Foundation first
Build the policy, governance, and risk management foundation that certification bodies require before investing in technical controls.
Service
Security Programme Design
End-to-end design of your information security programme — policy framework, control architecture, governance model, and a clear path to certification.
ISO 27001SOC 2 Type IIPolicy frameworkGovernance design
Time to certification readiness
6–9 months
Organisations starting from a low baseline typically reach ISO 27001 or SOC 2 certification readiness within 6 to 9 months with a structured programme design engagement.
Standards covered
ISO · SOC 2 · CE+
Programme design covers ISO 27001, SOC 2 Type II, Cyber Essentials Plus, and NIST CSF depending on your certification target.
Engagement model
Embedded team
Our consultants work directly with your security, legal, and IT teams to design a programme your people can run and sustain.
How It Works
How programme design accelerates certification
Control architecture
Design a control set mapped to your chosen framework that your team can implement, evidence, and sustain without external dependency.
Measurable progress
A metrics framework gives leadership clear visibility into programme maturity and gives the business confidence that security investment is working.
Capabilities
Programme design scope
- Security programme scoping aligned to your risk appetite, regulatory obligations, and business context
- Policy framework design covering information security, acceptable use, access management, and incident response
- Control architecture design mapping technical and operational controls to ISO 27001, NIST CSF, or CIS Controls
- Governance model design including roles, responsibilities, escalation paths, and committee structure
- Risk management framework design covering risk appetite, assessment methodology, and treatment workflow
- Metrics and measurement framework to track programme effectiveness for board and leadership reporting
- Certification readiness roadmap with milestones, resource estimates, and audit preparation guidance
Outcomes
Deliverables and outcomes
- Written security policy suite ready for staff communication, acknowledgement, and version control
- Control framework baseline mapped to your chosen standard and current implementation status
- Governance structure with defined RACI, meeting cadences, and board reporting format
- Risk register template with pre-populated common risks, appetite statements, and treatment options
- Programme metrics dashboard design giving leadership meaningful visibility without technical noise
- Certification roadmap with realistic timelines for ISO 27001, SOC 2, or Cyber Essentials Plus
Get Started
Design a security programme your team can actually run
Our consultants design programmes that are proportionate to your organisation size, risk appetite, and certification target — avoiding the over-engineering that makes programmes expensive to maintain and hard to evidence.
Contact Us → →