Which standard the gate in front of you actually requires, and which it does not.
THE FREE DIAGNOSTIC
Know where you stand.45 minutes with the practitioner.A written roadmap, same day.
Not a sales call and not a scoping call. Bring the questionnaire, the clause, the customer email or the auditor's finding, and leave knowing what it requires and what you already have.
- Free, no obligation, no follow-up sequence unless you ask
- One-page roadmap written the same day, yours either way
Currently accepting diagnostic bookings
5-star client reviewsRead them on G2
CISSP, PECB Lead Auditor, ISO 27001 and ISO 42001Book the free 45 minute diagnosticBring the questionnaire, the clause or the customer email. You leave with a one-page roadmap either way.Same-week availability
No sales pitch 45 minutes Senior practitioner
CISSP, ISO 27001 Lead Implementer and Lead Auditor, ISO 42001 Lead Implementer and Lead Auditor, PMP.
Trusted by
THE DIAGNOSTIC AT A GLANCE
45 min
with a senior practitioner
Video, at a time you choose.
1 page
written roadmap
Sent the same day. Yours either way.
£0
for the diagnostic
No obligation and no follow-up sequence.
4
standards
ISO 27001, ISO 42001, SOC 2 and Cyber Essentials.
Programme prices are published at /pricing, excluding VAT, and fixed after scoping. Goldline is not a certification body.
What we would cover
Where your boundary should sit: the people, systems and sites inside the certificate.
What you already have that counts, and the order to build the rest in.
Doing it alone vs with Goldline
Doing it alone
- One person reads the standard at night and guesses which controls apply.
- A template pack that an auditor takes apart at Stage 1.
- The boundary drawn too wide, so everything after it is bigger.
- Evidence gathered in the week before the visit.
- The audit date moving because the internal audit was left to the end.
With Goldline
- The person who scopes it is the person who delivers it.
- A boundary agreed in writing before anything is built.
- Your team builds it. Goldline directs the order and reviews every artefact.
- Evidence organised so an auditor or a procurement reviewer can find it without a rebuild.
- Fixed published prices, confirmed after scoping. An independent body certifies.
The diagnostic comes first. If it is all you need, that is a good outcome and nothing else happens.
How a programme runs
Planned timings for a single entity under 50 people. The independent body sets its own audit dates.
Weeks 1 to 4
Scope and diagnostic
Free diagnostic, then scoping of your systems, your risks and what a buyer will ask to see. Fixed price confirmed.
Weeks 5 to 12
Build with direction
Your team builds the single management system. Goldline sets the order, reviews every artefact and runs the internal audit.
Months 4 to 9
Independent assessment
Goldline prepares you for the Stage 1 and Stage 2 assessments by an accredited certification body and stays through close-out of any findings.
AFTER THE CALL
ISO 27001 and ISO 42001 Sprints. Pay up front, or monthly with nothing to pay for the first 30 days.
For teams under 50 people with someone who can give it four hours a week. The same fixed Sprint fee, paid up front or spread across the programme.
01How it runs
- Weeks 1 to 4
Cyber Essentials guidance, with your assessment marked by an independent certification body. Your scope and boundary agreed. Your compliance platform set up and connected, in your own account. A first-cut gap register.
- Weeks 5 to 12
Risk assessment, Statement of Applicability, policies and evidence built to audit-ready. Planned at 12 weeks from the start.
- Months 4 to 9
The management system runs, evidence builds up in your platform, and you are supported through Stage 1 and Stage 2 with the certification body you choose. The internal audit must be done by someone independent of the build, and is a separate cost.
Timings are planned objectives, not guarantees, and depend on your named owner's four hours a week. Certification is decided by an accredited certification body. Stage 1 and Stage 2 audit fees are separate and paid to the certification body directly. The Cyber Essentials assessment fee is passed through at the certification body's published rate, nothing added.
02Stop before day 30 and owe nothing
If you take the first 30 days free, nothing is payable for the programme in those 30 days, and if you stop before day 30 you owe nothing for the programme. The Cyber Essentials fee, once passed to the certification body, is not refundable. Your platform account and your Cyber Essentials answers stay yours.
03Pay up front, or monthly
The Sprint fees are published on the pricing page, all plus VAT, paid half at the start and half on delivery, or with the first 30 days free, then quarterly (40/30/30) or in six monthly payments.
04Working to a deadline?
A Sprint covers the management system build with your named owner. See the Sprint prices
You leave the call knowing your number.