The methodology an auditor would recognize.

An assessment, not an attestation

A CPA performs an attestation audit and issues an opinion: a regulated statement that the client's representations are fairly stated in the respects the engagement covers. The work supports the opinion; the opinion is the product.

A Tidebreak assessment is the work without the opinion. We apply audit-grade discipline (scoping, sampling, evidence collection, finding rationalization, and framework mapping) to one question: whether a firm's IT environment supports the professional obligations its leadership already carries. We describe what we found, how we found it, and what the frameworks say about it. We do not issue an opinion, a pass, a grade, or a seal.

A practitioner-grade assessment is work a professional auditor would recognize as competent. Findings cite their evidence, sampling logic, and framework editions in the register professional standards already require, not in the vocabulary of a vendor demo. When the question becomes "can you defend this," the CPA, outside counsel, or carrier who asks it can trace any claim to its source.

We identify exposure, describe it in language a firm's advisors can act on, and recommend remediation. The firm, with its counsel and auditors, makes the compliance determinations. We inform those decisions; we do not make them.

The framework stack

A Tidebreak assessment maps against three frameworks at once: a security controls framework, a governance framework, and the professional standard that governs the firm itself. That combination is the distinguishing claim of the work. It is why a finding can be defended to a CPA and a CISO in the same meeting, and why one report can serve a carrier questionnaire and a partnership-level risk discussion.

The procedural walk

Every engagement runs the same ten-step sequence. Each step's scope adjusts to the firm's size, regulatory surface, and prior assessment history, but the discipline is constant. Each step produces a specific, citable work product, and any finding traces back to the step that surfaced it.

1. Step 01 · Scope confirmation

   Engagement letter issued with defined firm scope, assessment period, frameworks referenced, and out-of-scope boundaries.

   Artifact produced

   Executed engagement letter

2. Step 02 · Environment discovery

   Inventory of systems, data stores, identity providers, and third parties that touch the scoped environment. Asset inventory reconciled against what the IT provider reports.

   Artifact produced

   Environment inventory memorandum

3. Step 03 · Control walkthrough

   Structured interviews with the firm's IT provider, named control owners inside the firm, and selected workforce members. Control population established.

   Artifact produced

   Walkthrough notes, control population register

4. Step 04 · Risk-based sample selection

   Samples drawn from the control population using documented risk factors: privilege level, system criticality, control coverage gap, prior finding history.

   Artifact produced

   Sample selection memorandum

5. Step 05 · Evidence collection

   Configuration captures, log extracts, policy documents with version identifiers, access control list exports, and backup restoration test records collected per sample.

   Artifact produced

   Evidence register, per sample

6. Step 06 · Observation development

   Evidence reviewed against CIS Controls v8.1.2 safeguards, NIST CSF 2.0 categories, and the applicable professional standard. Observations drafted with evidence references.

   Artifact produced

   Draft observations

7. Step 07 · Finding rationalization

   Observations aggregated into findings where aggregation clarifies the reading. Severity tier assigned per the published severity framework.

   Artifact produced

   Draft findings

8. Step 08 · Fieldwork close-out

   Findings reviewed with the firm's IT provider for factual accuracy. Disputes documented. Firm leadership briefed.

   Artifact produced

   Close-out memorandum

9. Step 09 · Reporting

   Executive Report and Full Assessment Report drafted. Evidence register and framework mapping appendices assembled. Disclaimers reviewed.

   Artifact produced

   Executive Report, Full Assessment Report

10. Step 10 · Delivery and debrief

    Reports delivered. Working session with firm leadership, and separately with the IT provider, to walk each finding.

    Artifact produced

    Delivered reports, debrief notes

Steps five and six are where the practitioner-grade claim is earned or lost. If the evidence does not support the observation, the observation does not ship. If the observation does not map cleanly to a safeguard and a professional standard, the finding rewrites until it does.

