From requirement to evidence.
We help organisations turn compliance obligations into workable controls, documented policies, and audit-ready evidence, across ISO/IEC 27001, SOC 2, PCI DSS, DORA, ISO/IEC 42001, and ISO/IEC 27701.
Frameworks we supportFrameworks we support.
Each framework has its own scope, control requirements, and evidence expectations. We work across all of them and understand how they interact, useful when your organisation faces more than one obligation at once.
Information security
The international standard for information security management systems. We support gap assessment, control implementation, documentation, and preparation for certification audit.
Privacy management
An extension to ISO 27001 covering privacy information management. Addresses GDPR and other data protection obligations through a structured management system approach.
Audit readiness
A US-origin assurance framework used by technology and SaaS businesses to demonstrate security, availability, and processing integrity to enterprise customers.
Payment security
Required for organisations that handle cardholder data. We support scoping, gap analysis, control implementation, and preparation for qualified security assessor reviews.
Digital resilience
The EU Digital Operational Resilience Act applies to financial entities and their ICT providers. We help with ICT risk management, incident reporting frameworks, and third-party risk assessments.
AI risk governance
The NIST AI Risk Management Framework helps organisations govern AI systems across their lifecycle. Applicable alongside or independently of ISO/IEC 42001 requirements.
AI management systems
The international standard for artificial intelligence management systems. Addresses responsible AI development, deployment, and use within a structured governance framework.
How we work.
Compliance work is not a one-off project, it is a cycle. We support every stage, from initial assessment through to ongoing monitoring after certification.
Gap assessment
Evaluate your current state against the framework requirements. Identify what is in place, what is missing, and where the highest-priority gaps lie.
Control implementation
Design and implement the technical and organisational controls needed to meet the requirements, matched to your environment and how your organisation operates.
Evidence collection
Build the documentation, logs, and artefacts that demonstrate your controls are working. We structure evidence so it is coherent and straightforward to present.
Audit preparation
Walk through the audit process before it happens. Address gaps in evidence, prepare personnel, and ensure nothing catches the auditor by surprise.
Ongoing monitoring
Post-certification, maintain the programme: manage exceptions, update controls as the environment changes, and keep evidence current for surveillance reviews.
Common questions.
What is the difference between ISO 27001 and SOC 2?
ISO 27001 is an international standard that results in a certification issued by an accredited certification body, it specifies what an information security management system must contain. SOC 2 is a US-origin attestation framework issued by a CPA firm, it assesses controls against defined Trust Service Criteria. ISO 27001 is more common in European and enterprise procurement contexts; SOC 2 is prevalent in US SaaS markets. Many organisations pursue both over time.
How long does certification typically take?
For ISO 27001, the timeline from starting gap assessment to passing a Stage 2 certification audit is typically six to twelve months, depending on the size of your organisation and how much is already in place. SOC 2 Type 2 requires a minimum observation period (commonly six or twelve months) before the audit can be completed. We establish realistic timelines during scoping.
Can you help with post-certification maintenance?
Yes. Certification is not a one-time outcome, it requires ongoing management. We offer retained advisory support to keep your programme current, manage control changes, respond to audit findings, and ensure your evidence is ready for surveillance and recertification audits.
Let's turn your compliance obligations into a workable programme.
Tell us which frameworks apply, where you are in the process, and any deadlines or constraints. We'll outline the right approach.