Data center DR runbooks and compliance evidence via read‑only capture.

Security and compliance leaders sponsor engagements when calendared DR audits or regulatory cycles create budget and urgency:

• CISO
• Head of Risk
• IT Compliance leader
• Director of Internal Audit

Operations teams provide access and validate output during the engagement. MKDC scopes and delivers the audit artifact set your committee needs.

See the full checklist under Deliverables on this page. Discovery, recovery, and compliance deliverables ship together in one fixed-fee engagement.

View Deliverables checklist

Yes — that gap is why security and compliance leaders engage us before an audit cycle. We map what is running via read-only API capture and validate inventory, L2/L3 topology, and dependencies before publish — not by copying outdated diagrams.

The full checklist of capture-derived deliverables is in the Deliverables section of this page. View the checklist.

Your operations teams document intent — what is critical, who owns it — through guided follow-ups we structure for them.

Where vendor coverage is partial, every deliverable labels what was captured and what was not.

We deliver automated compliance reports with per-framework gap analysis, mapped to the DR and business-continuity controls of each framework, for:

• FFIEC BCM Booklet
• SOC 2 — Common Criteria 9 (Risk Mitigation / BCM)
• SOX ITGC (recovery + change-management subset)
• HIPAA Security Rule §164.308(a)(7) Contingency Plan
• HHS 405(d) HICP — Resilience subset
• ISO 22301:2019 — BCMS operational subset (crosswalk)

Each engagement includes a cross-framework index and evidence bound to the captured estate in the witness bundle. Full control catalogs are scoped in the SOW.

No. MKDC engagements deliver advisory documentation, not formal attestation. You receive a reproducible witness bundle — you or any third party can re-derive each conclusion from its source evidence, within the engagement scope — but we do not sign attestations or substitute for independent auditor judgment. We work alongside your auditor or DR consultancy rather than replacing them.

How we partner with auditors and consultancies

Yes. Every engagement includes a reproducible witness bundle — source captures, validation logs, and an integrity manifest — so internal audit or any third party can re-derive each conclusion within the engagement scope, without MKDC in the room. We do not sign attestations or substitute for your auditor's judgment.

No. We capture read-only from management APIs only — vCenter, network device APIs, storage controllers, OOB — with no agents installed on production workloads. Zero production interruption is a core requirement of how we built the product, not a best-effort claim.

We document what is running and how it connects from read-only API capture. Labeling production workloads, application ownership, and business criticality requires context your operations teams hold. We structure follow-ups so they can enrich the map with the labels your audit committee needs — instead of guessing under exam pressure.

Recovery runbooks and automated compliance reports with per-framework gap analysis are derived from the same validated capture. Splitting the pillars would produce inconsistent or non-reproducible artifacts — recovery runbooks disconnected from the dependency map, compliance gaps without estate evidence. One fixed-fee engagement, 4–6 weeks, one witness bundle.

Discovery tools and CMDBs are built for maps you run day to day — not for a calendared DR audit packet. MKDC is read-only capture timed to your compliance cycle: cross-tier validation, recovery runbooks, automated compliance reports with per-framework gap analysis, and a reproducible witness bundle so conclusions trace to source evidence. That is why teams add MKDC when the gap is audit-grade documentation examiners can re-check — not when they only need a live dependency dashboard.

MKDC is for audit-ready DR and compliance documentation on operational data centers. We're usually not the right fit when:

• You only need a live dependency map or inventory update — not audit-grade documentation before a DR audit or compliance cycle.
• Your scope is cloud-native (for example, SOC 2) with no on-premises data center for us to capture.

We're a partial fit — not a full substitute — when:

• You need formal attestation signatures or a facilitated DR tabletop exercise today. We deliver the advisory documentation and reproducible witness bundle those reviews depend on; we do not sign attestations or run tabletop exercises ourselves.

For most US enterprise data centers, yes — we capture read-only from the management APIs of commonly deployed network, compute, and storage platforms (for example VMware vSphere, major DC switching vendors, NetApp ONTAP, Pure FlashArray, Dell PowerStore, and typical out-of-band server management). We run a short qualification conversation before any SOW to confirm your mix. If coverage is partial, every deliverable labels what was captured and what was not; estates outside current support go on a wait-list and inform our roadmap.

You keep everything: inventory, topology, recovery runbooks, automated compliance reports with per-framework gap analysis, and the witness bundle, which internal audit or examiners can re-check later without MKDC. Most teams re-capture before the next audit cycle or after a major migration, so the documentation matches production again. Each re-capture is scoped as its own engagement.

Each engagement runs under a Master Services Agreement with a fixed-scope SOW. MKDC's liability under that contract is capped at the engagement fee. We carry $5–10M aggregate Errors & Omissions coverage, bound before any signed engagement.