Kellwick helps organisations meet security, regulatory and customer-driven requirements - from ISO 27001 and DORA to NIS2, SOC 2, CMMC, NIST and ongoing security governance. We find the gaps, fix what matters, build the evidence and help you keep it working.
When an audit, regulator, customer or contract raises the bar, Kellwick gets you ready.
The questions external scrutiny exposes first
before an auditor, regulator or buyer does
We find the disconnects while they are still operational problems - before they become audit, regulatory or sales problems.
What actually blocks a certification - or a regulator
These are the blockers we find most often. None of them are exotic - which is exactly why they are missed until an auditor is in the room. The same gaps fail ISO 27001 Stage 1 and leave you exposed under DORA.
We do not guarantee outcomes and we are not a certification body. What we do is find these before the auditor does - while there is still time to fix them cheaply.
Current focus: DORA
ISO 27001 is a strong foundation - but it is not DORA. DORA adds strict incident-reporting timelines, ICT third-party risk registers, and resilience testing that ISO 27001 alone does not require. If you're a regulated financial entity, the gap between 'ISO 27001 certified' and 'DORA compliant' is exactly where the regulator will look.
DORA is our current spotlight because it is mandatory now - but it is one of the standards and regulatory regimes we support. We do the same across ISO 27001, NIS2, GDPR, ISO 42001, NIST CSF 2.0, SOC 2 and CMMC & NIST SP 800-171, and run them for you on a vCISO retainer.
A governed framework for identifying, protecting, detecting and recovering ICT systems - board-owned, documented and tested, not just an IT checklist.
Classifying ICT-related incidents and reporting major ones to your regulator inside strict timelines. ISO 27001 asks you to manage incidents; DORA dictates when and how you report them.
A programme of resilience testing - from vulnerability assessments to scenario-based tests - proving you can keep operating through disruption, not just that controls exist on paper.
A register of ICT providers with contractual, monitoring and exit requirements. Your PSPs, cloud, liquidity and platform vendors are in scope - concentration risk included.
Where you take part in threat-intelligence sharing, the governance and safeguards around it are in place and documented - not improvised.
Where it really starts
By audit week these gaps are already old. Each one was cheap to fix when it appeared, and expensive to fix under a deadline. A readiness review finds them while there is still time.
See how a readiness review worksMonths before
Weeks before
Then, all at once
Audit week
The audit becomes the first place all of it surfaces at once.
The future state
Compliance should not require chaos, duplicated work or last-minute evidence collection. When security governance works as an operating system, this is your normal:
Every control, risk and supplier has a named owner. Nothing lives only in someone's head.
The proof an auditor or regulator asks for is already mapped, current and where you expect it.
You know where you stand before the audit, the regulator or the enterprise buyer asks.
Audit prep stops being an annual fire drill. Readiness is a state you keep, not a scramble you repeat.
Ready should be your normal operating state, not a project you restart before every audit.
One plan, every framework
The same four steps carry every engagement, whether it starts with ISO 27001, DORA or a vCISO retainer.
Understand scope, obligations, current controls, evidence and gaps - so you know exactly where you stand before someone else asks.
Prioritise remediation, assign ownership and implement what is missing, without letting compliance paralyse delivery.
Build the evidence trail, test readiness and prepare for external scrutiny - so the audit or regulator finds what you already know.
Keep controls, risks, suppliers, metrics and governance current through ongoing support or a vCISO retainer.
Where most teams start
Find what will derail readiness, close the gaps and walk into the certification audit with evidence your team can defend.
Explore ISO 27001Turn DORA obligations into operating controls and defensible evidence, including a Register of Information that stands up to scrutiny.
Explore DORAAccountable security and governance leadership on a retainer - roadmap, risk, evidence and board reporting owned, not outsourced by the hour.
Explore vCISOFull capability
Beyond the three above, Kellwick supports the standards and regulations that external scrutiny puts in front of you - whatever your sector - each with its own dedicated page.
Pass the audit. We find what blocks Stage 1 before the certification body does.
Get regulator-ready. Close the gap between ISO 27001 and what the regulator now requires.
Scope first. Most of the market sells you the answer before asking the question.
Prove your data handling. ISO 27701 is standalone now - no ISMS required.
Govern the model. Certifiable today - and your buyers' vendors already are.
The US buyer's ask. Not certifiable, not a federal requirement - here is what actually binds you.
Answer the SOC 2 ask. Audit-ready for the CPA's examination - not scrambling when it arrives.
Understand your scope, close the gaps and prepare the SSP and evidence your defense supply-chain obligations require.
The real cost
A failed audit can delay enterprise deals, extend sales cycles, create remediation costs, and damage customer trust. The real risk is discovering too late that your ISMS only works on paper.
Delayed enterprise deals
Expensive remediation under time pressure
Lost buyer confidence
Longer sales cycles
Surveillance audit stress
Repeat nonconformities
Security questionnaires you cannot answer
Customer confidence lost when evidence and ownership are unclear
Most audit surprises are avoidable. We find the gaps while you still have time to fix the system, collect the evidence and walk in prepared.
The ISO 27001 engagements
We tell you what will block ISO 27001 certification before the certification body does.
