GRC · Cyber risk management · Information security
Readiness for SOC 2, NIST, and ISO standards such as 27001 and 42001. Built for startups and growing companies, and designed so your team can run it on their own.
ISO 27001
ISMS design, operation, and audit prep
SOC 2
Control mapping and evidence workflows
ISO 42001
Readiness for teams building with AI
NIST
CSF-aligned risk and control programmes
Why certify
Customers want to know who protects their data before they sign. Independent proof answers that once, for everyone, so you stop filling in a new questionnaire for every prospect and deals stop stalling in security review.
Questionnaires and vendor reviews are routine. Certification answers much of it up front, so prospects move to a decision faster.
Bigger customers often require certification before they will work with you.
Supply chain compromise adds more to the cost of a breach than any other factor IBM measured (IBM, 2026), so clients vet their vendors before signing.
The average breach costs $4.99M globally and $11.5M in the US (IBM, 2026). One incident can undo a year of new customers.
Building controls into a young company is usually faster and cheaper than retrofitting them in the middle of a deal.
Certification doesn't make you unbreachable. It proves you run security as a managed process, and that gives customers a reason to choose you.
Source: IBM Cost of a Data Breach Report 2026
Services
Fixed-scope projects or retained programme support. Built for operators who need evidence, not slide decks.
Gap analysis, Statement of Applicability, control mapping, evidence workflows, and certification-body coordination for ISO 27001, SOC 2, or ISO 42001, so you enter audit with a defensible programme — not a scramble.
Risk registers, KRI/KPI reporting, control effectiveness monitoring, and executive packs, mapped to NIST CSF or your chosen framework, that translate technical findings into decisions leadership can act on.
Vendor due diligence, DDQs, contract security review, and remediation tracking across concurrent vendors — including AI Act and DORA-aware posture checks.
Privacy Officer support for LGPD, HIPAA-aligned PHI handling, and practical data-protection controls that sit inside the same GRC operating model as the ISMS.
Axiom Case Study
The working documents from an engagement with Axiom, a fictional AI software company built to show our method. Each one feeds the next: assets lead to risks, risks to controls, and controls to the evidence an auditor checks. Switch between the workbooks and their sheets below.
What Axiom has, who owns it, and how critical each asset is.
| Asset ID | Asset Name | Asset Category | Description | Business Owner | Technical Owner | Criticality | Data Classification | Confidentiality | Integrity | Availability | Primary Risk Considerations | Dependencies | Lifecycle Status |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
AST-001 | AWS Production Environment | Cloud Infrastructure | Production AWS environment hosting Axiom's customer-facing SaaS platform and supporting services | CTO | Cloud/DevOps | Critical | Confidential | High | High | High | Cloud misconfiguration, unauthorized access, service disruption | AWS IAM, networking, databases, applications | Active |
AST-002 | Customer Database | Data Store | Database containing customer account, application, and service-related information | Data Owner | Engineering | Critical | Confidential | High | High | High | Unauthorized access, data exposure, corruption, loss | AWS infrastructure, application services, IAM | Active |
AST-003 | AI/ML Models | Intellectual Property | Proprietary AI/ML models supporting Axiom's core products and services | Chief Product Officer (CPO) | ML Engineering | Critical | Confidential | High | High | High | Intellectual property theft, unauthorized modification, model compromise | Source code, compute infrastructure, CI/CD | Active |
AST-004 | Application Source Code | Software / Intellectual Property | Proprietary source code for Axiom's SaaS applications and supporting services | CTO | Engineering | Critical | Restricted | High | High | High | Unauthorized access, code theft, malicious modification | Git repository, CI/CD, developer accounts | Active |
AST-005 | API Gateway | Application | External API gateway providing controlled access to Axiom application services | CTO | Engineering | High | Restricted | High | High | High | API abuse, credential compromise, unauthorized access, denial of service | AWS infrastructure, IAM, application services | Active |
AST-006 | CI/CD Pipeline | Development Infrastructure | Automated build, testing, and deployment pipeline used to deliver application and infrastructure changes | CTO | DevOps | High | Confidential | High | High | High | Supply-chain compromise, unauthorized deployment, malicious code injection | Source code repository, IAM, cloud infrastructure | Active |
AST-007 | Source Code Repository | Development / SaaS | Central repository containing application source code, configuration, and development artifacts | CTO | Engineering | Critical | Restricted | High | High | High | Credential exposure, unauthorized access, code modification | Developer identities, CI/CD pipeline | Active |
