How this site is made, and who pays for it.

Ownership

policyandcompliance.com is published by AllyMatter Inc., which makes one of the policy management tools listed in the directory. AllyMatter is labeled on every appearance, is never a use-case pick, and receives no lead from the matching form unless the buyer names it.

The primary spot

Each page has one primary spot, the labeled Sponsored placement near the top. On pages for frameworks and policies AllyMatter supports, the primary spot carries AllyMatter's own ad, labeled as an ad from the publisher and placed at no charge. Everywhere else it carries a house ad or a paying vendor's ad at a flat fee. Buying it changes nothing else on the page. Consultant listings and consultant strips that a firm pays for are labeled Sponsored too, and buying them changes nothing else on the page either.

Data rules

• No record copies a source as-is. Each is written in our words from one or more sources, two or more where available.
• Every obligation row links to the enforcing federal or state authority. Links are re-checked regularly.
• Dates and triggers are re-verified against the source at publish.

Verification stages

Every record is drafted from one or more linked sources, two or more where available, and written in our words. As further checks are done, the record shows the stage it has reached:

• Links verified: the authority links on the record resolve to the pages they name, on the date shown.
• Accessed and verified: a person opened the publisher's own document (the statute, the rule or the agency page) and the claim on the record was checked against that document, line by line, on the date shown. This is the stage for sources that refuse automated requests, where only a person can retrieve the page.
• Human-checked: a person read the sources and confirmed the requirement and trigger on the date shown.

Assessors

The assessors lane lists only firms found on a public register kept by the accreditor or scheme owner: the FedRAMP Marketplace, the Cyber AB marketplace, the PCI Security Standards Council list, HITRUST's assessor list, IAF CertSearch and the like. Consultants who prepare you for an assessment are listed separately and cannot certify the work they helped build.

Listings

Listings come from public registers, firms’ own websites and vendor partner lists. A card taken from a register says “On the public register”; a card taken from a firm’s website says “Website checked” with the date we read it. “Verified” is reserved for a stricter standard, checked with the firm itself. A listing is not a recommendation. Any firm can confirm its own listing.

Firms, assessors and tools are listed in random order, reshuffled each time a page loads, so no one is favored by where they sit. The exception is paid listings: a firm that pays for a listing is shown at the top of the list, in a group labeled Sponsored. AllyMatter, which publishes this site, is always listed first and labeled as the publisher.

Picks

Use-case picks are chosen by hand for a stated situation, name the tradeoff, and say whether the price is public. The publisher's tool is excluded.

Languages

The site is English today. Other languages will mount under their own path, with the same records and the same stages.

For firms and individuals

Consultants can have a profile page of their own, in a full or simple layout, and firms that complete verification get a verified firm profile. Paid placements, their prices and their rules are on advertise, drawn at full size on what each ad looks like. You can also publish a press release or write a guest article, or contact us.

Liability

Nothing on this site is legal, audit or tax advice. policyandcompliance.com and AllyMatter, Inc. accept no responsibility for errors in the data or for decisions made on it. Read the source, then decide. Think something is wrong? Email [email protected].