GRC advisory
Governance, risk and compliance
Audits go better when the evidence is already in order. As an ISO/IEC 27001 Lead Auditor, I know what auditors look for, and I help you meet ISO/IEC 27001 and your regulator's requirements with a plan your team can deliver.
When to call
When teams ask for it.
- An audit or certification deadline is approaching
- Security spending is hard to justify to the board
- Controls exist on paper but nobody knows if they work
Scope
What it involves.
- Information system audits against your regulator's and your own requirements
- ISO/IEC 27001 gap assessments and audit readiness
- A security roadmap tied to business risk, not to a tool list
- Policies and controls people can actually follow
How it works
How the work is done.
Audit, improve, prove it, repeat.
Every audit feeds the roadmap, the roadmap shapes the controls, and the next audit checks they held.
- 1. Audit
- Against your own rules
- 2. Gap review
- Measured to ISO 27001
- 3. Roadmap
- Ordered by business risk
- 4. Policies
- Written to be followed
- 5. Readiness
- Ready for the auditor
Outcome
What you have at the end.
A defensible position for auditors and a prioritised plan for the team that has to deliver it.
Usually for: Regulated institutions, public bodies and growing companies
Proof
Work and credentials behind it.
Other services
Other ways I can help.
- Penetration testingWeb, API, mobile, network and cloud testing from an attacker's point of view.
- Security operationsDetection engineering, SIEM, incident handling and malware analysis.
- Agentic AI securitySecuring AI agents and LLM features, and automating the security work itself.
- Training and speakingSecurity awareness, technical workshops and conference talks.
Let's scope it together.
Tell me what you need to protect and by when. I'll reply with whether I can help and how I'd approach it.