Insights
Keeping certified management systems operating between audits, and running several standards as one integrated system without duplicate work.
A management review agenda that covers every required input and ends each item with a decision, an owner and a date - and the record auditors expect.
16 Oct 2026 · 7 min read
Most small and mid-size organisations cannot justify a full-time GRC hire. A well-designed monthly and quarterly rhythm keeps your ISMS alive between audit cycles without the overhead.
16 Oct 2026 · 7 min read
Year 3 is a recertification audit, not another surveillance check. Understanding the fuller re-audit scope, how scope changes are handled, and what evidence resampling means in practice helps you prepare correctly.
20 Sept 2026 · 6 min read
Most ISMS drift happens quietly in the twelve months after certification. Here are the six evidence gaps surveillance auditors consistently find in year two, and how to close them.
17 Sept 2026 · 6 min read
A practical, end-to-end guide to preparing for an ISO 27001 surveillance audit - proving the ISMS kept operating all year, closing prior findings, and walking in composed rather than cramming.
30 Jun 2026 · 11 min read
Certification is a moment. The surveillance audit is where the ISMS proves it actually kept running. Here is what to check in the 90 days before the auditor returns.
10 Jun 2026 · 2 min read
A final 30-day checklist for surveillance: evidence continuity over the year, closed prior findings and control owners who can speak to their controls. Rehearse, do not cram.
8 Apr 2026 · 3 min read
Auditors look for real decisions and follow-ups in your management review, not a calendar invite. Here is what a substantive review actually produces.
1 Apr 2026 · 3 min read
The ISMS starts decaying the moment attention moves on. A steady rhythm keeps it audit-ready between surveillance visits.
11 Mar 2026 · 3 min read
Managed ISMS, QMS, AIMS and integrated systems at a defined monthly capacity.