VRC ASSURANCE
Pairs with: Secure AI adoption →ServicesVRC Assurance
VRC Assurance
Independent proof your security program works
VRC Assurance is an attestation against the VRC Control Set: one independent assessment, crosswalked to the frameworks your partners and customers already know. It's built for small and mid-size businesses, including regulated ones, that need credible proof now, and a clear path to a full audit later.
Partners want proof. A full audit may not fit yet.
Partners and customers want to know you protect their data. A security questionnaire asks for evidence, not promises, and a self-assessment or a checklist often isn't enough to satisfy them.
At the same time, a full SOC 2, ISO/IEC 27001, or HITRUST audit is a big commitment for a small business that may not need one yet. VRC Assurance sits in between: an independent review you can stand behind, sized for where you are today.
It's the step before a full audit, not a replacement for one.
What you get
An independent review.
Your program is assessed against the VRC Control Set, our published list of security, privacy, and AI governance controls.
A VRC attestation report.
A report you can share with partners and customers, signed by a VRC assessor who did not manage your program.
A framework crosswalk.
Your results mapped to the HIPAA Security Rule, NIST CSF 2.0, SOC 2, ISO/IEC 27001, and HITRUST e1, plus NIST AI RMF and ISO/IEC 42001 for AI.
A clear next step.
Where you stand today, and exactly what it would take to go further when a partner or market asks for more.
How it works
01
Assess.
We assess your program against the VRC Control Set, using evidence like configurations, policies, screenshots, and training and review records.
02
Fix.
We help you close the gaps we find, so the controls are working before anyone reviews them.
03
Independent review.
An assessor who did not build your program reviews the evidence. The people who help you build it are not the people who review it.
04
Attestation report.
You receive your VRC attestation report with the framework crosswalk, ready to share with partners and customers.
One assessment. Every framework you're asked about.
Instead of answering each framework separately, you're assessed once against the VRC Control Set. Each control carries a crosswalk, so your report shows how your results line up with the frameworks your partners, customers, and future auditors recognize.
The VRC Control Set
15 domains, one review
- Governance & risk
- Policies
- Workforce & training
- Access control & MFA
- Asset inventory
- Vendor & BAA management
- Data protection & encryption
- Logging & monitoring
- Vulnerability & patch mgmt
- Secure configuration
- Incident response
- Backup & BC/DR
- Physical & device security
- Email security
- AI governance
Security & privacy frameworks
HIPAA Security Rule
45 CFR 164.308–316
NIST CSF 2.0
Govern, Identify, Protect, Detect, Respond, Recover
SOC 2
Trust Services Criteria (Security)
ISO/IEC 27001:2022
Annex A controls
HITRUST e1
Essentials baseline
AI governance domain also maps to
NIST AI RMF 1.0
Govern, Map, Measure, Manage
ISO/IEC 42001:2023
AI management system, Annex A
The crosswalk is alignment evidence. A VRC attestation is not a SOC 2 report, an ISO/IEC 27001 certificate, or a HITRUST certification, and it carries none of their marks. Framework names are used only to show where your controls line up.
Start with Assurance. Grow into certification.
Nothing you do for Assurance is wasted. The controls, evidence, and crosswalk carry forward, so when you move to a full audit you start prepared, not from scratch.
01
Assure.
We assess you against the VRC Control Set, help you close the gaps, and an independent VRC assessor issues your attestation report with the crosswalk.
With VRC
02
Grow.
You run and mature your program with VRC. When a partner, customer, or market needs more than Assurance, we flag it early.
With VRC
03
Certify with a partner auditor.
When you need ISO/IEC 27001, SOC 2, or HITRUST, we hand you to an independent audit partner with your controls, evidence, and crosswalk ready. That means a faster audit with fewer surprises.
With an independent audit partner
AI governance is built in. AI-powered, human-led delivery.
Assurance covers how you use AI, not just how you secure your network. And the way we deliver it follows the same rules we ask of you.
In the control set
An AI governance domain, mapped to NIST AI RMF and ISO/IEC 42001
- VRC-AI-01 AI use inventory: every AI tool, feature, and agent, with an owner, purpose, data types, and vendor.
- VRC-AI-02 AI acceptable use policy: approved tools, prohibited uses, and data handling rules, approved by leadership.
- VRC-AI-03 Human review of AI output before it's used in operational, financial, compliance, or client-facing decisions.
- VRC-AI-04 No PHI in AI tools without a BAA, and approved tools configured to keep your data out of model training.
- VRC-AI-05 Least-privilege, read-only AI access through dedicated identities whose activity is logged and reviewed.
NIST AI RMF 1.0 · ISO/IEC 42001:2023 · HIPAA Security Rule · SOC 2
In how we deliver it
Human-led, AI-powered, with guardrails that don't bend
- Read-only by default. Any AI used in an assessment gets read-only, least-privilege access to the systems a check needs, and nothing more.
- No PHI. Evidence is limited to items that shouldn't contain PHI: configurations, policies, screenshots, and training and review records.
- An expert signs off. AI helps gather and organize evidence. A qualified VRC assessor reviews every finding and signs the attestation.
Need help putting AI to work safely first? See Secure AI adoption
Built for where you are today
- Small and mid-size businesses that handle sensitive data and need a real, independently reviewed program, but don't need a full SOC 2 or ISO audit yet.
- Regulated businesses and their vendors whose partners and customers send security questionnaires, and who want to answer with evidence instead of promises.
- Teams headed toward ISO, SOC 2, or HITRUST that want to build and test their controls now, and walk into the full audit prepared.
VRC Assurance questions we hear a lot
Is VRC Assurance a certification?
No. It's a VRC attestation: an independent review against a published control set, with a crosswalk to the frameworks your partners know. It is not an accredited certification, and it isn't a SOC 2 report, an ISO/IEC 27001 certificate, or a HITRUST certification. We're clear about that, and we'll help you describe it accurately when you share it.
Isn't it a conflict if VRC also manages our compliance?
Fair question. The people who help you build your program are not the people who review it. Your attestation is signed by a VRC assessor who did not manage your program.
Why not just do SOC 2?
You can, and when you need it, we'll help you get there. Many small businesses don't need a full SOC 2 audit yet. Assurance gives you credible proof now and prepares you for SOC 2 later.
Will our partners and customers accept it?
It depends on the partner. Many want independent evidence that your controls are in place, and Assurance gives you a report and a crosswalk to the frameworks they ask about. If a partner requires a specific audit, we'll tell you, and we'll help you prepare for it.
Is it wasted effort if we need a full audit later?
No. The controls, evidence, and crosswalk carry forward. When you move to ISO/IEC 27001, SOC 2, or HITRUST with an independent audit partner, you start prepared, not from scratch.
Do you need access to our sensitive data?
No. Assurance evidence is limited to items that shouldn't contain PHI, like configurations, policies, screenshots, and training and review records. Any AI we use in the work gets read-only access, and an expert reviews every finding.
How does this relate to Secure AI adoption?
They work together. Secure AI adoption helps you put AI and AI agents to work under control. Assurance independently reviews your whole program, including the AI governance controls, against the VRC Control Set.
Let's see where you stand
Book a short call, and we'll walk you through the control set and what Assurance would look like for your business.