Cyber and Information Security Advisory
Practical support from an IRCA-certified ISO 27001 Lead Auditor with more than fifteen years’ experience implementing and auditing information security management systems.
What Defenceart does
Defenceart helps organisations prepare for ISO 27001 certification, keep their management system working once they have it, and put sensible data protection practices in place alongside it.
The work is advisory and audit-based. Defenceart doesn’t sell technical testing or certification. The job is to help you understand where you stand, decide what is worth doing, and do it in a way that will stand up to an external audit.
Not sure where to start?
A short call is usually the quickest way to work out what you need. There is no charge for it and no obligation afterwards.
Services
Gap Analysis
ISO 27001 · ISO 27701 · UK GDPR · NCSC CAF
Where you stand against a standard, and what it will take to close the gaps. Usually the first step.
Management System Implementation
ISO 27001 · ISO 27701 · ISO 9001 · ISO 20000-1
Building a management system your team can run, from scope to certification readiness.
Internal Audit
ISO 27001 · ISO 9001 · ISO 20000-1 · ISO 27701
Annual internal audits, pre-certification audits and supplier audits, by an IRCA-certified Lead Auditor.
Management System Maintenance
ISO 27001 · ISO 27701 · ISO 9001 · ISO 20000-1
Keeping a certified system current between audits, with a fixed amount of time each month or quarter.
Security Governance Advisory
ISO 27001 · NCSC CAF
Governance reviews, a part-time security lead (vCISO), and help with customer security questionnaires.
Data Protection Advisory
UK GDPR · DPA 2018 · DUAA 2025 · PECR · ISO 27701
Records of processing, DPIAs, privacy notices, cookies and the Data (Use and Access) Act 2025.
Security Awareness Training
ISO 27001 · UK GDPR
Training built around your own policies and risks, run as a planned programme.
Common questions
Do you issue ISO 27001 certificates?
No. Certificates are issued by accredited certification bodies. My role is to get you ready for that audit and keep your system working afterwards.
How long does it take?
For a small or mid-sized organisation starting from scratch, three to six months to be ready for the certification audit is realistic.
Is ISO 27001 realistic for a small company?
Usually, yes. The standard is designed to be proportionate, provided the essentials are in place and actually used.
Who I work with
Most of my clients are mid-sized and enterprise organisations that need ISO 27001 for commercial reasons: a customer has asked for it, a tender requires it, or a supply chain review has raised questions. I also work with organisations that already hold certification and want an independent internal audit, or ongoing help keeping their management system running.