CONSULTANCY // HANDS-ON

When the AI report isn't enough, we step in

Practitioner-led compliance work. ISMS build-outs, audit readiness sprints, mock audits, and ongoing retainers. No frameworks-as-PowerPoint nonsense.

SERVICES

Four ways we engage

6–12 weeks

COMPLIANCE SPRINT

From £8,500

Fixed-scope ISMS build for ISO 27001, SOC 2, or Cyber Essentials Plus. Policies, procedures, evidence, and a Stage 1 readiness review.

  • Gap analysis
  • Policy & procedure suite
  • Risk register
  • Statement of Applicability
  • Evidence pack
  • Stage 1 readiness sign-off
4 weeks

AUDIT READINESS

From £5,500

Pre-audit deep dive when your certification body visit is locked in. We close the open gaps and rehearse the auditor conversations.

  • Documentation review
  • Evidence-pack hardening
  • Internal audit run
  • Auditor Q&A rehearsal
  • Day-of-audit support
1–2 weeks

MOCK AUDIT

From £3,500

Full Stage 1 / Stage 2 simulation by an ISO 27001 lead auditor. Findings report with severity scoring you can hand to your team on Monday.

  • Document audit
  • Live walkthroughs
  • Non-conformity report
  • Remediation roadmap
  • Re-test of critical findings
Monthly

ISMS RETAINER

From £1,800/mo

Outsourced ISMS function. We run your management reviews, internal audits, supplier assessments, and incident handling on retainer.

  • Management review chair
  • Quarterly internal audits
  • Supplier risk reviews
  • Incident response support
  • Continuous policy updates

WHY US

Practitioners, not auditors-turned-consultants

We've sat in the auditor's chair

Lead auditor experience across ISO 27001, SOC 2, and the UK GDPR landscape. We know what gets flagged.

Fixed scope, fixed price

No hourly billing surprises. You get a statement of work with deliverables and a date.

We build, then hand over

An ISMS your team can run. Documentation, training, and a transition plan — not a binder you'll never open.

DISCOVERY CALL

Book a 30-minute discovery call

Tell us where you are. We'll email you back within one business day with two or three time slots that work.

No calendar tool. Carl emails back personally.