Skip to main content

IT Risk & Compliance Services

forward vision Secures
Close up of woman's hand typing on computer keyboard in the dark against colourful bokeh in background.

IT consultants offering innovative intelligence and compliance strategies tailored to your needs


Years on average of IT risk and compliance experience among team leaders

Wide range

Of industry experience, including financial services, government contracting, higher education, healthcare, and the public sector

Helping address today's security challenges with IT risk management, compliance, and governance services.

As organizations adopt innovative and disruptive technologies, effective IT governance, risk management, and compliance programs become imperative to maintaining data sensitivity and uninterrupted business operations. In an uncertain and changing business environment, increased reliance upon technologies introduces new risks, as well as more compliance obligations for organizations of all sizes and complexity.

Your IT Risk & Compliance team at Forvis Mazars is designed for impact and brings the agility required to help you move at pace to overcome the biggest IT security obstacles that stand between current and future state.


Move with momentum to help stay compliant and secure with Forvis Mazars’ cybersecurity team. Learn more about our offerings below.

Learn More

Ransomware Simulation

Our Ransomware Simulation is a fully automated live ransomware simulation conducted on an organization’s production network. It is designed to consider how an organization’s internal network and security controls prevent the lateral spread of ransomware using our safe-by-design ransomware simulation software.

Government Contracting and CMMC Compliance

Preparing for Certification With CMMC 2.0

In November 2021, the Department of Defense (DoD) affirmed plans to move forward with the Cybersecurity Maturity Model Certification (CMMC) to protect Controlled Unclassified Information (CUI), introducing sweeping changes to how contractors comply with requirements. Final rulemaking is underway and implementation guidance is released regularly to clarify expectations for contractors and CMMC assessors. While the implementation of CMMC and rollout timeline have changed, CMMC will still be mandatory across the Defense Industrial Base (DIB) and will appear in all contracts over the next several years.

Forvis Mazars is one of the first Authorized CMMC Third-Party Party Assessor Organization (C3PAO) with the CMMC Accreditation Body. As a C3PAO, Forvis Mazars provides NIST 800-171 and cybersecurity program readiness consulting for contractors of all sizes across the country. Our firm is also a national leader in performance of NIST 800-171 Joint Surveillance Voluntary Assessments (JSVA) with DoD, which are expected to convert to CMMC Level 2 certifications, once the final CMMC rule is published and implemented.

IT Risk & Controls / SOX

IT audits and general control testing evaluate your institution’s control environment based on current policies, applicable law, regulations, or guidelines. Our tests can help assess your ability to safeguard assets, maintain data integrity, and effectively achieve security objectives. Below are some of the tests our professionals can perform for you:

  • FDICIA IT Key Control Testing
  • SOX IT Key Control Testing
  • Customized IT Internal Audit Control Testing

International Organization for Standardization and the International Electrotechnical Commission (ISO/IEC) 27001 Solutions

Helping You Prepare for an ISO 27001 Certification & Providing Independent ISMS Assessment Support

Organizations operating at an international scale are faced with a unique challenge associated with information security and privacy assurance. Our team of lead auditors is well positioned to support you with understanding the process to prepare for an ISO 27001 certification and meeting requirements for maintenance of the Information Security Management System (ISMS Forvis Mazars’ team members are ready to support you with preparing for and pursuing an ISO 27001 Certification.

Forvis Mazars offers various ISO 27001 solutions to help meet your organization’s needs:

  • ISO 27001/27002 Readiness Assessment – The ISO 27001 Readiness Assessment is designed to support organizations in evaluating the statement of applicability and potential nonconformities associated with an ISO 27001 Certification.
  • ISO 27001 Internal Audit Services – A key component of ISO 27001 readiness and compliance is the maintenance of an internal control monitoring function. Our lead auditors’ knowledge and experience of ISO 27001 allows them to support your organization efficiently and effectively with the internal audit requirement.
  • ISO 27001 Certification Support – Performing ISO 27001 audits results in the submission of the recommendation for certification to one of Forvis Mazars’ Certification Body partners.

