Loading page…
Advisory practice
A certificate is the outcome, not the objective. We implement management systems that hold up between audits — with real risk assessments, controls people follow, and evidence that accumulates on its own.
In this practice
+3 more services in this practice
What we usually find
Outcomes
A gap analysis that tells you exactly what is missing, and a remediation plan sequenced so certification is not blocked by dependencies discovered late.
Where you hold several standards, one management system with a common control set, one internal audit programme and one management review.
Policies and procedures written from how your organisation actually works, so operational teams follow them without a translation layer.
Controls designed so that operating them produces the evidence, instead of evidence being reconstructed before each audit.
What we deliver
Scoped individually or combined into a programme, depending on where you are starting from.
ISMS scope and context, risk assessment and treatment, Statement of Applicability, Annex A control implementation, internal audit and certification support.
PIMS extension to your ISMS covering controller and processor obligations, with mapping to privacy regulation including GDPR.
Cloud-specific control guidance for shared responsibility, tenant isolation, virtual environment security and cloud provider assurance.
Service management system design aligning IT service delivery, incident, change and problem management to business needs.
Process definition, quality objectives, customer focus and continual improvement built into how work is already done.
Business impact analysis, recovery objectives, continuity and recovery plans, and a testing programme that proves they work.
Environmental management and occupational health and safety systems with aspect, impact and hazard assessment.
Anti-bribery management system covering policy, due diligence, financial and commercial controls, and reporting channels.
Deliverables
Named outputs, not a workstream description. Every item below is produced by this practice and can be reviewed in draft before it is finalised.
Defined management system boundary, interested parties and their requirements, and the internal and external issues the system has to address.
Assessment against every clause and control of the applicable standard, each finding rated with an owner and an effort estimate.
Asset and process-based risk assessment feeding a documented treatment plan, and — for ISO 27001 — a justified Statement of Applicability.
Mandatory documented information plus the operational procedures the standard requires, written to match how your organisation actually works.
A full internal audit cycle: programme, checklists, fieldwork records, non-conformities raised and closed, and the audit report.
Management review inputs and minutes, plus the evidence set assembled for Stage 1 and Stage 2 certification audit.
Our approach
Each stage produces something you can review before the next one starts. No stage depends on trusting that the previous one went well.
Define the boundary, interested parties, applicable requirements and the certification outcome you need.
Clause-by-clause and control-by-control assessment against the standard, with each gap given an owner and an effort estimate.
Asset and process-based risk assessment feeding a treatment plan and, for ISO 27001, a justified Statement of Applicability.
Policies, procedures and controls built with the teams that will operate them, plus the records the standard requires.
A full internal audit cycle, non-conformities raised and closed, and a management review that meets the clause requirements.
Stage 1 and Stage 2 readiness, auditor liaison, and support closing any findings raised by the certification body.
SecureGRC · technology enablement
SecureGRC holds the management system as an operating record: clauses and obligations with owners, evidence attached where it belongs, non-conformities tracked to closure, and the audit programme scheduled rather than remembered.
Relevant platform capabilities
Common questions
Related practices
Next step
Tell us your current position, what has to be demonstrated and the date it is required by. You will receive a scoped approach with defined stages — not a generic proposal.