GRC Consultancy
Practical help with governance, risk and compliance: a risk register you will actually use, policies that match how you work, and readiness for frameworks such as ISO 27001 and SOC 2. We connect each requirement to the controls and evidence behind it.
When it's needed
Compliance work tends to arrive with a deadline: a customer contract, an audit date or a funding round.
- A customer or partner requires ISO 27001 or SOC 2
- Security questionnaires are slowing down sales
- You need a risk register and policies, and don't know where to start
What we assess
- Current controls and gaps
- Measured against the framework you need to meet.
- Risks and ownership
- What could go wrong, how likely it is, and who owns it.
- Policies and procedures
- Whether they exist, match reality and are followed.
- Evidence and audit readiness
- What an auditor will ask for, and whether you can show it.
How we work
- 01
Discover
Understand your obligations, deadlines and current controls.
- 02
Validate
Check that controls work in practice, not just on paper.
- 03
Prioritize
Build a plan ranked by risk and by the deadlines you face.
- 04
Reduce
Write policies, close gaps and prepare the evidence with your team.
What you get
- A gap analysis
- Against ISO 27001, SOC 2 or the framework you need.
- A risk register
- Risks with likelihood, impact and a named owner.
- Policies that fit
- Written for how your organization actually works.
- Audit and questionnaire support
- Evidence and answers that hold up to review.
Common questions
Ask us something elseDo you certify us?
No. Certifications and attestations come from an accredited auditor. We help you prepare, so the audit goes smoothly.
What do you need from us to get started?
To start, we usually need a named internal owner; your current policies, contracts and audit obligations; and access to the people who run the systems in scope. We confirm the exact list during scoping.
How is this different from Security Engineering?
GRC Consultancy focuses on risk, policies and compliance evidence. Security Engineering builds and runs the technical controls. They work well together.
Related services
Not sure where to start?
Tell us what you're building and what worries you. We'll recommend the smallest engagement that answers it.