Cyber and Information Security Advisory
Practical support from an IRCA-certified ISO 27001 Lead Auditor with more than fifteen years’ experience implementing and auditing information security management systems.
What Defenceart does
Defenceart helps organisations prepare for ISO 27001 certification, keep their management system working once they have it, and put sensible data protection practices in place alongside it.
The work is advisory and audit-based. Defenceart doesn’t sell technical testing or certification. The job is to help you understand where you stand, decide what is worth doing, and do it in a way that will stand up to an external audit.
Services
Advisory
Getting ready for certification, or building something that works. Gap analysis, ISO 27001 implementation, UK GDPR and ISO 27701, and related management systems.
Audit
An independent view of where you stand. Internal audits, pre-certification audits and audits of your suppliers.
Managed Compliance
Keeping it working after certification. Fractional information security management, security questionnaires and staff awareness training.
What you actually receive
Findings are written plainly, tied to the clause behind them, and marked as essential for certification or good practice. You decide what to act on.
This is an illustrative extract from a gap analysis report.
Gap analysis report Illustrative example
Clause 9.2 Internal audit
| Finding | No internal audit has been carried out against the current scope. |
|---|---|
| Why it matters | An internal audit and a management review need to be complete before the certification audit. |
| Action | Plan and complete an internal audit, then record the results for management review. |
Essential for certification
Clause 5.2 Information security policy
| Finding | The policy is approved and communicated, but the wording is dense and hard for staff to apply. |
|---|---|
| Why it matters | A policy people cannot follow does not change how they work. |
| Action | Shorten it and add a one-page summary for staff. |
Good practice
Who I work with
Most of my clients are mid-sized and enterprise organisations that need ISO 27001 for commercial reasons: a customer has asked for it, a tender requires it, or a supply chain review has raised questions. I also work with organisations that already hold certification and want an independent internal audit, or ongoing help keeping their management system running.
Common questions
Do you issue ISO 27001 certificates?
No. Certificates are issued by accredited certification bodies. My role is to get you ready for that audit and keep your system working afterwards.
How long does it take?
For a small or mid-sized organisation starting from scratch, three to six months to be ready for the certification audit is realistic.
Is ISO 27001 realistic for a small company?
Usually, yes. The standard is designed to be proportionate, provided the essentials are in place and actually used.
Not sure where to start?
A short call is usually the quickest way to work out what you need. There is no charge for it and no obligation afterwards.