Skip to content

Managed vCISO

Audits and core frameworks

What this is

A certification programme takes an organisation from its current position to a certificate or attestation against a recognised framework. It covers scope definition, gap analysis, remediation, the operating evidence an auditor requires, internal audit, and liaison with the certification body through to a closed audit.

The problem

The certificate is not the hard part. Scope, evidence and the date are.

Certification programmes fail in predictable ways. Scope is drawn too wide at the start, so the programme is twice the size it needed to be and the cost is fixed before anyone notices. Evidence is left until the end, so the auditor asks for records from March that were never kept. And the date is committed to a customer before anyone has established what the distance actually is.

None of those are technical problems. They are programme management problems in a domain where the consequences are commercial - a certificate that slips by two months can lose the deal it was obtained for.

What makes it manageable is doing the unglamorous things in the right order: scope against commercial need rather than instinct, start the evidence clock early, run a real internal audit as a dry run, and manage the certification body actively rather than waiting to be assessed.

Who this is for

  • Companies with a deal blocked on a certificate they do not yet hold.
  • Organisations that have started a certification programme and stalled.
  • Teams that need ISO 27001 and SOC 2 and want one programme producing both.
  • Firms whose recertification is approaching with drift since the last audit.
  • Public sector suppliers needing Cyber Essentials or Cyber Essentials Plus for a bid.

Delivery

How the engagement actually runs

Sprints inside your engineering cycle, with findings arriving continuously rather than a report arriving at the end. Durations are elapsed time for a typical scope, and get re-scoped against your estate before anything is committed.

  1. 013-5 weeks

    Scope and gap

    Establish scope against commercial need, measure the real distance, and commit to a date that can be met.

  2. 022-3 months

    Build

    Documentation and remediation delivered as sprints, with the highest-risk and longest-lead items - supplier assessments especially - started first.

  3. 032-3 months

    Operate and evidence

    The management system runs and generates records. Internal audit and management review completed. This period cannot be compressed.

  4. 046-10 weeks

    Audit

    Stage 1, remediation, Stage 2, non-conformity closure, certificate. We attend and handle the questions.

Deliverables

What you actually receive

Artefacts your team owns and can maintain after the engagement, not a report that ages the moment it lands.

Deliverables for Audits and core frameworks, with what each one contains and when it lands
DeliverableWhat it containsWhen
Scope decisionWhat is in and out, argued from what your buyers actually ask about. Scope is the single largest cost lever and it is decided in week one.Week 1-2
Gap analysisCurrent position against the standard, delivered as a prioritised backlog with owners and effort estimates rather than a compliance matrix.Week 3-4
Realistic dateA defensible certification date based on the measured gap and your capacity, so what gets committed to a customer can be met.Week 4
Documentation setPolicies, procedures, risk assessment, Statement of Applicability or control descriptions - written to your operating model, not templated.Month 2-3
Evidence pipelineWhat gets recorded, where it lives, and how long it is retained - established before the evidence clock starts, not during fieldwork.Month 2
Independent internal auditA genuine dry run of the external audit, run by someone who did not build the system, so findings surface while they are still cheap.Month 4-5
Auditor liaisonCertification body selection, Stage 1 and Stage 2 attendance, and non-conformity closure managed through to the certificate.Month 5-7

Frameworks this touches

FAQ

Questions people actually ask

Can we get ISO 27001 and SOC 2 from one programme?

Yes, and it is considerably cheaper than running them separately. The underlying control work overlaps by roughly seventy per cent, and most evidence serves both. What differs is the output and the process: ISO 27001 produces a certificate from an accredited body after a two-stage audit, while SOC 2 produces a report from a CPA firm covering an observation window. Running one control programme and two validation tracks is the normal approach for companies selling on both sides of the Atlantic.

How do we choose a certification body?

Accreditation first: only certificates from bodies accredited by a recognised national accreditation body, UKAS in the UK, carry weight in enterprise procurement. Unaccredited certificates are cheaper and faster and are routinely rejected by exactly the customers the certificate was obtained to satisfy. Beyond that, look at sector experience, auditor availability against your target date, and whether they can also cover your future scope.

What if we have already committed to a date with a customer?

Say so at the start, because it changes the approach. A fixed external date means scope is narrowed aggressively to what is achievable, the evidence clock starts immediately, and the certification body is booked before the gap analysis finishes. It is frequently deliverable. What is not deliverable is a date committed without knowing the distance, discovered three months in - which is why the gap analysis comes first even when the date is already public.

How much of this can our team do ourselves?

More than most programmes assume, and the split matters. Your team knows the systems and holds the evidence; that work cannot be outsourced meaningfully. What tends to be worth bringing in is the scoping judgement, the documentation set, the independent internal audit, and the auditor relationship - the parts where having done it before saves months. A programme where a consultant writes everything and the team learns nothing fails at the first surveillance audit.

More in Managed vCISO

Start

Three ways in, depending on how close the deadline is.

Or just email a human: hello@cloudgap.ai

We reply within24 hours