ISMS & AIMS Audits
Every stage of ISO 27001 and ISO 42001, from gap analysis to stage 2.
ISO audits are most of what we do. We implement the management system, run the internal audits the standard requires, and run stage 1 and stage 2 certification audits. On any one system we take one role, never all of them, because an audit only counts if the auditor had no hand in what they are auditing. Whichever role we can't take, an independent certified auditor we work with takes instead, so every stage is still covered.
ISMS is the established one. AIMS is the one almost nobody is ready for yet.
ISO 27001 has been around for two decades and is now table stakes for serious procurement. ISO 42001 was published in 2023 and few businesses have started on it, which is exactly why now is the right time. We cover both standards at every stage, and on any one system we take one role.
Information Security Management System
ISMS, ISO 27001
The standard most procurement teams now ask for. It shows you treat information security as a system, not a series of fires.
- Information security policies and procedures, written for your business
- Risk assessment, treatment plans, and statements of applicability
- Evidence trails an auditor can actually follow
- Gap analysis against the ISO 27001 controls
AI Management System
AIMS, ISO 42001
Published in 2023, the first ISO management system standard for AI. Few businesses have it in place yet, so the ones that start now are ahead when customers begin to ask.
- AI governance, risk and lifecycle controls
- Use-case registers and impact assessments
- Roles, accountability and review cadence for internal AI
- Mapping your AI initiatives to ISO 42001 clauses
What this looks like in practice
- Gap analysis
- Where you currently stand against ISO 27001 (ISMS) or ISO 42001 (AIMS), what's missing, and the order to close those gaps in.
- Implementation
- Policies, procedures, risk treatment and statements of applicability written for your business, not boilerplate copied from a template that won't survive an auditor's first question.
- Internal audit
- The internal audits both standards require, run by certified auditors with no part in building what they audit. Where we implemented the system, an independent auditor we work with runs them instead.
- Stage 1 and stage 2 audits
- The certification audits themselves. Stage 1 checks your documentation and readiness, stage 2 checks the system works in practice. The certificate is issued by the accredited certification body.
- AI governance (ISO 42001)
- AIMS is new, and most businesses don't yet know what's required. We help you stand up the AI governance, risk and lifecycle controls before regulators or customers ask.
How it runs
Scope the system
Agree what's in and out of the management system, who the stakeholders are, and which clauses of the standard genuinely apply to your business.
Build it, or audit it
Implementing, we write the documentation, build the controls and capture the evidence. Auditing, we test all of that against the standard and report what we find.
Bring in the other side
Whichever role we are not taking goes to an independent certified auditor we work with, so internal audit, stage 1 and stage 2 still run in order. The certificate comes from the accredited certification body.
Other services
- IT ConsultingProject consulting, technology recommendations, and custom builds when off-the-shelf doesn't fit.
- Cloud & InfrastructureAWS and Azure, both directly. Partner status on each, live clients on each, and no preference to sell you.
- CybersecuritySIEM and XDR setup, posture reviews, and the compliance work the auditors and insurers care about.
Tell us what is actually
going wrong.
No sales sequence and no discovery deck. Send through what you are working on, and someone from our team of certified professionals replies within a business day.
