An engagement pattern, not a named client. The sequence, the constraints and the decisions below are how these programmes actually run. No client is identified, and no outcome figures are claimed - where a number would normally sit, you will find the reason the number varies instead.
The trigger
A B2B payments platform closed a partnership with a high-street bank. The partnership was conditional: the bank required a recognised security certification before onboarding could complete, and set a six-month window.
The company had strong engineers and no security function. Nobody owned a risk register, no policy set existed beyond what had been written for a previous funding round, and the certification the bank wanted had never been scoped.
The constraint
Six months is achievable and it is not generous. The binding constraint in any certification programme is not the amount of work - it is that an auditor needs to see the management system operating over a period, which means the evidence clock has to start early and cannot be compressed at the end.
That inverted the usual sequence. Rather than designing the full management system and then implementing it, scope was fixed in the first fortnight and the evidence-generating activities - access reviews, risk reviews, supplier assessment - were started immediately, in parallel with the documentation being written.
What was delivered
Month 1. Scope fixed against what the bank was actually asking about rather than the whole company, which materially reduced the programme. Gap analysis completed and converted directly into a sprint backlog with named owners. Asset and system inventory built.
Months 2 to 3. Policy set drafted against the company's real operating model. Access control, joiner-mover-leaver and supplier assessment processes stood up and started running, because those are the ones that need a record across the observation period.
Month 4. Staff training delivered. Internal audit conducted by someone independent of the people who built the system, run as a genuine dry run rather than a formality.
Months 5 to 6. External audit support, including attendance, evidence preparation and closure of the non-conformities raised.
What made it work
Three things, and none of them are technical.
Scope was narrowed early. The instinct to certify everything would have made the six-month window impossible. Scope can always be widened at recertification.
The evidence clock started in week two. Documentation was written while the controls were already operating, rather than the other way round. This is the single most common cause of a slipped certification date.
A named individual owned it. Not a project team - one person accountable for the date, attending the standups, making the scope calls and answering to the executive.
The outcome
[CLIENT INPUT REQUIRED - Q9] The live site states specific outcomes for this engagement, including a clean audit result and a cost comparison against hiring. Those figures are not reproduced here until the client confirms each one as measured rather than estimated, and confirms the attributed quote is genuine. A compliance consultancy publishing an unverified metric about its own work is the exact failure mode this rebuild exists to remove.
The shape of the engagement, the sequence and the constraints above are accurate and are what a comparable programme would involve.