Hotman Group, LLC

BACKGROUND

Introduce your business and what you do there.

I’m a system administrator at Maynard, Inc. We manufacture aerospace and commercial fabricated parts and assemblies. We also offer machining services and specialized hardware for defense and aerospace contractors, focusing on technical expertise and responsive, dependable service.

OPPORTUNITY / CHALLENGE

What challenge were you trying to address with Hotman Group, LLC?

We needed a consultant to help us navigate through the Cybersecurity Maturity Model Certification (CMMC) processes for our upcoming audit to ensure we were prepared.

SOLUTION

What was the scope of their involvement?

Hotman Group, LLC reviewed our System Security Plan (SSP), documentation, and artifacts. They also conducted breakout sessions to describe what would stand out to an auditor as being non-compliant and where we were too wordy.

What is the team composition?

We worked with 2–5 teammates from Hotman Group, LLC.

How did you come to work with Hotman Group, LLC?

Someone referred Hotman Group, LLC to us. We chose them because they were close to our geographic location, their pricing fit our budget, they were a great culture fit, and they offered good value for the cost.

How much have you invested with them?

We spent around $10,000.

What is the status of this engagement?

We worked together from August 2026–October 2026.

RESULTS & FEEDBACK

What evidence can you share that demonstrates the impact of the engagement?

Hotman Group, LLC presented us with a breakdown of the scoring for each control and the list of item objectives that needed to be fixed before the C3PAO audit.

How did Hotman Group, LLC perform from a project management standpoint?

Hotman Group, LLC was very organized and communicative. They held regular meetings and were flexible around vacations. They delivered 100% on time. We communicated via virtual meetings, emails, and messaging apps.

What did you find most impressive about them?

The communication between the different styles of employees Hotman Group, LLC interacted with was consistent. It actually helped bridge some gaps our team had in communication. They strengthened the trust of our department and helped provide the proof we needed for management to allow some of our ongoing projects toward compliance to be approved.

Are there any areas they could improve?

There were a few times our team forgot what we discussed during the meetings. Our notes were a little sparse, and we were too embarrassed to ask. It would be great if they had an electronic note taker so we could go back and review what we said. Again, this isn’t a failing on their part, but more of a reassurance for us.

BACKGROUND

I am the Cybersecurity Practice Director of Gotham Technology Group

Gotham Technology Group provides IT solutions and services across cybersecurity, cloud, end-user computing, data center, collaboration, managed services, and technical staffing for businesses ranging from SMBs to global enterprises.

OPPORTUNITY / CHALLENGE

• SOC 2 Type II Compliance
• Move to a modern GRC Platform

SOLUTION

Referral

• High ratings
• Pricing fit our budget
• Great culture fit
• Good value for cost
• Company values aligned

2-5 Employees

Hotman Group helped us move our SOC 2 program into Hyperproof and turn it into an operating system of record rather than a place to collect information for an audit. That included workflow configuration, ownership assignments, evidence collection, control monitoring, risk mapping, and improving how the platform is used across the organization. They have stayed involved as we moved from Type 1 into Type 2, reviewing evidence and documentation, helping us prepare for the audit, and working through active control questions in a weekly cadence. The same foundation is now being used as new compliance needs come up, including PCI DSS SAQ-A and the compliance impact of our Azure migration. 

RESULTS & FEEDBACK

The biggest change is visibility. We have a much clearer view of control health, evidence freshness, ownership, and what is coming due, instead of trying to reconstruct that picture when an audit starts. That showed up in our first Type 2 cycle: when the auditor request list came in, we had the majority of it completed within about a week. We also entered the six-month operating period with more consistent processes and clearer accountability. The program is now less reactive and easier to operate between audits, which is the direction we wanted when we moved the work into Hyperproof.

We have a weekly working cadence with HG, and we can reach them between meetings for questions, document review, or an issue that comes up. That gives us a regular place to work through evidence, control questions, and audit items without letting them pile up. They also bring in the right person from their team depending on the topic, which has been useful as the program has expanded. The cadence keeps the work moving while still leaving the internal decisions and control ownership with our team.

• Virtual Meeting
• Email or Messaging App

What stands out is the structure and clarity they helped us build around the program. We went from thinking we were doing the right things to being able to show what is in place, who owns it, and how it is operating. Hyperproof is now something we use to run the compliance program, not just a place to store audit evidence. That has given us much more confidence going into Type 2 and a foundation we can keep building on.

No.  They did what they said and said what they did.

BACKGROUND

Please describe your company and position.

I am the VP Operations of Diligence International Group, LLC

Describe what your company does in a single sentence.

Diligence International Group provides investigative and data-verification services, including claims investigations, due diligence, surveillance, background checks, asset tracing, and fraud-related support for insurers, law firms, financial institutions, and other businesses.

OPPORTUNITY / CHALLENGE

What specific goals or objectives did you hire Hotman Group, LLC to accomplish?

• Provide ongoing vCISO and GRC support, manage Diligence’s SOC 2 program and customer security questionnaires, and take ownership of recurring compliance activities so the organization can maintain an effective security and compliance program year-round.

SOLUTION

How did you find Hotman Group, LLC?

Referral

Why did you select Hotman Group, LLC over others?

• Great culture fit
• Good value for cost
• Company values aligned

How many teammates from Hotman Group, LLC were assigned to this project?

