No formal information security structure. Patient-adjacent data handled without documented controls, no risk assessment process, and no business continuity plan. The organisation would have failed any enterprise security questionnaire at the start of the engagement.

Every artifact was built as part of a coherent, cross-referenced compliance system rather than a collection of isolated documents. Every control maps to a clause. Every decision has documented reasoning.

Zero controls fully compliant at assessment date across 36 total findings. The vendor landscape was undocumented, DPA gaps were widespread, and no formal risk management process existed across every assessed domain.

The SHIELD Framework was applied across all six stages, from scoping through to the strategic debrief. The assessment was methodical: scope first, then hazard identification, then control infrastructure mapping, then evidence review.

No SOC 2 programme existed. The security team had implemented technical controls informally but nothing was documented, evidenced, or mapped to the Trust Services Criteria. One deal had already been lost.

TSC scoping and criteria mapping came first, followed by gap analysis across all 33 Common Criteria. Policy development, control design, and evidence framework were built in parallel to compress the timeline without cutting corners on quality.