Dual framework mapping

A finding that reads only in security-control language tells a CISO what to fix but leaves the managing partner unsure what obligation is at stake. A finding that reads only in professional-standard language cannot be translated into remediation by the IT provider. Tidebreak's reports carry both readings at once, because each is necessary and neither is sufficient.

• The security mapping. Every finding cites the CIS Controls v8.1.2 safeguards and, where relevant, NIST CSF 2.0 categories that the finding implicates.
• The professional-standard mapping.Where meaningful dual mapping exists, the finding also cites the ABA Model Rule, AICPA Code provision, HIPAA requirement, or financial-services rule that the finding implicates.
• When mapping is absent. Findings without meaningful dual mapping are labeled as such. The absence is information.
• Where it appears in the report. Both mappings appear on the finding card itself, on the Framework Mapping appendix, and in the vertical crosswalk.

The dual reading is what makes the report useful to a referral network. The CPA can defend it, the IT provider can act on it, and outside counsel can read the same document and orient. The finding does not translate; it already speaks both languages.

How we score

• Critical. Conditions that create material professional, regulatory, or business-continuity exposure. Remediation priority measured in days or weeks, not quarters.
• Moderate.Conditions that weaken the firm's defensible posture without creating immediate material exposure. Remediation within the current operating cycle.
• Observational. Conditions worth noting that do not, on their own, carry meaningful exposure. Included to support the completeness of the reading.

The implementation score is a 0-100 number derived from the firm's position against the CIS Controls v8.1.2Implementation Group 2 safeguards in scope. IG2 is the default target, adjusted up or down with the firm's data sensitivity, regulatory surface, and size. Every Full Assessment Report discloses the calculation and its inputs. The score summarizes current posture. It is not a certification, a grade, or a carrier-facing attestation.

Every assessment also reports the firm's position against NIST CSF 2.0's four tiers (Partial, Risk Informed, Repeatable, Adaptive) across the six functions, adding a governance-level view alongside the safeguard-level one.

Where we hand off

A Tidebreak assessment is one input into a firm's risk and compliance decisions, not the whole of it. The work below is work our clients often need and that we do not perform. We name it here so the boundary is visible and a firm's advisors know where our scope ends.

1. 1. Attestation audits (SOC 2, HIPAA certifications, ISO 27001 audits). We do not issue opinions. Firms needing an attest report engage a licensed CPA firm with a registered attest practice.

2. 2. Penetration testing. We do not conduct offensive security testing. Firms needing pen tests engage a dedicated offensive-security provider; we can advise on scoping.

3. 3. Incident response during an active incident. We do not operate as a retained IR firm. Firms experiencing an active incident engage their IR retainer or cyber insurance panel; we can assist post-incident in root-cause and remediation tracking.

4. 4. Managed security services (SOC, MDR, SIEM). We do not operate any managed security service. Firms needing continuous monitoring engage an MSSP or extend their MSP's service.

5. 5. Regulatory filings and notifications. We do not prepare or submit breach notifications, regulator filings, or examination responses. Firms needing these engage outside counsel or a specialized notification service.

6. 6. Legal opinions on rule interpretation. We do not interpret ABA, AICPA, HIPAA, SEC, NYDFS, state bar opinions, or any other legal or regulatory authority in specific-facts contexts. Firms with rule-interpretation questions engage outside counsel.

7. 7. Day-to-day IT operations and remediation execution. We do not configure, patch, deploy, or operate technology on a firm's behalf. Firms execute remediation through their IT provider; we provide the specification and review implementation evidence.

8. 8. Insurance placement or underwriting support. We do not place cyber insurance coverage or underwrite risk. Firms work with licensed brokers and carriers; our reports support those conversations rather than replace them.

9. 9. Software procurement or reseller services. We do not resell, source-prefer, or receive commissions on any security product. Our recommendations are vendor-agnostic.

10. 10. §164.308(a)(1) HIPAA risk analysis as a formal deliverable. Where a covered entity requires the specific deliverable that satisfies §164.308(a)(1), we can produce a Tidebreak-format assessment that serves as the foundation, but the covered entity or its counsel formally adopts and approves the analysis.