Prove
Compliance readiness
Get ready for independent assessment, with the evidence in order.
We help you prepare for an independent assessment against a recognised standard, such as SMB1001 or ISO/IEC 27001. We find the gaps, help write the policies and procedures, build your risk register, coordinate the control work and organise the evidence. Readiness support is not certification: Cyber Guys does not certify, and only an independent certification body can.
Request a quote- Price
- Quoted on scope
- How you can engage us
- One-off project
- Delivered by
- Cyber Guys
Who it is for
Businesses that need to show clients, tenders or regulators that they meet a recognised security standard, and want to arrive at the assessment prepared.
Scope
The standard or framework you choose — SMB1001, ISO/IEC 27001, the relevant parts of the NIST Cybersecurity Framework or CIS Controls, and privacy obligations under the Australian Privacy Principles where they apply to you — across the parts of the business agreed in the scope.
What is included
- Agreeing the standard, the level or certification scope, and the parts of the business covered
- A gap assessment against the chosen standard
- Policies and procedures drafted or updated to fit how your business works
- A risk register and risk treatment plan
- Coordination of control implementation with your team and IT provider
- Evidence collection, organised by requirement
- An internal readiness review before the independent assessment
- Preparation for the independent assessment, including what the assessor is likely to ask for
What is not included
- Work outside the agreed scope, which is quoted separately
- Certification or independent assessment: Cyber Guys does not certify and does not act as your certification body
- Reproducing licensed standards text; we reference requirements by clause or control number and describe them in our own words, so you may need your own copy of a licensed standard
- Certification body fees
- Legal advice, including on privacy obligations
- Technical implementation beyond coordination, unless a separate uplift service is engaged
How delivery works
- 01
Assess the gaps
We agree the standard and scope with you, then assess your current position against each requirement.
- 02
Plan
We agree a readiness plan: the documents, controls and evidence needed, who owns each and in what order.
- 03
Build
We draft policies and procedures, build the risk register and coordinate the control work with your team and IT provider.
- 04
Review readiness
We run an internal readiness review against the evidence and tell you plainly what is ready and what is not.
- 05
Prepare for assessment
We help you prepare for the independent assessment. The assessment itself, and any certification, is by an independent body.
Who does what
You
- Choose the standard and approve the scope
- Name owners for policies, risks and controls
- Review and formally adopt the policies and procedures
- Engage and pay the independent certification body
- Provide accurate information and evidence
Cyber Guys
- Run the gap assessment and explain the findings
- Draft policies, procedures and the risk register
- Coordinate control implementation and track it to completion
- Organise evidence by requirement
- Run the internal readiness review and report the result honestly
Your IT provider or partner
- Your IT provider implements or confirms technical controls they manage
- The independent certification body, engaged by you, conducts the assessment and makes the certification decision
Access we need
- Access to existing policies, procedures and records
- Time with the people who own key processes
- Read access to systems where technical evidence is needed
We never ask for your password. Access is through a named account that you or your IT provider create for the engagement, and can remove at any time.
Dependencies and licences
- You need your own copy of any licensed standard you are being assessed against
- Certification timing depends on the certification body you engage
What you receive
- Gap assessment report
- Policy and procedure set
- Risk register and treatment plan
- Evidence register organised by requirement
- Internal readiness review report
How we know it is finished
- Every requirement in scope is marked ready with evidence, not ready with an owner and plan, or excluded with a reason
- Policies are adopted by the business
- The internal readiness review report is delivered
Request a quote for Compliance readiness
Tell us a little about your business. We will arrange a short scoping call to agree what is in scope and send a written quote. The call is about scope and price — it is not free security advice.