AST-008 | Identity Provider | Identity & Access Management | Central identity service supporting employee authentication and access management | IT/Security | IT | Critical | Confidential | High | High | High | Account compromise, privilege escalation, unauthorized access | Employee accounts, SaaS applications, MFA | Active |
AST-009 | AWS IAM Environment | Identity & Access Management | AWS identities, roles, permissions, and access policies governing cloud resources | CTO | Cloud/DevOps | Critical | Confidential | High | High | High | Excessive privileges, credential compromise, unauthorized access | AWS production environment | Active |
AST-010 | Security Logging Platform | Security Monitoring | Centralized collection and analysis of security and application logs | CISO / Security Lead | Security Engineering | High | Confidential | High | High | High | Insufficient monitoring, log tampering, delayed incident detection | AWS services, applications, endpoints | Active |
AST-011 | Employee Endpoints | Endpoint | Company-managed laptops and workstations used by employees and contractors | IT | IT | High | Confidential | High | High | Medium | Malware, credential theft, unauthorized access, data loss | Identity provider, endpoint security, SaaS services | Active |
AST-012 | Corporate SaaS Applications | Business Applications | Business productivity, collaboration, communication, and operational SaaS platforms | COO | IT | Medium | Confidential | Medium | Medium | High | Account compromise, data leakage, service disruption | Identity provider, third-party vendors | Active |
AST-013 | Customer-Facing SaaS Application | Application | Primary application through which customers access Axiom's AI/ML services | Chief Product Officer (CPO) | Engineering | Critical | Confidential | High | High | High | Application vulnerabilities, unauthorized access, service disruption | AWS, APIs, databases, AI/ML models | Active |
AST-014 | AI/ML Compute Environment | Cloud Infrastructure | Cloud compute resources used for model training, inference, and related workloads | Chief Product Officer (CPO) | ML Engineering | High | Restricted | High | High | High | Unauthorized access, resource abuse, model theft, service disruption | AWS, AI/ML models, source code | Active |
AST-015 | Backup and Recovery Environment | Resiliance / Data Protection | Backup services and storage supporting recovery of critical application and business data | CTO | Cloud/DevOps | Critical | Confidential | High | High | High | Backup failure, ransomware impact, data loss, recovery failure | Databases, AWS storage, production environment | Active |
AST-016 | Vulnerability Management Platform | Security Tooling | Platform used to identify, track, prioritize, and remediate security vulnerabilities | CISO / Security Lead | Security Engineering | High | Internal | Medium | High | Medium | Missed vulnerabilities, inaccurate prioritization, remediation delays | Applications, cloud infrastructure, endpoints | Active |
AST-017 | Incident Response Documentation | Security / Covernance | Incident response plans, procedures, evidence records, and supporting documentation | CISO / Security Lead | Security Engineering | High | Confidential | High | High | High | Delayed response, inadequate evidence handling, inconsistent escalation | Security monitoring, personnel, communication systems | Active |
AST-018 | Third-Party Vendor services | Third Party | External vendors providing technology, infrastructure, development, or business-critical services | COO | Operations Manager | High | Confidential | High | High | High | Supply-chain compromise, vendor breach, service disruption | Vendor contracts, SaaS applications, cloud services | Active |
AST-019 | DNS and Domain Services | Network / Infrastructure | Domain registration and DNS services supporting public-facing Axiom applications and communications | CTO | Cloud/DevOps | High | Internal | Medium | High | High | Domain takeover, DNS manipulation, service disruption | AWS, registrar, applications | Active |
AST-020 | Security Policies and ISMS Documentation | Governance / Information | Policies, procedures, standards, risk documentation, and ISMS records supporting information security governance | CISO / Security Lead | Information Security Officer (ISO) | High | Confidential | High | High | Medium | Outdated requirements, inadequate governance, compliance gaps | Risk register, ISMS, control framework | Active |
Axiom is a fictional company; no real client data is shown. Click a row to read it in full, and scroll sideways for more columns.
Approach
A short call to map scope, frameworks, deadlines, and who owns what internally. You leave with a written outline of work.
Structured gap analysis against ISO 27001, ISO 42001, SOC 2, NIST, or your chosen baseline. Risks, missing evidence, and overlapping controls are documented.
Policies, registers, SoA, TPRM workflows, and evidence trackers — designed to be used by your team, not filed and forgotten.
Optional retainer: management reviews, vendor cycles, vulnerability follow-through, and audit support until the programme runs without outside help.
Capabilities
Delivery is hands-on. You end up with working registers, audit-ready evidence, and a programme your team can run, not a report that sits in a folder.
Frameworks
Engage
Share the framework, the deadline, and the gap. You will get a clear recommendation — project, retainer, or a template pack — including if the fit is not right.