Consulting, audit and
training services.

ISO/IEC 27001 Readiness & Implementation

From scoping and gap assessment to a working ISMS that is ready for certification audit.

A practical, right-sized path to ISO/IEC 27001, built by an auditor who knows what certification audits actually test — and who has run security programmes from the inside.

What we do

• Scoping, context and interested-party analysis
• Gap assessment against ISO/IEC 27001 and Annex A controls
• Risk assessment and treatment methodology, Statement of Applicability
• Policies, procedures and evidence aligned to how your teams really work
• Management review, awareness and pre-certification readiness review

What you get

• A documented, proportionate ISMS — not a binder of shelfware
• Clear ownership of controls and risks
• Confidence going into your certification body audit

Internal Audits (ISO 27001 & ISO 9001)

Independent, evidence-based internal audits that satisfy the standard and genuinely improve the system.

Clause 9.2 requires objective internal audits. We provide an independent perspective, delivered with the discipline of a certified auditor and the practicality of a former CISO.

What we do

• Audit programme and schedule planning
• Process, control and clause-level audits with sampled evidence
• Clear findings: nonconformities, observations and opportunities for improvement
• Corrective action guidance and effectiveness follow-up
• Support through management review and certification surveillance

What you get

• Audit reports your management and external auditors can rely on
• Early visibility of gaps before they become certification findings

Supplier & Third-Party Audit Support

Assess and assure vendors, or prepare for the customer audits you receive.

Vendor risk and customer due diligence are now routine. We help you run supplier assurance programmes — and help you get through client audits with confidence.

What we do

• Supplier risk tiering and assessment questionnaires
• On-site or remote third-party security and quality audits
• Review of supplier certifications, scope and Statements of Applicability
• Preparing your team for customer security audits and RFP questionnaires
• Tracking remediation to closure

What you get

• A defensible, repeatable third-party assurance process
• Fewer surprises from vendors — and from your customers’ audits

Fractional CISO Services

Senior security leadership on a part-time, retained basis.

Having served as CISO for a Chicago-headquartered legal services offshoring firm and a San Francisco-headquartered lead-generation marketing corporation, we bring seasoned leadership without the cost of a full-time executive.

What we do

• Security strategy, roadmap and budget advice
• Board and leadership reporting; security governance forums
• Client security questionnaires, contractual security terms and due diligence
• Incident response readiness and oversight
• Mentoring and building your in-house security team

What you get

• An accountable security leader at a predictable monthly commitment
• Credibility with enterprise customers and auditors

Information Security, Risk & Compliance Consulting

Pragmatic advisory across security governance, risk management and regulatory expectations.

More than 25 years of building information security systems for organisations of every size means advice grounded in what works under real operational constraints.

What we do

• Information security risk assessments
• Policy, standards and control framework design
• Business continuity and incident response planning
• Data protection and client-contract compliance support
• Security programme reviews and maturity roadmaps

What you get

• A prioritised, realistic security roadmap
• Controls mapped to the requirements your customers care about

ISO 9001 Quality Management Consulting & Auditing

Build, audit and improve a quality management system that supports the business.

As a certified ISO 9001 auditor, we help organisations implement and sustain a QMS that is lean, process-driven and ready for certification and surveillance audits.

What we do

• QMS gap assessment and implementation support
• Process mapping, objectives and performance indicators
• Internal audits and management review support
• Corrective action and continual improvement coaching
• Integrated management systems with ISO/IEC 27001

What you get

• A QMS that people use, not just one that exists on paper
• Readiness for certification and surveillance audits

Tailored Training

Practical, engaging training for leadership, auditors and teams.

Training is a genuine passion. Programmes are tailored to your organisation, language and risks — delivered in-person or online.

What we do

• ISO/IEC 27001 and ISO 9001 awareness for staff and management
• Internal auditor training with case studies and practice audits
• Security awareness programmes and role-based sessions
• Workshops for leadership on risk and governance
• Custom curricula for your teams

What you get

• Teams that understand their role in the system
• Internal auditors who are confident and effective