IT Consulting
IT Governance & Compliance
Policy frameworks, control design and audit preparation for ISO 27001, SOC 2, GDPR, PCI DSS and HIPAA.
- Policy and standard framework development
- ISO 27001 ISMS design and implementation support
- SOC 2 readiness assessment and control mapping
Controls that survive an audit
Overview
Compliance frameworks are not the same as security, but they are how customers, insurers and regulators verify that you take it seriously. Failing an audit is a commercial problem regardless of how good your actual controls are.
We build governance that is proportionate to your business: policies people will follow, controls that are operable day to day, and evidence collection that happens as a by-product of normal work rather than a scramble before an audit.
IT governance and security governance give leadership a clear view of technology risk. Our IT risk management and cyber risk management work keeps a risk register with owners and review dates, and our IT policy consulting produces policies people actually follow.
For IT compliance, our compliance consulting and security compliance services support ISO 27001 compliance, SOC 2 compliance, GDPR compliance, PCI DSS compliance and HIPAA compliance. Engagements usually start with a compliance assessment against the standard, followed by ISO 27001 consulting or SOC 2 readiness work and audit preparation. Techx4u is not a certification body: we implement the controls and produce the evidence your auditor reviews.
What is included
Everything in the engagement, in writing.
- Policy and standard framework development
- ISO 27001 ISMS design and implementation support
- SOC 2 readiness assessment and control mapping
- GDPR data mapping, DPIAs and privacy documentation
- PCI DSS and HIPAA scoping and control implementation
- Internal audit and evidence-collection processes
What you get out of it
Outcomes you can hold us to.
- 01Audits pass without a fire drill
- 02Controls that operate continuously, not just at audit time
- 03Faster completion of client security questionnaires
FAQ
Frequently asked questions
How long does ISO 27001 certification take?
For a mid-sized organisation starting from a reasonable baseline, six to twelve months from kickoff to Stage 2 audit is realistic. The ISMS needs to be genuinely operating for a period before an auditor will certify it.
Can you act as our vCISO?
Yes. A fractional CISO engagement gives you named senior accountability for security governance without a full-time executive hire.
Ready to move on IT Governance & Compliance?
We will scope it against your actual environment, not a generic package, and give you a fixed price before any work starts.