Title: Knowledge hub

> Practical UK guides on ISO 27001, ISO 42001, SOC 2, NIST CSF and Cyber Essentials: internal audit, certification, worked examples and choosing a route.

Source: https://aegentra.co.uk/knowledge  
Publisher: Aegentra (aegentra.co.uk), United Kingdom edition. Prices in GBP excluding VAT.  
Updated: 2026-10-21  
Licence: public web content; cite the source URL.

Knowledge hub

# Know what matters. — Ask better questions.

Clear distinctions for decisions about learning, security and management systems.

[Decision guide ### A course, an audit or implementation support? Three different needs. Three different routes.](https://aegentra.co.uk/knowledge/course-or-consultancy)[Decision guide ### ISO 27001 and Cyber Essentials are not interchangeable. Start with the actual requirement in your customer or tender document.](https://aegentra.co.uk/knowledge/iso-27001-and-cyber-essentials)[Decision guide ### Check the certificate—and what it covers. The organisation, scope, standard and accredited certification body all matter.](https://aegentra.co.uk/knowledge/checking-certification)[Decision guide ### ISO 31000 in the UK: guidance, training and certification Separate the risk-management framework, an individual credential and an organisational assurance claim.](https://aegentra.co.uk/knowledge/iso-31000-certification-uk)[Decision guide ### ISO 27001 certification in the UK: scope, costs and responsibilities Decide what needs to be certified, what work belongs in the project and how to compare proposals without confusing consultancy with certification.](https://aegentra.co.uk/knowledge/iso-27001-certification-uk)[Decision guide ### ISO 27001 risk assessment and risk register: a worked example An original small risk register for a fictional hosted service. Follow the assumptions, treatment choices and evidence instead of copying an unexplained score.](https://aegentra.co.uk/knowledge/iso-27001-risk-assessment-example)[Decision guide ### ISO 27001 Statement of Applicability: a worked example Connect a treatment decision to an applicable control, its implementation state and the evidence behind it. Use this small fictional example to structure the conversation—not to replace the standard.](https://aegentra.co.uk/knowledge/iso-27001-statement-of-applicability-example)[Practical guide ### ISO 27001 Clause 9.2: internal audit requirements explained The audit programme, planned intervals, impartial auditors and what UK certification bodies check, in plain English.](https://aegentra.co.uk/knowledge/iso-27001-clause-9-2-internal-audit-requirements)[Practical guide ### How to conduct an ISO 27001 internal audit Seven steps with inputs, outputs and time, a sample plan, one finding graded three ways and a report template.](https://aegentra.co.uk/knowledge/how-to-conduct-an-iso-27001-internal-audit)[Practical guide ### ISO 27001 internal audit checklist: Clauses 4 to 10 and Annex A Every clause with the audit question, the evidence to sample and the typical finding, plus Annex A tests and a template.](https://aegentra.co.uk/knowledge/iso-27001-internal-audit-checklist)[Practical guide ### What an ISO 27001 internal audit costs in the UK From £1,500 + VAT: the six cost drivers, day rate versus fixed fee, and in-house versus outsourced versus pre-assessment.](https://aegentra.co.uk/knowledge/iso-27001-internal-audit-cost-uk)[Decision guide ### ISO 42001 in the UK: implementation, audit and certification Translate an AI customer requirement into an AI management-system boundary. Keep governance, technical evaluation, privacy obligations and independent certification distinct.](https://aegentra.co.uk/knowledge/iso-42001-certification-uk)[Decision guide ### SOC 2 Type 1 vs Type 2: a UK buyer’s guide Clarify which report your customer expects before planning readiness work. SOC 2 is an independent attestation report, not an ISO certificate or an individual course credential.](https://aegentra.co.uk/knowledge/soc-2-type-1-vs-type-2)[Decision guide ### NIST CSF 2.0 for UK teams: from outcomes to decisions Use the Cybersecurity Framework to structure risk conversations, prioritise improvements and explain evidence. Keep the framework distinct from an individual training credential.](https://aegentra.co.uk/knowledge/nist-csf-2-uk)

## Build your capability.

[How to become an ISO 27001 Lead Implementer](https://aegentra.co.uk/knowledge/how-to-become-iso-27001-lead-implementer)

[How to become an ISO 27001 Lead Auditor](https://aegentra.co.uk/knowledge/how-to-become-iso-27001-lead-auditor)

[How to become an ISO 42001 Lead Implementer](https://aegentra.co.uk/knowledge/how-to-become-iso-42001-lead-implementer)

[How to become an ISO 42001 Lead Auditor](https://aegentra.co.uk/knowledge/how-to-become-iso-42001-lead-auditor)

[How to become an ISO 31000 risk manager](https://aegentra.co.uk/knowledge/how-to-become-iso-31000-risk-manager)

## Let’s make the next step clear.

Tell us what you need to achieve, what is in scope and where you are starting.

[Talk about your project](https://aegentra.co.uk/contact)