GRC, Risk & Compliance
Certification is not a document exercise. It is a set of controls that somebody has to own, operate and evidence every month after the auditor has left.
A policy pack passes nothing. Controls that actually run do. We build and operate compliance programmes with you: the regulatory framework, the risk work underneath it, policies people can follow, training, and the preparation that gets you through an audit.
Four situations that bring organisations to us
A customer or RFP requires certification
There is a deadline attached, and you are starting close to zero.
You are certified and it is slipping
The controls exist on paper, nobody has operated them since the last audit, and surveillance is coming.
You have never run a formal risk assessment
You cannot say, with evidence, which risks you have accepted or who accepted them.
You need a CISO but not a full-time one
For a board, an insurer or a customer, or because security decisions currently land on whoever is least busy.
Services
Regulatory framework
Establishing the framework your organisation will be governed by: which standards and regulations apply to you, what they actually require, and what compliance will mean in practice.
Compliance and risk programme
Strategic planning for the programme itself, including scope, ownership, sequencing, and the review cadence that keeps it alive once certification is won.
Risk assessment and register
A register that reflects your business rather than a downloaded template: identified risks, named owners, treatment decisions and dates.
ISO security standards
Guidance, training and preparation for achieving compliance, including the internal work an auditor expects to find already running before they arrive.
Policies and controls
Written to fit how your organisation genuinely operates. A policy nobody follows is an audit finding waiting to happen.
Training
Staff awareness that is not a video nobody watches, plus management and board sessions on what leadership is accountable for.
Incident response assessment
Assessment of information security events by the response team, and whether your detection, escalation and response hold up outside a tabletop exercise.
Virtual CISO
A senior consultant owning your security programme: strategy, board reporting, vendor and customer security reviews, and incident readiness. The model, scope and commitment are defined with each client.
How a certification programme runs
Every programme is shaped by where you are starting and what you have to prove, so the length of each stage differs. The sequence does not.
Gap assessment
Where you stand today against the standard that applies to you, control by control, with an honest view of the work remaining.
Risk assessment
Assets, threats, existing controls and treatment decisions, recorded so that accepting a risk has a name and a date against it.
Build
Policies, procedures and technical controls implemented with your teams rather than handed to them. The longest stage, and the one that determines whether certification holds.
Operate and evidence
Controls have to run before anyone can audit them. We keep the programme moving and the evidence organised through that period.
Internal audit and management review
Both required, and both routinely forgotten until the certification body asks for them.
External audit
We prepare your team, work alongside you through the assessment, and handle any nonconformities raised.
What cannot be compressed
How long certification takes depends on how much is already in place and how wide your scope is. The part nobody can shorten is the period during which controls must genuinely operate before an audit. Anyone promising certification in a few weeks is selling a document pack.
We will tell you after a scoping call whether you are closer to six months or eighteen, and what the first three things to fix are.
Start with the gap assessment
It is the cheapest part of the programme and it is the one that tells you whether the deadline you have been given is realistic.
Common questions
How long does certification take?
Do you issue the certificate?
Which standard do we need?
Do we need penetration testing as well?
Can you act as our CISO?
What does it cost?
Certifications held across our team
Tell us which standard, and when you need it
We will tell you how far away you are, and what the first three things to fix are.
Contact Cyberange