Implementation

• The policies and procedures the standard requires, written to describe how your organisation actually operates rather than a template company.
• The controls themselves, designed to work in your environment and to be evidenced.
• The risk assessment, the statement of applicability, and the technical documentation the standard calls for.
• The evidence that each control operates, gathered and organised so it can be examined.
• Where AI is in scope, the system inventory, classifications, impact assessments and oversight arrangements.

Implementation fails more often on project management than on technical difficulty. Someone has to hold the schedule, chase the evidence, prepare the people who will be interviewed, and manage the relationship with the certification body.

That is part of the engagement. You are told each week what has moved, what is outstanding, and what we need from you.

We work within Vanta, Drata, Secureframe or whichever platform is already in place, and configure it properly rather than working around it. Where there is none, the engagement runs on our own record, which is included and stays yours afterwards.

A certificate obtained on thin evidence still fails the buyer review that follows it. We build to the standard of the person who will examine it, not to the minimum that passes.