Compliance without the chaos.
Frameworks are written for organisations with compliance departments. Most companies don’t have one. We bridge that gap — readiness, evidence, and audit support without a headcount you can’t justify.
The three disciplines, one engagement.
Governance
Someone has to own security decisions and be able to show how they were made. We build the policies, committees, and reporting lines that turn intent into an operating structure.
Risk
Not every vulnerability matters equally. We quantify exposure against business impact so your budget goes to the risks that could actually stop you trading.
Compliance
Certification is the proof, not the goal. We get you audit-ready and keep you there between assessments.
Eleven frameworks.
Which one applies is usually decided for you — by a contract, a regulator, or the data you hold.
Three ways to engage.
Where you start depends on how far along you already are — not every company needs the same shape of engagement.
Gap assessment
A one-off measurement against the framework that applies to you, and a costed remediation plan showing exactly what closing the gap would take.
Readiness programme
Implementation carried all the way through to the audit itself — controls, policies, and evidence collection built with your team, then support through the assessment.
Fractional compliance function
For companies without a dedicated compliance function, we can take on the ongoing governance work directly — policy maintenance, evidence collection, vendor risk reviews, and audit liaison — so it doesn’t fall on an already-stretched internal team.
The readiness journey.
Gap assessment
We measure you against the framework as it’s actually audited, not as it reads.
Remediation plan
A prioritised, costed roadmap — what to fix, in what order, and why.
Implementation
Controls, policies, and evidence collection put in place with your team.
Audit support
We prepare the evidence package and sit with you through the assessment.
Continuous monitoring
Ongoing evidence collection so the next cycle isn’t another scramble.
Continuous monitoring is its own discipline.
The last step of the readiness journey above doesn’t end when the audit does — evidence collection, control monitoring, vendor risk, and the re-assessment cycle are ongoing work.
Common questions.
It depends on your existing controls and which report type you need. A gap assessment and remediation phase typically come first, followed by the observation window itself — commonly three to twelve months for a Type II report, set by your auditor and the maturity of what’s already in place.
It depends on your buyers. SOC 2 is the more common ask from North American enterprise customers, while ISO 27001 is often expected by European counterparts and larger global procurement teams. Many companies eventually hold both; the sequence usually follows where your pipeline sits.
A gap assessment measures your current controls against a framework and produces a remediation plan; we perform this directly and it carries no certification weight on its own. An audit is the formal, independent examination carried out by a licensed CPA firm or accredited certification body that results in the report or certificate you hand to customers.
Yes. For companies without a dedicated compliance function, we can take on the ongoing governance work directly — policy maintenance, evidence collection, vendor risk reviews, and audit liaison — so it doesn’t fall on an already-stretched internal team.
Yes. We regularly work alongside a client’s existing CPA firm or certification body, preparing the evidence package and answering auditor requests directly so the relationship you already have stays intact.
Certification isn’t the finish line. Controls need to keep operating, evidence needs to keep being collected, and most frameworks require periodic re-assessment. We typically shift into a lighter continuous-monitoring engagement so the next cycle starts from a maintained baseline instead of a fresh scramble.
Find out how far off you are.
A no-obligation gap assessment shows exactly where you stand against the framework that matters to your buyers.