Services

Seven frameworks of compliance and security readiness - each a specific engagement.

Kellwick supports the standards and regulations regulated technology teams encounter most: EU regulation you are supervised against - DORA, NIS2, GDPR & privacy - and standards your buyers ask you to hold - ISO 27001, ISO 42001, NIST CSF 2.0 and SOC 2. Each is delivered as a fixed-scope engagement with a defined output, not vague GRC. Running them week to week is the vCISO / managed ISMS retainer - the engine behind all seven, not an eighth framework.

Not sure where to start? Begin with a 2-day Mini Gap Review. Getting ready for ISO 27001? See the focused readiness page for SaaS companies, FX brokers or iGaming.

The seven frameworks

Two kinds of pressure - one operating discipline behind them.

Each framework is its own hub, with its own fixed-scope engagements. Most clients start with one and grow into the others as their buyers and regulators ask for more.

EU regulation

Binding law. You are supervised against these - the question is not whether you adopt them.

DORA

EU regulation - not certifiable

Get regulator-ready. Close the gap between ISO 27001 and what the regulator now requires.

Explore

NIS2

EU directive - not certifiable

Scope first. Most of the market sells you the answer before asking the question.

Explore

GDPR & Privacy

GDPR regulation + ISO 27701 certification

Prove your data handling. ISO 27701 is standalone now - no ISMS required.

Explore

Standards

Voluntary frameworks your buyers, auditors and enterprise deals ask you to hold.

ISO 27001

Certifiable standard

Pass the audit. We find what blocks Stage 1 before the certification body does.

Explore

ISO 42001 / AI Governance

Certifiable standard

Govern the model. Certifiable today - and your buyers' vendors already are.

Explore

NIST CSF 2.0

Voluntary framework - not certifiable

The US buyer's ask. Not certifiable, not a federal requirement - here is what actually binds you.

Explore

SOC 2

US attestation - not certifiable

Answer the SOC 2 ask. Audit-ready for the CPA's examination - not scrambling when it arrives.

Explore

CMMC & NIST SP 800-171

US defense supply-chain obligation (DFARS / NIST SP 800-171)

Understand your scope, close the gaps and prepare the SSP and evidence your defense supply-chain obligations require.

Explore

The ISO 27001 engagements

Which engagement fits where you are?

These are the fixed-scope engagements that sit under the ISO 27001 framework - from a first read to staying audit-ready between cycles. The other six frameworks each have their own on the hub pages above, and the vCISO retainer runs whichever of them apply to you.

Service	Duration	Best for	Output	Pricing
Mini Gap Review	1-2 days	A first, low-risk read	Top 5 Stage 1 blockers + next step	$1,250 fixed
Readiness Assessment	5-10 days	Honest pre-audit diagnosis	Gap register + readiness score + roadmap	From $4,500
Remediation Sprint	3-6 weeks	Closing the blockers	Gap tracker + evidence map + owner map	From $8,500
Evidence Pack	1-2 weeks	Scattered evidence	Control-to-evidence map + audit-day index	From $3,000
Ongoing Support	Monthly	Staying audit-ready	Retainer, internal audit, surveillance & recert prep	From $2,000/month

The auditor’s lens

We read the same evidence your auditor will - before they do.

Every engagement works from the artifacts a certification body and an enterprise buyer actually open. We group them the way an auditor thinks - a management system, not a checklist.

01Stage 1 lives here

The management system

Where Stage 1 audits usually stop.

ISMS scope
Statement of Applicability
Risk register
Management review records
Internal audit records

Operating evidence

Proof the controls actually run.

Access reviews
Incident log
Change and release evidence
Secure development (SDLC) evidence

Third parties & trust

What buyers and auditors probe next.

Supplier and subprocessor list
Security questionnaires

Not sure how many of these you could show today? A 2-day Mini Gap Review tells you where the holes are - starting with the ones that stop Stage 1.

ISO 27001 Readiness Assessment

We tell you what will block ISO 27001 certification before the certification body does.

Who it is for: Teams that need an honest, evidence-based view of audit readiness.
What it covers: Scope, clauses 4-10, Annex A, risk register, SoA and evidence quality.

Book a readiness assessment

You receive · 5-10 days

ISMS scope review
Clause 4-10 readiness review
Annex A control review
Risk register + SoA review
Evidence review
Interviews (management, IT, HR, engineering, ops)
Gap register + readiness score
Stage 1 blocker list / Stage 2 risk list
30 / 60 / 90 roadmap
Final readiness report

ISO 27001 Remediation Sprint

Readiness finds the blockers. The Remediation Sprint helps remove them.

Who it is for: Teams closing gaps before a certification or surveillance audit.
What it covers: Structured remediation across risk, SoA, policy, process and evidence.

Plan a remediation sprint

You receive · 3-6 weeks

Gap tracker
Evidence map
Risk / SoA review
Policy / process review
Control owner map
Audit readiness checklist
Management review prep
Internal audit readiness notes
30 / 60 / 90-day remediation plan

ISO 27001 Evidence Pack

We organise your ISO 27001 evidence so your team can show the right proof, in the right order.

