Ongoing support
For certified companies, the risk moves to the surveillance visit and the recertification year. These engagements keep the ISMS operated - not just documented - between cycles.
One-off support
Fixed-scope reviews for a specific point in the certification cycle - an internal audit, the annual surveillance visit, or the recertification year. Booked once, delivered, done.
An internal audit that would satisfy a certification body, not a checkbox.
We help plan and run internal audits against your scope and SoA, with findings that lead to real corrective actions.
Independence note
If Kellwick performs remediation for an area, the internal audit of that area must be carefully scoped or excluded to preserve independence.
For certified companies - a lighter check ahead of the annual surveillance visit.
A focused review of what has drifted since certification: risk, evidence, access reviews, supplier oversight and management review discipline.
Surveillance audit within 90 days? See surveillance readiness →
Third year of the cycle - more thorough than a surveillance check.
A fuller review before recertification, covering scope changes, control performance over the cycle and the evidence trail the auditor will resample.
Surveillance readiness
For companies already certified to ISO 27001, preparing for their annual surveillance audit.
Certification is not the finish line. Between audits, an ISMS quietly drifts - evidence goes stale, access reviews slip, the risk register stops matching reality. Surveillance auditors notice. We check that your system is still audit-ready before they arrive.
Stay audit-ready between audits.
Book a surveillance readiness callCertification and surveillance audits are performed by an accredited certification body. Kellwick prepares you for that process; it does not perform it.
Monthly retainers
For companies that want the discipline owned continuously rather than run in bursts. Three tiers of accountable ownership, scaling with the number of frameworks you answer for - each with a defined monthly advisory capacity behind it.
Keeps one framework owned and audit-ready between cycles.
Capacity: up to one advisory day per month, one primary framework, one entity.
Accountable coordination across two frameworks, with management reporting.
Capacity: up to three advisory days per month, up to two frameworks.
Board-level accountability across every framework you answer for.
Capacity: up to five advisory days per month, multi-framework, board reporting.
Retainer prices and the full included / not-included scope for each tier are set out on the pricing page.
See retainer pricingCertification is performed by an accredited certification body through Stage 1 and Stage 2 audits. Kellwick prepares you for that process; it does not perform it and cannot guarantee its outcome.
Kellwick is an independent advisory practice. We are not a certification body and do not issue ISO certifications. Certification decisions are made only by accredited certification bodies.