About COMPLY

Evidence-driven. Governance-focused. Audit-ready.

COMPLY exists to help organizations achieve and demonstrate security compliance with clarity, accountability, and defensible outcomes.

Our Mission

Help organizations achieve and demonstrate security compliance.

COMPLY helps small and mid-size organizations turn compliance pressure into clear decisions, accountable action, and evidence that customers, auditors, and leadership can follow.

The model connects requirements, controls, evidence, and governance so teams can build, explain, and sustain a compliance program without losing sight of how work operates in practice.

Underneath that practical delivery model are unified controls, UCC (Universal Control Criteria), and evidence-driven artifacts. Together they provide a framework-agnostic way to show that controls are designed, implemented, operating, and evidenced with traceability from requirement to audit conclusion.

Why trust COMPLY

Client-side experience, assessment discipline, and practical delivery.

COMPLY is closely associated with AnsecGroup and is shaped by people who understand the pressure from both sides of a security compliance engagement.

Experience from both sides of the engagement

COMPLY combines client-side operating experience, assessment discipline, and leadership perspective. The team has helped organizations run security programs, prepare for and evaluate controls, and explain compliance outcomes to decision-makers. That keeps the work grounded in what owners can execute – not only what a framework says on paper.

Engagements are designed to leave clients with clearer decisions, accountable owners, usable evidence, and a roadmap that remains useful after the report is delivered.

Learn more about the team

Explore the broader AnsecGroup team and its security, privacy, risk, and compliance experience before you start a conversation with COMPLY.

Visit AnsecGroup

Practitioner profile

Hans Lanslots, RI

Information & Technology Leader | Co-Creator of C.O.M.P.L.Y.

Hans brings more than three decades of experience guiding complex, cross-functional IT organizations and designing secure technology environments across Europe and the United States.

Client benefit: Clients gain an executive and operational perspective that connects control design, technology decisions, and compliance objectives to how the business actually runs.

View LinkedIn profile

Practitioner profile

Steffani Burd, Ph.D.

Founder of ANSEC | Co-Creator of C.O.M.P.L.Y.

Steffani develops empirically based solutions that protect information assets, improve business outcomes, and apply security compliance in practical settings.

Client benefit: Clients gain a research-informed advisor who can connect security auditing, investigative thinking, communication, and business improvement.

View LinkedIn profile

After the assessment

What happens after the assessment report is delivered?

The report is a decision point, not the finish line. COMPLY helps translate findings into owned actions, usable evidence, and a review rhythm for the next stage.

Review the findings

Walk through the evidence, gaps, risk context, and implications with the people who own the work.

Prioritize the roadmap

Turn gaps into practical actions with clear ownership, sequencing, and evidence expectations.

Keep progress visible

Use recurring reviews, governance checkpoints, and management reporting to keep the program current.

Discuss your next step

Our Approach

Evidence-driven.

COMPLY treats evidence as the operating proof of compliance, not as a last-minute audit attachment. Evidence is structured, mapped to controls and criteria, reusable across frameworks, and evaluated for whether it supports control design, existence, and operating effectiveness.

Governance-focused.

COMPLY connects compliance activity to ownership, accountability, review cycles, internal audit, management review, and corrective action. The goal is to make compliance a governed operating rhythm with clear responsibilities and executive visibility.

Audit-ready.

COMPLY builds traceability from requirements to controls, criteria, evidence artifacts, and audit conclusions. This gives auditors and leadership a defensible basis for understanding what was tested, what evidence supports it, and where gaps or improvements remain.

The COMPLY model behind the work

Unified Controls

Normalized, technology-neutral controls that map back to source security frameworks and standards.

UCC completeness standard

UCC (Universal Control Criteria) defines the criteria used to assess whether a control is aligned, complete, and supportable.

COMPLY Artifacts

Purpose-built evidence objects mapped to criteria and assurance dimensions: design, existence, and operational effectiveness.

Evidence reuse and deduplication

A single artifact can support multiple security frameworks and standards with clear traceability, reducing duplicated effort.

Continuous compliance governance

Ownership, review cycles, internal audit, and management review are built into the operating model.

The Story Behind C.O.M.P.L.Y.™

Explore why C.O.M.P.L.Y.™ was developed and how the model addresses the complexity of multi-framework security compliance.

The C.O.M.P.L.Y.™ story explains the practical compliance problems that shaped the methodology: overlapping requirements, duplicated control work, fragmented evidence, repetitive assessments, and limited visibility into compliance posture.

Read the Story