Who it is for: Teams whose evidence exists but is scattered across Slack, Drive, Jira, GitHub and M365.
What it covers: Evidence inventory, mapping to controls, gaps and audit-day ordering.

Organise your evidence

You receive · 1-2 weeks

Evidence inventory across tools
Control-to-evidence map
Evidence gap list
Audit-day evidence order / index
Owner map for each evidence source

NIS2 Scope Determination

Before you spend a euro on NIS2 readiness: are you actually in scope?

Who it is for: Cloud, SaaS, MSP and digital-infrastructure companies unsure whether NIS2 reaches them.
What it covers: Entity type against Annex I/II, the Art 6(30) cloud test, size thresholds with partner/linked aggregation, and any sector-specific act that displaces NIS2.

Find out if NIS2 applies

You receive · 1-2 days

Entity-type determination against Annex I and II
Art 6(30) cloud-service analysis where relevant
Size-threshold assessment including partner and linked aggregation
Essential vs important classification
Sector-specific displacement check (e.g. DORA for financial entities)
Competent authority and registration position for your Member State
A short written scope opinion you can hand to a buyer

AI Governance Readiness

ISO 42001 is certifiable today. Your buyers' vendors already are.

Who it is for: AI SaaS and companies embedding AI into a regulated product.
What it covers: ISO 42001 clauses 4-10 and Annex A, the AI system impact assessment, AI Act classification, and how the AI management system meets or overlaps an existing ISMS.

Scope AI governance readiness

You receive · 1-3 weeks

ISO 42001 clause 4-10 readiness review
Annex A control review
AI system impact assessment (clause 6.1.4 / 8.4) design
EU AI Act classification and applicability position
ISO 27001 overlap map where an ISMS already runs
Gap register and roadmap

Also from Kellwick

Focused engagements for specific situations - outside the core readiness ladder but often exactly what a team needs.

2-4 weeks

Vanta / Drata / Sprinto Cleanup

A compliance platform collects evidence. It cannot decide whether your scope, risks and control ownership make sense.

Learn more →48h triage

Security Questionnaire Support

Stop letting enterprise security reviews stall your deals. We help you answer questionnaires accurately, with evidence.

Learn more →Monthly

Ongoing Support

Internal audit support, surveillance and recertification prep, and the maintenance retainer - for teams that are already certified.

See ongoing support →

Deal blocked by a security questionnaire? See the focused page for enterprise deals stalled in a security review - no ISO 27001 journey required.

Go →

Pricing

Fixed-scope, quoted after a short call.

We do not sell off-the-shelf packages. After a short readiness call we scope the work to where you actually are and send a fixed-scope quote - no open-ended hourly billing, no surprises.

What shapes your quote

Company size and ISMS maturity
Your certification or surveillance timeline
How much evidence already exists - and its quality
Scope of the ISMS and number of control owners
Whether you need remediation, evidence work or ongoing support

Start with a low-risk Mini Gap Review, or book a readiness call for a scoped quote.

Certification is issued by accredited certification bodies; DORA supervision is performed by regulators. Kellwick prepares you for these processes; it does not perform them and cannot guarantee their outcome.

Not sure which one you need?

Start with a short call. If a readiness review is not the right first step, we will say so.

Book a readiness call

Seven frameworks of compliance and security readiness - each a specific engagement.

Not sure where to start? Begin with a 2-day Mini Gap Review. Getting ready for ISO 27001? See the focused readiness page for SaaS companies, FX brokers or iGaming.

Service

Duration

Best for

Output

Pricing

Mini Gap Review

1-2 days

A first, low-risk read

Top 5 Stage 1 blockers + next step

$1,250 fixed

Readiness Assessment

5-10 days

Honest pre-audit diagnosis

Gap register + readiness score + roadmap

From $4,500

Remediation Sprint

3-6 weeks

Closing the blockers

Gap tracker + evidence map + owner map

From $8,500

Evidence Pack

1-2 weeks

Scattered evidence

Control-to-evidence map + audit-day index

From $3,000

Ongoing Support

Monthly

Staying audit-ready

Retainer, internal audit, surveillance & recert prep

From $2,000/month

ISO 27001 Evidence Pack

We organise your ISO 27001 evidence so your team can show the right proof, in the right order.

Who it is for

Teams whose evidence exists but is scattered across Slack, Drive, Jira, GitHub and M365.

What it covers

Evidence inventory, mapping to controls, gaps and audit-day ordering.

NIS2 Scope Determination

Before you spend a euro on NIS2 readiness: are you actually in scope?

Who it is for

Cloud, SaaS, MSP and digital-infrastructure companies unsure whether NIS2 reaches them.

What it covers

Entity type against Annex I/II, the Art 6(30) cloud test, size thresholds with partner/linked aggregation, and any sector-specific act that displaces NIS2.

AI Governance Readiness

ISO 42001 is certifiable today. Your buyers' vendors already are.

Who it is for

AI SaaS and companies embedding AI into a regulated product.

What it covers

ISO 42001 clauses 4-10 and Annex A, the AI system impact assessment, AI Act classification, and how the AI management system meets or overlaps an existing ISMS.