Policy-as-code
Policy-as-code engine
Infrastructure-as-code snippets for up to three org-level controls.
ISO 27001 & SOC 2 architecture review
ISO 27001 & SOC 2 gap analysis A remediation roadmap, not another PDF.
Gap analysis, remediation planning, and automation. We map your infrastructure to the gold standard for financial services and enterprise contracts, delivered by engineers who have built compliance at scale.
The contrast
Stop buying compliance reports that die in a PDF.
Path 1 — The legacy way PDF · spreadsheets · assessor scramble
- Manual evidence collection and endless spreadsheets.
- Hundreds of hours on assessor interviews and prep.
- Outdated security patterns slow developer velocity.
- One-time assessor scramble — no lasting infrastructure.
Path 2 — BlockSkunk's way Live register · real-time evidence
- Controls automated and loaded into Arbiter's live risk register.
- Assessors log in to see real-time evidence. No prep needed.
- Modern, automated processes actually speed up developers.
- Single-pane-of-glass view to direct the business securely.
Compliance Readiness
Find your gaps. Load your register.
We do not just hand you a checklist. When you partner with BlockSkunk for your ISO 27001 or SOC 2 gap analysis, we load your current state directly into Arbiter. Arbiter is the live GRC risk register, not a bolt-on integration.
The Catalyst Offer
Purchase a comprehensive gap analysis and receive 3 months of Arbiter free. Start operating in Arbiter's risk register on day one.
Book an architecture review → The deliverable
Two phases. ~One week. Full gap-to-roadmap coverage.
Phase 0
Architecture review & gap analysis
Read-only cloud role access and a zero-disruption review of your environment. We map your infrastructure to ISO 27001 and SOC 2 controls and identify gaps before remediation planning begins.
Phase 1
Remediation plan
A complete gap-to-roadmap package your engineering team can execute — technical deep-dive, current and desired state documentation, and an executive readout ranked for leadership.
Phase 1 outputs
What your team receives.
-
Playbook
Detailed playbook
Step-by-step remediation guide your engineering team can action immediately.
-
Deep dive
Technical deep-dive
Script-based analysis run directly inside your cloud environment.
-
Current state
Current state document
All compliance defects and observations in plain language.
-
Desired state
Desired state document
Exact remediation steps mapped to each defect.
-
Readout
Executive readout
Slide deck with high-value actions ranked for leadership.
Tooling
Tooling & accelerators
Arbiter
Arbiter is the risk register
Arbiter is BlockSkunk's live GRC risk register. Your gap analysis loads here on day one, with cloud logging mapped to business risks in real time.
Scanning
Automated scanning
Rapid misconfiguration detection. No manual triage.
Workshops
Interactive workshops
Tabletop exercises bridging engineering and compliance.
Practitioners
Our team: practitioners who've sat on both sides of the assessment table.
Our team has run internal assessments across Fortune 500 firms and fast-moving scale-ups. We approach your infrastructure as engineers with experience at the assessment table. The goal is to bake compliance in early, so every future assessment costs less and takes less time.
Book an architecture review. 30 minutes.
No commitment · Engineers who've built compliance at scale · [email protected]