Continuous evidence collection
Automated collection wherever an API exists, structured manual collection where it does not, into a single repository mapped to every framework you hold.
Loading page content
Built to deliver
Executive summary
Certification is not the finish line; it is the start of a permanent operating obligation. Most organisations handle it in an annual panic — evidence gathered six weeks before the audit, control failures discovered eleven months late. This engagement runs the control environment continuously, so surprise becomes structurally impossible and each additional framework costs a fraction of the first.
Certification is not the finish line; it is the beginning of a permanent operating obligation. Controls have to keep working, evidence has to keep being generated, internal audits have to happen, and surveillance audits arrive whether or not anyone prepared.
Most organisations handle this in an annual panic. Six weeks before the audit, someone starts collecting screenshots. Controls that lapsed in month three are discovered in month eleven. The team that built the programme has moved on to other work.
Managed Compliance replaces that cycle with a continuous operation. We run the calendar, collect the evidence, test the controls, handle the auditors and answer the customer questionnaires — and you get a monthly report showing exactly where you stand across every framework you hold.
The cost of annual-cycle compliance
Each capability below is a discrete workstream with its own owner, deliverables and definition of done.
Automated collection wherever an API exists, structured manual collection where it does not, into a single repository mapped to every framework you hold.
Scheduled testing across the control set with exceptions raised and tracked when a control lapses — in the month it happens, not at audit.
End-to-end coordination of surveillance audits, SOC 2 examinations and customer audits, including evidence packaging and auditor liaison.
A maintained answer library and a managed response service that returns completed enterprise questionnaires in 48 hours.
Scheduled policy review, approval routing, version control and attestation tracking across the organisation.
A monthly posture report across all frameworks — control health, open exceptions, upcoming obligations and audit readiness score.
Each benefit is stated with the commercial consequence attached, because a capability without a consequence is a feature list.
Monthly testing across the control set with exceptions raised in the month they occur.
Exceptions raised in the month they occur, not surfaced for the first time at next year's audit.
Continuous evidence collection wired to the systems that generate it, packaged for the auditor.
Saves roughly 11 days of senior time per surveillance audit.
A maintained answer library with evidence pointers and a managed response service.
Removes a recurring two-week delay from every enterprise deal.
New frameworks loaded onto the existing cross-mapped control library, reusing evidence.
Keeps the marginal cost of expansion low as buyer requirements broaden.
Phases overlap deliberately — design begins before assessment closes, so the programme does not stall waiting for a document to be signed off.
Weeks 1–6
Take over the existing programme: import controls, evidence and policies, and validate current state against each framework.
Weeks 4–10
Connect automated evidence sources, define collection schedules and set up the testing calendar.
Weeks 8–16
Close the exceptions inherited at transition and establish a clean baseline across the control set.
Ongoing
Steady-state delivery: continuous evidence, monthly testing, questionnaire response and audit coordination.
As needed
Add new frameworks onto the existing control library, reusing evidence to keep the marginal cost low.
Named artefacts, listed in the statement of work. If it is not on this list, we will tell you before you sign rather than after.
Sector constraints change the delivery approach more than they change the obligations. These are the sectors this methodology is built around.
Fixed fee for defined scopes, retainer for ongoing services. We do not price advisory work on time and materials, because that misaligns our incentive with your outcome.
2 weeks
Organisations unsure whether their programme is still operating
Commercial basis: Fixed fee
Rolling, 12-month minimum
Organisations wanting the programme operated for them
Commercial basis: Monthly retainer
Per framework
Existing managed clients adding a certification
Commercial basis: Fixed fee per framework
Every proposal states what is included, what is not, and what would trigger a change request. If the scope we recommend is smaller than the one you asked for, we will say so.
One implementation, cross-mapped. Each framework below links to its own obligations and control domains.
Specific answers about scope, timeline and what we will and will not do.
Ask a practitioner directly. First responses come from the person who would run your engagement, within one business day.
Ask a questionTurn data protection law into working product behaviour.
We map where personal data actually lives, rebuild consent and rights flows into your product, and leave you with a privacy programme that survives an audit and a board question.
Explore capabilityDefensible security, built around how your business actually loses money.
Threat-led security strategy, architecture and control design that prioritises the handful of scenarios that would genuinely hurt you — not a generic checklist of 300 controls.
Explore capabilityOne operating model for privacy, security, risk and AI accountability.
We design the committees, policies, decision rights and reporting lines that let trust obligations be managed as one programme instead of four competing ones.
Explore capabilityCombining capabilities reduces cost — the second framework typically lands at about half the price of the first.