Every engagement has a written scope, named deliverables and a fixed fee agreed before we start. Pick the one that matches your situation, or book a scoping call and we will tell you which applies.
We build your information security management system (ISMS) from where you are today to a passed Stage 2 audit. The scope, the deliverables and the fee are agreed before work begins, and we stay with you until the certificate is issued.
For: Software and IT services companies whose overseas clients ask for an ISO 27001 certificate in security questionnaires or tenders.
Scope, deliverables and timelineFor organisations that are already certified: an independent internal audit, preparation for surveillance and recertification visits, the transition from the 2013 edition to ISO/IEC 27001:2022, and a retained ISMS manager when you do not have one.
For: Certified companies that need the annual internal audit done by someone independent of the ISMS.
Scope, deliverables and timelineSri Lanka’s Personal Data Protection Act No. 9 of 2022 brings its core obligations for controllers and processors into force on 1 January 2027. We assess where you stand, build the records, notices and procedures the Act requires, and align the work with ISO 27001 and ISO 27701 so the same evidence serves both.
For: Any Sri Lankan organisation that processes personal data of customers, employees or users.
Scope, deliverables and timelineBusiness impact analysis, continuity and recovery plans, and exercises that show the plans work when something goes wrong. Structured as a management system and taken to certification if ISO 22301 is a requirement for you.
For: Companies whose clients or regulators ask for a tested business continuity plan.
Scope, deliverables and timelineFor companies that want a quality management system alongside their security programme, or need the ISO 9001 certificate for tenders. We can build it as part of one integrated management system so quality, security and continuity share the same audits and reviews.
For: Software and services companies asked for ISO 9001 in tenders and vendor onboarding.
Scope, deliverables and timelineThe honest short version. We will confirm it against your contracts and regulator during scoping.
| If this is your situation | Start here |
|---|---|
| Overseas clients ask for a certificate in security questionnaires or RFPs | ISO 27001, and SOC 2 if your clients are mostly in the United States |
| You supply systems or services to a licensed bank | ISO 27001 (accredited certificate), plus ISO 22301 if you host critical infrastructure |
| You are a licensed finance company or insurer | ISO 27001 as the evidence framework for your regulator, with internal audit and maintenance to keep it current |
| You hold personal data of customers, patients or employees | PDPA readiness, aligned with ISO 27001 if you are certifying anyway |
| You already hold ISO 27001 | Internal audit and surveillance support, or the 2022 transition if your certificate is still on the 2013 edition |
| Tenders ask for ISO 9001 | ISO 9001, ideally as one integrated system with ISO 27001 |
Forty-five minutes, no charge. We ask about your organisation, what is driving the project and what you already have in place, then send a written proposal with a fixed scope and fee.
