ISO/IEC 27001:2022
ISO 27001 consulting
From gap assessment to certificate: scope, risk assessment, Statement of Applicability, the 93 Annex A controls, internal audit and certification audit support.
Learn moreSecurity, privacy & AI governance advisory · GCC · ANZ · USA
ISO 27001 and ISO 42001 readiness, led by a certified Lead Auditor.
We help organisations in the GCC, Australia, New Zealand and the United States build information security, privacy and AI management systems that pass certification audits and keep working after them. Advisory, vCISO leadership, AI governance and accessibility testing from a consultant who knows what auditors look for.
- Certified ISO/IEC 27001 Lead Auditor
- Certified ISO/IEC 42001 Lead Auditor
- 25+ years in IT and security
Services
Advisory for the standards and laws your customers ask about
Each engagement is scoped to what you actually need to prove, and to whom.
ISO/IEC 42001:2023
ISO 42001 consulting
An AI management system that holds up to audit: AI policy, AI system impact assessments, the 38 Annex A controls and certification readiness.
Learn moreGDPR · HIPAA · AU & NZ Privacy Acts
Privacy compliance
One privacy programme across the regimes that apply to you: data mapping, DPIAs, data subject rights, breach response and vendor contracts.
Learn moreFractional leadership
vCISO services
Senior security leadership without a full-time hire: strategy, board reporting, policy, third-party risk and incident readiness.
Learn moreAI risk and policy
AI governance
Know where AI is used in your business, what risks it carries and who owns them. Inventory, risk assessment, acceptable use policy and oversight.
Learn moreStrongAccess · GCC · ANZ
Accessibility testing
WCAG 2.2 AA audits, remediation support and continuous assurance for websites, apps and PDFs, including Arabic and right-to-left journeys.
Learn moreStrongAccess
Accessibility assurance for the GCC, Australia and New Zealand
Accessibility is now named in GCC national policy and set at WCAG 2.2 AA in Australian and New Zealand guidance. StrongAccess audits your digital services, helps your teams fix what we find and keeps every release accessible.
UAE · Saudi Arabia · Qatar
Accessibility testing for the GCC
Bilingual Arabic and English testing for government, semi-government, banking, healthcare and telecom, with procurement-ready evidence.
GCC accessibility testingAustralia · New Zealand
Accessibility testing for Australia & NZ
WCAG 2.2 AA audits and release-aligned assurance mapped to the DDA, AS EN 301 549 and the NZ Web Accessibility Standard 1.2.
Australia and NZ accessibility testingWhy work with us
Prepared by someone who audits
Assessed against audit criteria
As a certified Lead Auditor for both ISO 27001 and ISO 42001, we review your system the way a certification body will. Findings come up in our review, not in your Stage 2 audit.
Documentation sized to you
A 40-person company doesn't need a 400-page ISMS. Policies and procedures are written to fit how you work, so people follow them after the auditor leaves.
Senior expertise throughout
The consultant who scopes your engagement is the one who delivers it. No hand-off to a junior team after the contract is signed.
One programme, several frameworks
ISO 27001, ISO 42001, privacy laws and customer security questionnaires overlap heavily. We map shared controls once so you aren't running parallel projects.
How it works
A typical certification engagement
The same five stages apply to ISO 27001 and ISO 42001. Timing depends on scope and your starting point.
Discovery and scoping
We agree what's in scope, which standard or framework you need and why, and who your auditor will be.
Gap assessment
A clause-by-clause and control-by-control review of where you stand, with a prioritised remediation plan.
Implementation
Risk assessment, Statement of Applicability, policies, procedures and the evidence an auditor will ask for, built with your team.
Internal audit and management review
A full internal audit against the standard and a management review with your leadership, both required before certification.
Certification audit support
We help you choose an accredited certification body, prepare for Stage 1 and Stage 2, and close any findings.
Frameworks
Standards and regulations we work with
- ISO/IEC 27001
- ISO/IEC 27002
- ISO/IEC 42001
- ISO/IEC 27701
- ISO/IEC 23894
- NIST CSF 2.0
- NIST SP 800-53
- NIST AI RMF
- EU AI Act
- GDPR
- HIPAA
- PIPEDA
- Privacy Act 1988 (AU)
- Privacy Act 2020 (NZ)
- India DPDPA
- UAE PDPL
- SOC 2
- WCAG 2.2
- AS EN 301 549
Where we work
GCC, Australia, New Zealand and the United States
Based in the UAE, with working hours that overlap the GCC, Australian and New Zealand business day. Most work is delivered remotely; on-site visits are arranged where an engagement needs them.
FAQ
Common questions
How long does ISO 27001 certification take?
For a small or mid-sized organisation, getting ready for the certification audit typically takes three to six months. It depends on your scope, how much is already in place and how quickly decisions get made. The certification audit itself runs in two stages, usually a few weeks apart.
Can we implement ISO 27001 and ISO 42001 together?
Yes. Both standards use the same harmonised structure (clauses 4 to 10), so leadership, risk management, internal audit and management review can run as one integrated management system. Many certification bodies can audit both together.
Do you issue the ISO certificate?
No. Certificates are issued by accredited certification bodies, and that independence is what gives a certificate its value. We prepare you for the audit, help you choose a certification body and support you through Stage 1 and Stage 2.
Which privacy laws do you cover?
GDPR, HIPAA, PIPEDA, Australia's Privacy Act 1988, New Zealand's Privacy Act 2020, India's DPDPA and the UAE PDPL. Where several apply, we build one privacy programme with shared controls rather than separate projects for each law.
Which countries do you work in?
We're based in the UAE and work with organisations across the GCC, Australia, New Zealand and the United States. Most work is delivered remotely, with on-site visits arranged where an engagement needs them. Meetings are scheduled to suit your time zone.
Do you offer accessibility testing?
Yes. StrongAccess is our accessibility assurance programme for the GCC, Australia and New Zealand: WCAG 2.2 AA audits of websites, apps and PDFs, remediation support and continuous monitoring. In the GCC we test Arabic and English journeys, including right-to-left layouts.
Find out how far you are from certification.
Tell us where you are today. We'll come back with a clear view of the gaps, the effort involved and a realistic timeline. No obligation.