Services
Engagements built for outcomes, not slide decks.
Fixed-scope engagements and ongoing specialist support across information security, GRC and pragmatic technology transformation. Every engagement starts with a free 30-minute scoping call.
ISO 27001 Lead Implementer
Stand up a certifiable ISMS in 12–16 weeks.
- Stage 1 and Stage 2 audit readiness with zero non-conformities
- ISMS that operates beyond certification — not shelfware
- Executive and board reporting cadence aligned to risk appetite
Essential Eight Implementation & Maturity Uplift
Move from ML0/ML1 to ML2 or ML3 with confidence.
- Evidence-backed maturity assessment across all eight mitigations
- Prioritised, costed uplift roadmap to ML2 or ML3
- Sustained maturity — not a point-in-time score
Zero Trust Maturity Uplift
Identity-first reference architecture for hybrid environments.
- Current-state Zero Trust maturity baseline
- Reference architecture aligned to CISA / Microsoft ZTMM
- Phased rollout plan tied to identity, device, network, data and apps
ISO 27001 Self-Assessment
Know where you stand before the auditor does.
- Honest, evidence-backed view of your current posture
- Heatmap of conforming, partial and non-conforming controls
- Prioritised remediation plan with effort and cost estimates
Low-Cost Digital Transformation
Modernise without the seven-figure programme.
- 3-year digital strategy aligned to operating model
- Vendor and licensing optimisation (typically $200k–$1M+ in savings)
- Cloud governance and adoption cadence that sticks
Zero Code / Low Code Transformation
Power Platform and SaaS-led delivery, governed.
- Shadow IT replaced with auditable, governed workflows
- Faster delivery cycles at a fraction of bespoke build cost
- Citizen-developer capability with guardrails
IT Vendor & Supplier Recontracting & Negotiations
Reset commercial terms. Recover budget. Without burning relationships.
- Typical 15–35% reduction on in-scope contracts
- Modernised commercial terms — outcome-based, not seat-based
- Stronger SLAs, exit rights and price-rise protection
ISO 27001 Audit Readiness Gap Analysis
Are you ready for the big day?
- Clear, evidence-based view of audit readiness
- Ranked list of likely non-conformities and observations
- A focused fix list to close the highest-risk gaps before audit
Cloud Transformation & Serverless
Move to the cloud with intent — pay for outcomes, not idle infrastructure.
- Right-sized cloud target architecture (AWS, Azure or hybrid)
- Governed landing zone with identity, networking and guardrails baked in
- Workloads modernised toward serverless — lower run cost, less ops toil
Quality Assurance as a Service
ISO 9001-grade quality, without a full-time QA team.
- ISO 9001-aligned Quality Management System that actually runs
- Continuous internal audit programme and management review cadence
- Audit-ready evidence on demand — no last-minute scrambles
ISO 9001 + ISO 27001 Integrated Management System
Optimise your quality assurance — one system, two certifications.
- Single Integrated Management System (IMS) covering Quality and Information Security
- One policy stack, one risk methodology, one internal audit programme
- Lower audit cost and effort — combined external audits where the certifier allows
Automated Evidence Management
Stop chasing screenshots. Let evidence collect itself.
- Continuous, timestamped evidence per control — not point-in-time screenshots
- Dramatically reduced audit prep effort (typically 60–80% less)
- Auditor-ready evidence library that's always current
Right-Fit Risk Framework Implementation
Pick the right risk framework for your business — then make it actually run.
- Clear, defensible choice of risk framework(s) — and why
- Single risk taxonomy, appetite statement and reporting line into the board
- Risk management that informs decisions, not just fills a register
Integrated Essential Eight, ISO 27001, ISO 31000, ISO 9001 & RFFR Journey
One programme, five frameworks, dramatically less complexity.
- One sequenced roadmap covering all five frameworks
- Shared risk methodology (ISO 31000) feeding ISMS, QMS and RFFR
- Single internal audit programme and combined / coordinated external audits
Centralised SharePoint Auditor Portal
One audit portal. Every framework. Every auditor.
- Single, governed portal serving every external and internal auditor
- Evidence, policies and registers organised by framework and control
- Auditor access scoped, time-bound and fully logged — no email attachments
Virtual CISO (vCISO)
Executive-grade security leadership — on a fractional retainer.
- Accountable, named security leader in the org chart and to the board
- Risk-based security strategy aligned to business objectives and appetite
- Measurable maturity uplift across people, process and technology
Low-Cost ISO 27001 — Design, Implement, Adopt & Sustain
Certifiable ISO 27001 without big-four price tags.
- Certifiable ISMS delivered at a fraction of typical market cost
- Stage 1 and Stage 2 audit readiness with zero non-conformities targeted
- Internal team trained to run the ISMS without ongoing consultant reliance
System Digitisation
Retire paper, spreadsheets and shared inboxes — at audit-grade quality.
- Manual, paper-based workflows replaced with governed digital systems
- Single source of truth across operations, compliance and reporting
- Audit-ready transparency with full traceability and version history
Business Process Automation
Remove manual bottlenecks. Build governed, auditable workflows.
- Manual approval, review and tracking workflows fully automated
- Real-time process dashboards and SLA visibility for leadership
- Built-in audit trails for ISO 9001, ISO 27001 and RFFR evidence
Vendor & Supplier Renegotiation Engagement
Project-scoped renegotiation tied to transformation and renewal events.
- Quantified, signed-off commercial savings — typically 15–35% on in-scope contracts
- Recent reference engagement returned $1.1M in credits and savings during a cloud transformation
- Commercial terms restructured to match the future-state operating model
Not sure which engagement fits?
Tell me where you are today — auditor pressure, board mandate, M&A, or just the next maturity step — and I'll recommend the shortest path.