ISO 27001 / SOC 2 readiness without the consulting bill

What we ship

An ISMS scaffold that actually maps to your business, policies you can read in plain English, a risk register that lists real risks, a vendor due-diligence pack with real evidence attached. Not generic templates; not theory; not slideware to wave at an auditor.

Which frameworks

ISO 27001 (Annex A controls), SOC 2 Type 1 → Type 2 path, AU Privacy Act (APPs), GDPR for clients with EU customers. We've walked our own business through it; we know which controls are load-bearing and which are check-the-box theatre.

Tooling we plug in to

Vanta and Drata are the two we know best, both have continuous-monitoring integrations that make Type 2 audits painless. We can also work directly with your existing GRC platform; the deliverable is the policies + evidence, not vendor lock-in.

Why it costs less than a Big Four engagement

Because we don't ship a 200-page report. We ship: documented policies in your repo, a risk register that updates with your code, evidence collected continuously rather than scrambled before an audit. Same audit outcome, fraction of the cost.