This guide is the plan we run internally, generalised. It covers twenty weeks from scoping decision to Stage 2 audit, with the tasks, owners and dependencies laid out week by week.
It gives particular attention to the eleven controls introduced in the 2022 revision — threat intelligence, cloud services, ICT continuity, physical monitoring, configuration management, information deletion, data masking, DLP, monitoring activities, web filtering and secure coding — which are where most first-time implementations under-prepare.
It also documents the eight mistakes that most reliably add weeks to a certification timeline, each with the corrective approach.
Why it is structured the way it is, and the failure patterns it was designed around.
The 2022 revision added eleven controls. Four of them are where most first certifications lose weeks. A clause-level look at what auditors actually ask for.
A working risk register with a pre-populated scenario library, quantified exposure model and treatment tracking — not an empty template.
Most organisations discover their first real gap during an audit or an incident. The assessment surfaces it in fifteen minutes instead — scored, benchmarked and prioritised, with nothing to buy.
Built for
Kept current
Version 2.3, revised 9 May 2026. We update when a framework changes, when new rules are notified, or when an engagement teaches us something that improves it.
PDF + DOCX templates · 58 pages
What this will not do
A template cannot know your systems, test your controls or make the judgement calls that determine whether a programme holds up in an audit. Use it to move faster, not to skip the thinking — and treat any resource claiming to make you compliant on its own as a warning about its author.
The first certifiable AI management system standard, read from the implementer side: what Annex A demands, what integrates with an existing ISMS, and what does not.
Tiering model plus four proportionate question sets, so a low-risk vendor answers eight questions and a critical one gets genuine scrutiny.
A DPDPA-conformant notice set — customer, employee, vendor and website — with itemised processing tables and multilingual structure built in.
Your position across privacy, security, governance, risk and AI accountability, scored against sector benchmarks rather than a generic scale.
The specific gaps that matter most for your sector and size, ordered by risk reduction rather than by framework clause number.
Where you stand against DPDPA, ISO 27001, ISO 42001 and SOC 2 — and which of them your buyers are most likely to ask for next.
No sales call required to see your results. Take it, read the output, and decide independently whether you want to talk to anyone.