5-10 days
Book a readiness assessment →Readiness finds the blockers. The Remediation Sprint helps remove them.
3-6 weeks
Plan a remediation sprint →We organise your ISO 27001 evidence so your team can show the right proof, in the right order.
1-2 weeks
Organise your evidence →The path
You do not have to buy the whole journey up front. Start where you are; each step earns the next.
When you need us
Our clients rarely have the same industry. What they share is an external requirement that raised the standard they must meet.
A customer, tender or growth plan now requires ISO 27001 or another assurance standard.
A regulatory obligation such as DORA or NIS2 has become an operating requirement.
Enterprise procurement or a security review is asking questions your current evidence cannot answer cleanly.
A contract or supply-chain position introduces CMMC, NIST SP 800-171 or other security obligations.
AI, new products, suppliers or data use create governance requirements your existing system does not cover.
Security and GRC need senior ownership, but a full-time CISO is not the right answer.
Fit
We work best with a specific kind of team. Being clear about it saves everyone time.
Best fit
Not a fit
Why Kellwick
Compliance and security are not just documentation exercises. Across every framework you answer for, they touch product delivery, access control, incident handling, supplier risk, release governance, QA evidence, customer trust and enterprise sales.
Readiness takes more than document review. We test whether your controls survive real product delivery, engineering work, supplier dependencies, incidents, enterprise security reviews and external scrutiny - and provide the security leadership (vCISO) to keep them there. Policies matter. Operating evidence matters more.
Why teams trust us
We are explicit about what Kellwick does and does not do - no guaranteed audit outcomes, no legal assurance we cannot control.
Every engagement produces a documented evidence trail mapped to the controls it proves.
Assess, Fix, Prove, Operate - you always know what stage you are in and what comes next.
Privacy, security and data-handling practices suitable for the buyers who scrutinise their suppliers.
From the blog
Inference logs that capture customer inputs can contain PII, confidential business data or legally privileged material. ISO 27001 requires you to classify what you keep, control who reads it, and align retention with your DPA commitments.
Read →AI SaaS GRCLLM API vendors process customer data on your behalf. If they are not on your sub-processor register with a current DPA and assurance evidence, enterprise buyers will find that gap before you do.
Read →Security QuestionnairesThe enterprise deal you want comes with a security review you may not be ready for. Here is how to pass it without slowing the sale.
Read →FAQ
Straight answers on readiness, certification and how we work. Still unsure? A short call clears it up fast.
No. Kellwick is an independent advisory practice, not a certification body. We prepare you and improve your evidence and ISMS discipline; the certificate is issued only by an accredited certification body after their audit.
Often yes. A compliance platform collects evidence continuously, but it cannot decide whether your scope, risks, Statement of Applicability and control ownership actually make sense, or whether the human process behind each green check is real. That judgment is the part auditors test.
A Readiness Assessment takes 5-10 days and gives you a readiness score, your top gaps, and a 30/60/90 remediation roadmap. It is the fastest way to know whether your ISMS would survive an audit. If you want a lighter first step, a 1-2 day Mini Gap Review surfaces your top Stage 1 blockers.
That is exactly what the Remediation Sprint is for: a focused 5-15 day remediation across risk, SoA, evidence, policies and control ownership, with management review and internal audit prep before the auditor arrives.
Yes. We help you answer enterprise security questionnaires accurately and assemble the supporting evidence, so a stalled deal does not sit waiting on your security review.
No one credible can. We do not guarantee certification outcomes. What we do is remove the avoidable failures - weak evidence, outdated risks, unclear ownership - so you walk into the audit prepared rather than surprised.
That is a fair question. If your current preparation is solid, a short conversation will confirm it and you lose nothing. If there are gaps, a Mini Gap Review will surface them while there is still time to fix them - it is not a judgment on prior work, it is a second set of eyes before the auditor applies theirs. We are comfortable supplementing existing advisory or stepping in where it makes sense; we do not discard work that is already done.
Yes, and this is one of the most common ways teams work with us. A Surveillance Readiness Check reviews whether your risk register, SoA, control evidence and management review have kept pace since certification. We also offer an ongoing support retainer that keeps your ISMS maintained between audits - covering risk register reviews, policy updates, control evidence checks and internal audit preparation - so surveillance becomes a routine event rather than a scramble.
No. ISO 27001 is a common starting point, not the limit. We also support DORA, NIS2, GDPR privacy (ISO 27701), ISO 42001 for AI governance, SOC 2 and NIST CSF 2.0 - and a vCISO retainer runs whichever of them apply to you between audits and supervisory cycles.
Yes. DORA adds resilience testing, incident-reporting timelines and ICT third-party requirements that ISO 27001 alone does not cover. We map the gap between your ISMS and DORA and prepare you for it. DORA supervision is performed by your competent authority; we prepare you for it and do not perform it.
Yes. Our vCISO / Managed ISMS retainer provides ongoing security governance - risk register upkeep, access and supplier reviews, incident-reporting readiness and board-level reporting - without a full-time hire.
Get a clear view of your gaps, priorities and evidence before the audit, regulator or enterprise buyer puts you on their timeline.
Fixed scope. Evidence-led. No certification guarantees. No policy-template theatre.