A requirement-by-requirement comparison of current practices against the standard, producing a list of gaps to close.
Writing and maintaining the System Security Plan, policies, and procedures that assessors review as evidence.
Ongoing monitoring, evidence collection, and maintenance that keeps a compliance program current between assessments.
Mock assessments, evidence review, and staff interview practice ahead of a C3PAO certification assessment.
These descriptions explain each service in general, not this firm's specific offering.