Industry
Your clients' security and quality requirements, and increasingly their regulations, are passed down to you by contract.
Development agencies, outsourcing partners and IT service providers are audited through their clients. A bank under DORA, an essential entity under NIS2 or an enterprise procurement team sends a supplier questionnaire and a contract clause. ISO 27001 answers most of it; ISO 9001 answers the delivery-quality questions tenders increasingly ask.
Sector risks
Repositories, cloud accounts and production systems belonging to clients, granted per engagement and too often never revoked.
Incident notification windows, subcontractor approval and audit rights in client contracts that nobody mapped to an internal control.
Estimation, acceptance and defect handling that vary by project lead - the gap an ISO 9001 process approach is designed to close.
Evidence
Services
Delivery
Remote by default. Onsite days are useful for an integrated ISO 27001 and ISO 9001 audit when delivery teams sit in one office.
Last verified 16 October 2026 against EUR-Lex - Regulation (EU) 2022/2554 and European Commission - Digital operational resilience.
Last verified 16 October 2026 against European Commission - NIS2 and EUR-Lex - Directive (EU) 2022/2555.
Not ready for a full review?
Start with a fixed-scope Mini Gap Review.
Scoped and priced on a short call. We hand back your top Stage 1 blockers and the single next step that matters most.
From the blog
Build a reusable security answer library that speeds up every RFP
Read →Risk, Evidence & Supplier AssuranceA 48-hour triage process that groups questions by security domain and sorts them into answered, partial, and exposed tiers before your team types a single response.
Read →Risk, Evidence & Supplier AssuranceThe disconnect between risk registers and Statement of Applicability decisions is one of the first things a trained auditor checks. Learn how to close the gap before they arrive.
Read →Self-check
Nine yes-no questions on where information security management usually holds up - or falls apart - in software agencies & it providers.
Name the standard, the sites and the deadline. A specialist replies within one business day with a view on scope and whether the work is remote, onsite or both.
Kellwick is an independent consulting and internal audit practice. We are not a certification body and do not issue ISO certificates. Certification decisions are made only by accredited certification bodies.