Knowledge hub
Know what matters.
Ask better questions.
Clear distinctions for decisions about learning, security and management systems.
A course, an audit or implementation support?
Three different needs. Three different routes.
Decision guideISO 27001 and Cyber Essentials are not interchangeable.
Start with the actual requirement in your customer or tender document.
Decision guideCheck the certificate—and what it covers.
The organisation, scope, standard and accredited certification body all matter.
Decision guideISO 31000 in the UK: guidance, training and certification
Separate the risk-management framework, an individual credential and an organisational assurance claim.
Decision guideISO 27001 certification in the UK: scope, costs and responsibilities
Decide what needs to be certified, what work belongs in the project and how to compare proposals without confusing consultancy with certification.
Decision guideISO 27001 risk assessment and risk register: a worked example
An original small risk register for a fictional hosted service. Follow the assumptions, treatment choices and evidence instead of copying an unexplained score.
Decision guideISO 27001 Statement of Applicability: a worked example
Connect a treatment decision to an applicable control, its implementation state and the evidence behind it. Use this small fictional example to structure the conversation—not to replace the standard.
Practical guideISO 27001 Clause 9.2: internal audit requirements explained
The audit programme, planned intervals, impartial auditors and what UK certification bodies check, in plain English.
Practical guideHow to conduct an ISO 27001 internal audit
Seven steps with inputs, outputs and time, a sample plan, one finding graded three ways and a report template.
Practical guideISO 27001 internal audit checklist: Clauses 4 to 10 and Annex A
Every clause with the audit question, the evidence to sample and the typical finding, plus Annex A tests and a template.
Practical guideWhat an ISO 27001 internal audit costs in the UK
From £1,500 + VAT: the six cost drivers, day rate versus fixed fee, and in-house versus outsourced versus pre-assessment.
Decision guideISO 42001 in the UK: implementation, audit and certification
Translate an AI customer requirement into an AI management-system boundary. Keep governance, technical evaluation, privacy obligations and independent certification distinct.
Decision guideSOC 2 Type 1 vs Type 2: a UK buyer’s guide
Clarify which report your customer expects before planning readiness work. SOC 2 is an independent attestation report, not an ISO certificate or an individual course credential.
Decision guideNIST CSF 2.0 for UK teams: from outcomes to decisions
Use the Cybersecurity Framework to structure risk conversations, prioritise improvements and explain evidence. Keep the framework distinct from an individual training credential.
Let’s make the next step clear.
Tell us what you need to achieve, what is in scope and where you are starting.
Talk about your project