drummondgroup.com

{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.drummondgroup.com\/","url":"https:\/\/www.drummondgroup.com\/","name":"The Compliance Experts: Software, Systems and Cybersecurity","isPartOf":{"@id":"https:\/\/www.drummondgroup.com\/#website"},"about":{"@id":"https:\/\/www.drummondgroup.com\/#organization"},"primaryImageOfPage":{"@id":"https:\/\/www.drummondgroup.com\/#primaryimage"},"image":{"@id":"https:\/\/www.drummondgroup.com\/#primaryimage"},"thumbnailUrl":"https:\/\/www.drummondgroup.com\/wp-content\/uploads\/2024\/09\/Home-Page-Hero-4-e1726070683782.jpg","datePublished":"2022-09-21T19:56:04+00:00","dateModified":"2026-05-28T20:25:01+00:00","description":"Drummond helps regulated industries like health IT, finance and supply chain to test and certify compliant solutions, enhance cybersecurity and adopt standards.","breadcrumb":{"@id":"https:\/\/www.drummondgroup.com\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.drummondgroup.com\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.drummondgroup.com\/#primaryimage","url":"https:\/\/www.drummondgroup.com\/wp-content\/uploads\/2024\/09\/Home-Page-Hero-4-e1726070683782.jpg","contentUrl":"https:\/\/www.drummondgroup.com\/wp-content\/uploads\/2024\/09\/Home-Page-Hero-4-e1726070683782.jpg","width":1280,"height":720},{"@type":"BreadcrumbList","@id":"https:\/\/www.drummondgroup.com\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home"}]},{"@type":"WebSite","@id":"https:\/\/www.drummondgroup.com\/#website","url":"https:\/\/www.drummondgroup.com\/","name":"Drummond","description":"Experts in Compliance, Standards, and Security Testing, Assessments, and Certification.","publisher":{"@id":"https:\/\/www.drummondgroup.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.drummondgroup.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.drummondgroup.com\/#organization","name":"Drummond Group, LLC","url":"https:\/\/www.drummondgroup.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.drummondgroup.com\/#\/schema\/logo\/image\/","url":"https:\/\/www.drummondgroup.com\/wp-content\/uploads\/2019\/02\/logo-drummond-group-300X155.png","contentUrl":"https:\/\/www.drummondgroup.com\/wp-content\/uploads\/2019\/02\/logo-drummond-group-300X155.png","width":300,"height":155,"caption":"Drummond Group, LLC"},"image":{"@id":"https:\/\/www.drummondgroup.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.linkedin.com\/company\/drummond-group\/","https:\/\/www.youtube.com\/@drummond_group"]}]}

{"@context":"https:\/\/schema.org","@type":"FAQPage","mainEntity":[{"@type":"Question","name":"What is the difference between a certification and a compliance audit?","acceptedAnswer":{"@type":"Answer","text":"A certification is a formal determination, issued by an authorized certification body, that a product, system, or process meets a defined (often mandated) standard. Drummond holds authorizations to issue formal certifications for programs including ONC Health IT, DEA EPCS, DEA CSOS, PCI DSS (as a Qualified Security Assessor), ISO 27001, GS1 GDSN, and others.When permitted, Drummond will provide Drummond Certified\u00ae recognition, that is widely accepted as a trusted validation of compliance.\u00a0A compliance audit or assessment is an independent evaluation of whether your practices conform to a regulatory or industry framework, resulting in a findings report rather than a certificate. This can include mandated programs that do not specify or authorize organizations as certification bodies (e.g., HIPAA).Our compliance audit-based services include HIPAA, NIST, SOC 2, FTC Safeguards, and FDA CFR 21 Part 11. When appropriate, Drummond can provide Drummond Validated\u2122 recognition, which an impartial third-party assessment validation."}},{"@type":"Question","name":"How long does a compliance assessment typically take?","acceptedAnswer":{"@type":"Answer","text":"Timeline varies by framework and scope. A NIST CSF 2.0 risk assessment typically runs four to eight weeks from kickoff to final report. A PCI DSS Report on Compliance (RoC) for a Level 1 merchant or service provider typically requires eight to twelve weeks. HIPAA gap assessments generally run four to six weeks. Penetration testing engagements range from one week for a focused scope to several weeks for a complex environment. ONC Health IT certification timelines depend on criteria scope and product readiness. Specific timeline estimates are confirmed during the initial scoping conversation.\u00a0Contact Drummond to discuss your requirements."}},{"@type":"Question","name":"What happens after Drummond identifies a compliance gap?","acceptedAnswer":{"@type":"Answer","text":"Drummond delivers a findings report with specific, prioritized remediation recommendations. You are responsible for implementation of those recommendations (or fixes). Drummond does not configure systems, write policies, or perform technical remediation. That separation is deliberate: a firm that assesses gaps, tells you what to fix, implements the fixes on your behalf, and then grades its own remediation effort has a conflict of interest. After you complete remediation, you can engage Drummond for a separate follow-on validation to independently verify that the fixes were implemented correctly. This applies to most cybersecurity and audit services. It does not apply to formal certification programs (e.g. ONC Health IT, EPCS, PCI DSS, ISO 27001) where the certification process itself governs how deficiencies and retesting are handled."}},{"@type":"Question","name":"What credentials and authorizations does Drummond hold?","acceptedAnswer":{"@type":"Answer","text":"Drummond holds independent authorizations from the regulatory and standards bodies that govern each framework it assesses. Drummond is an ONC-Authorized Testing Laboratory (ONC-ATL) and ONC-Authorized Certification Body (ONC-ACB) for ONC Health IT certification. Our ONC-ACB operates under accreditation through the ANAB\/ANSI program (Accreditation ID#\u00a01045). Drummond is a Qualified Security Assessor (QSA) for PCI DSS. Drummond is ANAB-accredited for ISO 27001 certification. Drummond is a DEA-approved third-party auditor for EPCS and CSOS. Drummond is approved by GS1 as a testing and certification provider for GDSN. For cybersecurity assessment services (e.g., NIST, SOC 2, HIPAA, penetration testing, and others ) our assessment team credentials include CISSP, CISM, CISA, and OSCP depending on the service. Full credential details are available on request."}},{"@type":"Question","name":"Does Drummond work with organizations outside the Health IT Industry?","acceptedAnswer":{"@type":"Answer","text":"Yes. Drummond serves organizations across healthcare, financial services, retail, technology, pharmaceutical, and supply chain industries. While Drummond is well known for ONC Health IT and EPCS testing and certification programs, the same independent assessment model applies across PCI DSS, NIST risk assessments, penetration testing, SOC 2, ISO 27001, FTC Safeguards, AS2\/AS4 and FHIR interoperability, and more. If your compliance obligation involves formal third-party testing, certification, or a compliance audit, Drummond likely has an applicable service. Explore our services."}}]}