2-5 Employees

Describe the scope of work in detail. Please include a summary of key deliverables.

Hotman Group helps us manage a large part of our ongoing security and compliance workload. They handle customer security questionnaires and follow-ups, maintain approved response content so we are not starting from scratch each time, and join customer calls when additional security questions come up. For SOC 2, they help plan the audit, coordinate directly with the auditor, collect and organize evidence, monitor recurring controls, complete user access reviews, follow up with our team and vendors when something is outstanding, and help track remediation items through completion. They also manage our security awareness and phishing program and help plan and run our business continuity, disaster recovery, and incident response tabletop exercises. As our business has changed, they have also helped us assess how new operations fit into our SOC 2 environment and supported the transition to a new GRC platform for managing controls, policies, evidence, and compliance activities.

RESULTS & FEEDBACK

What were the measurable outcomes from the project that demonstrate progress or success?

One of the biggest outcomes for us is that the recurring work required to keep our SOC 2 and security program running no longer depends on our leadership team remembering and managing every individual task. HG owns much of the recurring coordination required to keep our controls, audit activities, questionnaires, and security awareness program moving throughout the year. We now have repeatable processes for things like customer questionnaires, control reviews, user access reviews, audit evidence, and security awareness rather than treating them as one-off projects each time they come up. 

Describe their project management. Did they deliver items on time? How did they respond to your needs?

They are very hands-on about keeping things moving. We do not have to create a new task list for them every time something is due. They track recurring compliance work, follow up on evidence and open items, coordinate with the auditor and other vendors, and respond when customer security requests come in. They are also good about taking ownership of what they can and only pulling our team in when they actually need information or a decision from us.

What was your primary form of communication with Hotman Group, LLC?

• Virtual Meeting
• Email or Messaging App

What did you find most impressive or unique about this company?

What has been most valuable for us is that they do more than tell us what needs to be done. They actually help run the work. They stay involved after the initial recommendations and help with the recurring controls, questionnaires, audit work, follow-ups, and other compliance tasks that have to happen throughout the year. For a small internal team, that makes a big difference.

Are there any areas for improvement or something Hotman Group, LLC could have done differently?

N/A

BACKGROUND

Please describe your company and position.

I am the President & CEO of SCOREalytics, Inc.

Describe what your company does in a single sentence.

SCOREalytics provides an AI-powered legal and regulatory intelligence platform that helps companies, law firms, and private equity firms monitor, analyze, and manage compliance and legal risk across multiple jurisdictions.

OPPORTUNITY / CHALLENGE

What specific goals or objectives did you hire Hotman Group, LLC to accomplish?

• Build SCOREalytics’ SOC 2 program from the ground up, including right-sized policies, controls, ownership and evidence routines, while implementing Hyperproof so the team could operate the program year-round and prepare for its first audit.

SOLUTION

How did you find Hotman Group, LLC?

Referral

Why did you select Hotman Group, LLC over others?

• Good value for cost
• Referred to me
• Company values aligned

How many teammates from Hotman Group, LLC were assigned to this project?

2-5 Employees

Describe the scope of work in detail. Please include a summary of key deliverables.

HG helped us design right-sized SOC 2 policies and controls around how we actually operate, then built the program in Hyperproof so the work was organized in one place. That included the control library, policy-to-control mappings, ownership assignments, evidence tasks, recurring activities, and the initial risk register. They trained our team on how to use and maintain the platform, helped us prepare for our first SOC 2 audit, and provided ongoing guidance as questions came up. The controls were designed with our business model and AI-driven workflows in mind rather than using a generic template. As the program has matured, the focus has shifted from getting the foundation in place to keeping the work operating between audits, improving automation, preparing for Type 2, and making sure the program can scale with the business.

RESULTS & FEEDBACK

What were the measurable outcomes from the project that demonstrate progress or success?

Built and approved 22 SOC 2 policies, launched a live Hyperproof workspace, created a 40-risk register, trained the executive team, and launched the SOC 2 Type 1 audit on schedule with a structured evidence and control process in place.

Describe their project management. Did they deliver items on time? How did they respond to your needs?

We work with HG through recurring check-ins, a dedicated chat channel, and ongoing guidance as questions come up. They help us work through practical issues in Hyperproof, audit preparation, controls, and broader GRC questions rather than limiting the engagement to a one-time readiness exercise. That ongoing access has been useful for a small team because we can bring them the next issue, get context on what good practice looks like, and then make the decision that fits our business.

What was your primary form of communication with Hotman Group, LLC?

• Virtual Meeting
• Email or Messaging App

What did you find most impressive or unique about this company?

What has stood out is that they helped us build the program around how the business actually works instead of treating SOC 2 like a software implementation. We came into the process thinking more of the work would simply be automated, but the reality is that a strong program still requires real ownership, decisions, and ongoing human effort. HG has helped us understand that operational side and put the structure in place to keep the program running, not just get through the first audit.

Are there any areas for improvement or something Hotman Group, LLC could have done differently?

One thing that would have helped at the beginning was an even more basic SOC 2 “101” on what the process actually requires from the internal team. There is a strong market narrative that compliance platforms automate most of the work, and we underestimated how human and operational the process still is. Setting that expectation even more explicitly upfront would have been useful.