Service 04
Compliance
consulting
ISO 27001, GDPR, PCI DSS, SOC 2 and NIS2 — built so the controls keep working after the auditor has gone home.
In short
Compliance consulting is the work of translating a standard's requirements into controls that fit how your organisation actually operates, then producing the evidence that proves those controls are working. The difference between a compliance programme that lasts and one that collapses after certification is whether the controls were designed around the business or bolted on for the audit.
The standards we work with
ISO/IEC 27001:2022
The international standard for an information security management system. Certification requires a defined scope, a risk assessment, a Statement of Applicability covering the 93 Annex A controls, mandatory documentation, internal audit, management review, and a two-stage external audit. Our ISO 27001 readiness guide walks through the whole sequence, including realistic timelines.
UK GDPR and EU GDPR
Data protection obligations that bite hardest on accountability: knowing what personal data you hold and why, having a lawful basis for it, honouring data subject rights within statutory deadlines, assessing high-risk processing, controlling international transfers, and being able to detect and report a breach within 72 hours. Most GDPR failures are not failures of intent — they are failures to know where the data went.
PCI DSS v4.0.1
Applies wherever payment card data is stored, processed or transmitted. The largest single lever is usually scope reduction: removing cardholder data from your environment, or segmenting it properly, cuts both the compliance burden and the underlying risk. We do the scoping work before the control work, because the alternative is paying to secure data you did not need to hold.
SOC 2
The report North American enterprise buyers ask for. A Type I report assesses control design at a point in time; a Type II assesses operating effectiveness over a period, usually three to twelve months, which is why the timeline cannot be compressed indefinitely. Preparation focuses on selecting the right Trust Services Criteria and producing evidence continuously rather than reconstructing it before the audit window closes.
NIS2
The EU directive extending cyber security and incident-reporting duties to a far wider set of sectors, with obligations on management bodies personally and short incident-reporting deadlines. If you operate in the EU in an in-scope sector or supply someone who does, the first question is whether it applies to you — and it now applies to many organisations that were out of scope under the original NIS.
How we work
- Applicability and scope. Which obligations genuinely apply, and how narrowly the scope can honestly be drawn. Scope decisions determine most of the cost of everything that follows.
- Gap analysis. A control-by-control assessment of where you stand, separating what is missing from what exists but is not evidenced — two very different amounts of work.
- Control design and implementation. Designing controls that fit your operations, and writing documentation that describes what the organisation does rather than what a template says it should.
- Evidence and operation. Building the routine that generates evidence as a by-product of working normally, so audit preparation is not an annual crisis.
- Audit support. Internal audit, management review, readiness assessment, and being present through the certification audit itself.
What you receive
A typical programme delivers the following, scaled to the standard and the scope agreed at the outset.
- A written applicability assessment and scope definition.
- A gap analysis mapped control by control, with effort estimates.
- A prioritised implementation plan sequenced by dependency, not by control number.
- Policy and procedure documentation drafted for your organisation, not filled in from a template.
- An evidence framework showing what is collected, by whom, how often, and where it lives.
- Readiness assessment before the external audit, and support during it.
We prepare organisations for certification. We do not issue certificates: under ISO rules, certification is granted by an accredited certification body that must be independent of the consultancy that helped you prepare. Any consultancy claiming it can both prepare and certify you is describing something that would invalidate the certificate.
Compliance is not the same as security
A certificate proves that a defined set of controls was assessed against a standard on a particular date. It does not prove that your systems cannot be broken into — which is why certification programmes and technical testing belong together. Run properly, they reinforce each other: the standard requires testing, and the testing produces evidence the standard wants to see.
CSA CCM v4 and CAIQ v4 cloud assurance
We assess cloud services against the Cloud Security Alliance Cloud Controls Matrix v4 — 197 control objectives across 17 domains — starting with a shared-responsibility delineation that states, control by control, who owns what between provider and customer. The matrix carries published mappings to ISO/IEC 27001, 27017 and 27018, the AICPA trust services criteria, CIS Controls, NIST CSF, NIST SP 800-53 and PCI DSS, so one evidenced assessment can be reported against several frameworks. CAIQ v4 work is offered on both sides: helping a provider prepare defensible, evidenced responses, and helping a customer evaluate the responses it receives rather than accepting them at face value.
Continuous audit metrics
An annual point-in-time audit no longer gives meaningful ongoing assurance at modern release velocity. We design continuous audit metrics that are owned, actionable, measured often enough to intervene, traceable to a control and tamper-resistant, and we help you decide which controls deserve one.
Questions we are asked
How long does ISO 27001 certification take?
For most small and mid-sized organisations starting without a management system, six to twelve months is realistic. The floor is set by the standard itself rather than by effort: the ISMS must have been operating long enough to produce evidence, including at least one internal audit and one management review, before a certification body can complete a Stage 2 audit. Organisations already running mature controls move faster; organisations that need to build the practices from scratch take longer.
Which standard should we do first?
Usually the one a customer is asking for, since that is the one with revenue attached. Beyond that: ISO 27001 is the broadest and most widely recognised internationally and makes a good foundation because other frameworks map onto it; SOC 2 is more often requested by North American buyers; PCI DSS is not optional if you handle card data; GDPR and NIS2 are legal obligations rather than choices. Doing ISO 27001 first generally reduces the marginal cost of the others substantially.
Can we reuse work across multiple standards?
To a large degree, yes. Access control, change management, logging, supplier management, incident response and risk assessment appear in every framework in slightly different language. We map controls once against a common set and then show how that set satisfies each standard, so the same evidence serves several audits. The overlap is why sequencing matters — the second certification costs considerably less than the first if the first was built properly.
Do we need a full-time compliance person?
Not necessarily, but you do need a named owner with authority. Standards require accountability to sit with someone identifiable, and audits go badly when no one can answer for a control. For smaller organisations that role is often part of an existing job supported by external help, which is one of the things a virtual CISO engagement is for. What does not work is treating compliance as a project with an end date and no owner afterwards.
What happens after certification?
The management system has to keep running. ISO 27001 certificates run on a three-year cycle with surveillance audits in between, and the standard requires continuing internal audit, management review, risk reassessment and improvement throughout. SOC 2 Type II reports cover a period and are reissued for each new period. This is the point at which programmes built for the audit rather than for the business tend to fall apart — and it is why we build the evidence routine into normal operations from the start.
Next step
Talk to a security consultant
Tell us what you are building, defending or certifying. We will tell you plainly what we would test first, what it takes, and whether you need us at all.