PAO assessment preparation
Get CMMC Readiness Review →
ISO 27001

Full ISMS development and certification preparation. Annex A control implementation and internal audit support.

NERC CIP

Compliance with the NERC Critical Infrastructure Protection standards for electric utilities and critical infrastructure.

IIROC / CIRO

Investment Industry Regulatory Organization of Canada cybersecurity guidance for investment dealers and brokers.

BCFSA

BC Financial Services Authority security guidance for credit unions, insurance companies, and financial planners.

CPA Canada Cyber

CPA Canada Cybersecurity Framework for public accounting and professional services firms.

Ontario CSF

Ontario Cyber Security Framework for public-sector entities and critical infrastructure in Ontario.

Compliance Questions Answered

The people who do the audit work. Drata and Vanta are strong at evidence collection for SOC 2, but they're software platforms, not auditors, so you still need someone to do the actual audit. For frameworks like HIPAA, Alberta HIA, or PCI DSS, their support is also much weaker than their SOC 2 offering. ThreeShield can work alongside your existing platform, or replace it entirely with Lavawall® GRC at a lower total cost. Because we also execute the audit, you don't need a fourth vendor for that.

An initial gap assessment takes 2-4 weeks. After that, it depends on your starting posture and the target framework. For organizations with reasonable existing controls, SOC 2 Type I readiness typically takes 3-6 months, and Type II requires a 6-12 month observation period (where continuous Lavawall® evidence collection removes most of the scramble). HIPAA and CIS baseline work can move faster: some clients reach an initial certification-ready posture in 60-90 days.

Many organizations do. A healthcare SaaS company, for example, might need SOC 2, HIPAA, and Alberta HIA at the same time. With Lavawall® GRC's multi-framework mapping, one control can satisfy requirements across several frameworks. ThreeShield folds the overlapping requirements into one program instead of running three separate compliance tracks.

Yes. Organizations that can demonstrate CIS IG1/IG2 compliance, MFA enforcement across all systems, tested backup recovery, and continuous monitoring are better placed at renewal, and clients have reported cyber insurance premiums 12% lower. Lavawall® generates the documentation insurers ask for. Lavawall®'s domain scanner finds the same kinds of internet-facing issues insurers' external scans look for, so you can fix them before renewal; clients who did have cut their insurance costs by approximately 12%.

Stop Overpaying for a Fragmented Compliance Stack

Book a free compliance scoping call. We'll identify which frameworks apply to your business, what your biggest gaps are, and what an end-to-end program would realistically cost, all before you commit to anything.

Book Free Compliance Scoping Call

Available globally for Lavawall® GRC · Calgary-based for full audit engagements

Looking for an independent audit specifically? See our GRC audit (Canada) service.