Not exactly in the same industry, but I worked in a genomics startup that was subject to various aspects of HIPAA and CLIA compliance. In our case this led us t

Not exactly in the same industry, but I worked in a genomics startup that was subject to various aspects of HIPAA and CLIA compliance. In our case this led us to implement ISO 27001/27002 and eventually FedRAMP. The answer is: consultants. There are people who make it their full-time job to keep up with the regulations and advise companies on how to comply with them. This is a good place to start when you are too small to have dedicated compliance staff, or too new to understand how to hire good ones. If you have advisors or board members who are experienced in the space, they should be able to connect you with good people. If you /don't/ have advisors or board members who have been through the process successfully with other companies, that seems like a bit of a red flag tbh and a gap you'll want to fill.