ISO 27001 & GRC Implementation Support

This is not a theoretical exercise. Support is hands-on, document-led and aligned to how your organisation actually operates.

Includes: Gap assessment against ISO 27001 controls · Statement of Applicability support · Risk assessment and treatment plan development · Policy review and documentation · Remediation tracking and audit preparation · Ongoing compliance reporting support

Best suited for: Organisations pursuing ISO 27001 certification, teams responding to audit findings, or businesses formalising information security governance for the first time.

Engagement type: Fixed scope or retainer available
Price: From £2,000

‍

Ready to talk?

A short call to talk through what's happening and whether this service is the right fit.

average response rate 1 hour

proven track of results

dedicated and honest

Schedule intro call

Explore other services

see all

Delivery Support

Retained support to keep risk, actions and reporting owned and functioning across one or more projects.

Risk and Control Foundations

Build practical governance from the ground up.

Backlog Clean Up

A focused intervention to bring existing risks, actions and controls back under ownership.

How We Work Together

A clear path from first conversation to structured delivery

Get in Touch

Tell me what's happening, a backlog that's slipping, a delivery function needing structure, or a compliance deadline approaching. No obligation, just a conversation.

Scope the Engagement

Together we agree the right service and a clear, fixed scope, so you know exactly what's included and what it costs before anything starts.

Structured Delivery

Work begins against the agreed scope. Risk registers, reporting cadences, or certification support, depending on what you need.

Ongoing Visibility

You get consistent, accurate reporting throughout, so risk and progress stay visible without you needing to chase it.

Let’s talk

Questions

A few things people usually ask before getting in touch.

Contact me

Is this project management?

No, this is operational governance support. I don't take delivery accountability or run projects. I ensure risks, actions and reporting stay structured and owned, so delivery teams can focus on execution.

Do you work with small organisations?

Yes. You don't need a full PMO or compliance function to benefit from structured governance.

How is pricing structured?

Priced by reporting output, not by the day. The base retainer covers one report and cadence from £1,500/month, with additional reports from £800/month each. Fixed-scope work is quoted per engagement.

What counts as one report?

One defined governance output on one cadence, for example a weekly RAID update or a monthly exec pack. Separate programmes or audiences are scoped individually.