PCI Compliance

Protect Your Business & Customer Data

Our PCI compliance services include:

  • PCI Report on Compliance Assessments – Provide independent validation of PCI DSS compliance in the form of a RoC that can be submitted to an acquiring bank or the major card brands. This is a requirement for merchants with more than six million VISA or MasterCard transactions per year.
  • PCI Readiness Assessments – Readiness assessments help organizations validate they can meet compliance with the Data Security Standard (DSS). Version 4.0 of the DSS introduces complex changes to protection and compliance reporting requirements, requiring merchants and service providers to enhance their PCI compliance processes.
  • Self-Assessment Questionnaire (SAQ) Assistance – Perform assessment against the correct SAQ Form, based upon the nature of payment transaction or transmission channels within your business. SAQs may be used by merchants with fewer than six million VISA or MasterCard transactions per year or service providers with fewer than 300,000 transactions per year.
  • PCI Compliant Network Penetration Testing – Identify potential network and application vulnerabilities impacting your cardholder data environment.

Third-Party Risk Management

With the everchanging operating landscape, companies are turning to third parties to remain competitive and drive efficiencies. While third parties are often important to the operational success of an organization, each relationship presents unique risks that must be identified, managed, and monitored. At Forvis Mazars, our consulting professionals provide services to clients for all aspects of third-party risk management, including framework development and implementation, risk assessment, risk mitigation, and lifecycle development and monitoring. Our teams are prepared to advise on the complexities of third-party risk and achieve strategic business objectives. We offer the following services:

  • Program Evolution & Enhancement
  • Assessment Assistance
  • TPRM Regulatory Compliance

Transaction Advisory

Tackling Information Technology Risk & Compliance Challenges

For businesses engaged in mergers and acquisitions, information technology risks can derail a deal. When you purchase a company, you own its data—past, present, and future—which can have a significant impact on valuation. Forvis Mazars helps your company identify information technology and data risk associated with a transaction.

Helping You Mitigate Risk

Our goal for each transaction is to arm our clients with the appropriate information to allow them to make important decisions about proceeding, renegotiating, restructuring, or withdrawing from a potential transaction. Information technology risk can affect a company’s value in many ways:

  • Technology Governance & Strategic Initiatives
  • Direct & Long-Term Remediation Costs
  • Increased Cyber Insurance Cost
  • Scalability & Functionality Failures
  • Hidden or Buried IT Costs
  • Significant Business Interruption

To help you manage these risks, our team assesses information technology areas and compliance activities of the target company or acquisition to determine if services and processes are secure, streamlined and efficient, and support continuity of operations post transaction.

Learn More

Data Privacy

Increasing Regulatory Scrutiny on Handling of Sensitive Consumer Information

The European Union’s Global Data Protection Regulation (GDPR) introduced minimum standards for increasing transparency of how organizations use consumer information and outlining minimum rights to consumers to define how organizations can use their data.

As the data privacy landscape continues to evolve—and more stringent regulations are passed—we help our clients design and develop privacy solutions that address compliance obligations and protect their brand in the marketplace.


Data privacy governance goes far beyond technology solutions and impacts core business processes and data flows.

  • Data Discovery & Process Mapping
  • Policy & Procedure Development
  • Data Privacy Impact Assessments (DPIA)
  • Record of Processing Activity (ROPA) Documentation
  • Third-Party Vendor Management (TPRM) & Assessments
  • Internal Audit Support

Forvis Mazars is experienced with the following cybersecurity standards, frameworks, and regulations.

  • California Consumer Privacy (CCPA/CPRA)
  • Global Data Protection Regulation (GDPR)
  • HIPAA Privacy Rule
  • NIST Privacy Framework
  • State Data Breach Notification Rules

Related FORsights

Like what you see?
Subscribe to receive tailored insights directly to your inbox.

How Forvis Mazars Can Help You

Two high rise office buildings glistening under a setting sun.
Financial Services
Accounting, tax, audit, and consulting services for the financial institution industry.
Government Contracting
Government contract consultants, auditors, and tax advisors serving clients nationwide.
Learn More
Illustration of a DNA molecule.
Healthcare & Life Sciences
Forvis Mazars can help you find sustainable growth for your healthcare organization.
Text bubbles with Forvis logo
Convenient locations to serve your needs.
Find a Location Near You
People discussing at a desk
Explore Your Passion Working at Forvis Mazars

Let's Get Started

Connect to experienced guidance.

How Can We Help You Today?
Wherever you are on your journey, we can help drive your business forward.
Subscribe to FORsights
Get tailored insights and resources.