Services

Six practices that answer to the same programme

Governance design, management systems, technical testing, independent audit, data governance and enablement. Engagements draw on whichever practices the problem needs, staffed by one accountable team.

Discuss your requirements Explore SecureGRC

01 · Advisory practice
Governance, Risk & Compliance
Risk frameworks, regulatory obligations and a GRC operating model your board can actually govern from.
Explore this practice
What this practice covers
- Enterprise risk framework design
- Risk assessment and register build
- Regulatory and contractual obligation mapping
- Regulatory change monitoring
- GRC operating model and governance structure
- Control framework rationalisation
02 · Advisory practice
ISO & Management Systems
ISO 27001, 27701, 27017, 20000-1, 9001, 22301, 14001, 45001 and 37001 — from gap analysis to certification and beyond.
Explore this practice
What this practice covers
- ISO/IEC 27001 — Information Security
- ISO/IEC 27701 — Privacy Information
- ISO/IEC 27017 — Cloud Security
- ISO/IEC 20000-1 — IT Service Management
- ISO 9001 — Quality Management
- ISO 22301 — Business Continuity
03 · Technical practice
Security Assessments
Vulnerability assessment, penetration testing, configuration review, web application testing and source code review.
Explore this practice
What this practice covers
- IT network vulnerability assessment
- Penetration testing
- Web application security testing
- Configuration assessment
- Network security assessment
- Source code review
04 · Assurance practice
Audit & Assurance
Internal audit, control testing, compliance evaluation and operational reviews against recognised standards.
Explore this practice
What this practice covers
- Internal audit programme
- Security control assessment
- Compliance evaluation
- Certification readiness audit
- Operational efficiency review
- Third-party and supplier audits
05 · Advisory practice
Data Governance & Privacy
Ownership and stewardship, classification, data quality and lifecycle — with privacy obligations built in from the start.
Explore this practice
What this practice covers
- Data governance framework and operating model
- Data ownership and stewardship
- Data discovery, cataloguing and metadata
- Data classification and handling
- Data quality management
- Privacy compliance
06 · Enablement practice
Training & Awareness
Practical security, privacy and compliance training that changes how teams work — not annual slide decks.
Explore this practice
What this practice covers
- Information security awareness
- Data privacy training
- Regulatory compliance training
- ISO standard and internal auditor training
- Control owner enablement
- Phishing simulation programmes

How engagements run

The same shape, whatever the practice

We assess before we design, design with the people who will operate it, implement into a system rather than a document set, and prove it works before we leave.

01
Advisory
Assess the current state, design the framework, agree ownership
02
Implementation
Build controls, populate registers, close gaps with the teams that own them
03
Technology
Run the programme in SecureGRC with workflow, evidence and reporting
04
Assurance
Audit, test and retest — findings tracked to verified closure

Advisory + technology

Where the consulting ends, the platform starts

Every practice has a hand-off point where a designed framework becomes a running programme. That hand-off is where most consulting engagements quietly fail.

SecureGRC exists to absorb it. The registers we populate, the owners we assign and the cadence we agree become live records with workflow, reminders and reporting attached — so the programme keeps running after the engagement closes.

Explore SecureGRC Request a demo

Using another platform?

That is fine, and common. The advisory work stands on its own and we implement into whatever system you already run. SecureGRC is offered where clients want the framework and the tooling to come from the same team — not as a condition of engagement.

Framework design is platform-neutral by default
We will map your framework into your existing GRC tool
No licence commitment is bundled into consulting scope

Scoping

Engagements are scoped around the outcome, not the service line

Most programmes begin with a problem rather than a practice area. Describe what you need to demonstrate and to whom, and we will define the work it actually requires — including where that is narrower than anticipated.

Discuss your requirements Explore SecureGRC