Audit and certification readiness
Understand your gaps before an auditor or certification body identifies them. We assess you against your target standard and show you what to address first.
Suited to: First-time certification and tender deadlines
Why it matters
Certification audits are costly to repeat and tender deadlines rarely move. A readiness assessment identifies the gaps that would lead to non-conformities while there is still time to address them, so that the formal assessment confirms your position rather than uncovering it.
When you might need it
- You are preparing for ISO/IEC 27001 certification
- A tender requires Cyber Essentials or evidence of security controls
- A customer security questionnaire has exposed gaps
- An internal or external audit visit is approaching
What we review
- Gap assessment against the chosen standard
- Review of policies, records and evidence
- Sample testing of key controls
- Risk assessment and statement of applicability (ISO/IEC 27001)
What you receive
- Gap report with a prioritised action list
- Evidence checklist for the assessor
- Realistic timetable to readiness
- Follow-up readiness check
Timescale and fees
Typically 3–8 working days, depending on the standard and how much documentation is already in place. Each engagement is quoted at a fixed price for an agreed scope, and the timetable is confirmed in your proposal before any work begins.
Ways to engage
- Single review: One focused engagement with a fixed scope and price.
- Multi-area assurance: Several related areas reviewed together, with one consolidated report.
- Support for your audit team: Specialist IT audit capacity for an existing internal audit function.
- Annual assurance programme: A planned cycle of reviews that builds year-on-year evidence.
Independence
We never audit systems or services that we have designed, implemented or operated. Any existing relationship, including with our sister services, is declared in writing before work begins.
Questions
Can you certify us?
No. Certification is issued by an accredited certification body. Keeping preparation and certification separate protects the independence of the result.
Is Cyber Essentials needed for government work?
Cyber Essentials is expected for many UK central government contracts, particularly those involving personal data or certain ICT services. We help you prepare; the certificate itself is issued by an IASME certification body.
Next step
The initial consultation is free and without obligation. We reply within one working day with a suggested scope.