FIRST CERTIFICATION

Unblock the deal.
Get certified.
Get back to building.

Your customer wants a certificate before they will sign. We get the security right first.

  • Free 45 Minute Diagnostic
  • Free Custom Certification Roadmap
  • No strings

Delivered by

CISSPVerify on Credly
Project Management Professional (PMP)®Verify on Credly
ISO 27001 Senior Lead Implementer (PECB)Verify on Credly
ISO 27001 Lead Auditor (PECB)Verify on Credly
ISO 42001 Lead Implementer (PECB)Verify on Credly
ISO 42001 Lead Auditor (PECB)Verify on Credly

Works inside a GRC platform, or the compliance platform you already use, or without one.

Currently accepting first certification engagements
Open the booking calendar
Book the Free DiagnosticSame-week availability
Book the free 45-minute diagnostic

Not sure which certificate you need? That is what the call is for.

info@goldlineconsultancy.co.uk

  • One practitioner

    from diagnostic to Stage 2

  • Fixed fee

    agreed before any work starts

  • A few hours a week

    from your team, not your roadmap

Built for founders who would rather ship product

Unblock the deal

The procurement team asking for ISO 27001. The CISO who will not sign off the integration without SOC 2. That is not a compliance problem, it is a revenue problem, and it is the one this engagement exists to clear.

A few hours a week

Your engineers should be building, not writing security policies. The engagement is designed so your team's time goes on the decisions only they can make, and the rest is not theirs.

One practitioner

The person who scopes the engagement delivers it, from the free diagnostic through to sitting in the room at Stage 2. No handover to someone more junior, because there is nobody more junior.

What is committed, and what is not

The scope, the fee and the practitioner are committed before any work starts. The certification decision belongs to your certification body, and anyone promising you that outcome is promising something they do not control.

What this is for

  • A named enterprise customer has asked for ISO 27001 or SOC 2 and the deal is waiting.

  • A security questionnaire has arrived and nobody can answer half of it.

  • You have no security lead, and the founder or first engineer has inherited this.

  • You need to know which certificate the customer actually wants before spending anything.

How it runs

PHASE 01

Diagnostic

Forty five minutes to establish which certificate the customer actually needs, and whether it is one, both or neither.

  • The gate identified
  • A written note the same day

PHASE 02

Scope and platform

The management system scope written down, and the compliance platform configured against it rather than left on defaults.

  • Scope statement
  • Platform configured
  • Integrations validated

PHASE 03

Build and evidence

Policies written for how you actually operate, controls implemented, and the evidence an auditor will accept.

  • Policy framework
  • Statement of Applicability
  • Evidence pack

PHASE 04

Audit

An independent internal audit, certification body engagement coordinated, and the practitioner in the room at Stage 2.

  • Internal audit report
  • Certification body engaged
  • Stage 2 attendance

The platform

This runs on a compliance platform, because doing it on spreadsheets costs more of your team's time than the platform costs. Works inside a GRC platform, or the compliance platform you already use, or without one.

    Already on a platform and not audit-ready?

    Frequently asked

    Usually yes, because the size of the team is not what sets the work. The scope is what sets it: the product, the infrastructure it runs on and the data an enterprise buyer cares about. A small team with one product and a single cloud account has a narrower scope than a larger team with several, and the engagement is scoped and priced accordingly.

    Findings are a normal part of a first certification audit. Each one is written up by the auditor, and the response is a corrective action with a root cause, a fix and evidence that the fix holds. The practitioner who built the system prepares that response with you rather than leaving it at your door. The certification decision rests with your certification body. What Goldline commits to is the scope, the fee and the practitioner.

    Engineering time is needed for the things only engineers can do: access reviews, configuration changes, logging and backup evidence, and answering questions about how the product is built. The documentation, the control design, the platform configuration and the audit preparation are not theirs. Sessions are booked in advance so nothing lands as an interruption.

    It depends on who is asking. Buyers in the UK and Europe generally ask for ISO 27001, and North American buyers generally ask for SOC 2. Sometimes the questionnaire says one thing and the procurement team will accept the other, and sometimes neither is the real gate. The diagnostic exists to establish which it is before anything is bought.

    Works inside a GRC platform, or the compliance platform you already use, or without one. The platform is a tool for collecting and monitoring evidence, and it is chosen on fit rather than preference.

    Not on a system Goldline implemented. Clause 9.2 requires the audit to be independent of the work being audited, and an implementer auditing their own implementation does not meet that. An independent credentialled auditor is introduced instead, and the internal audit is run by them.

    Yes, and it is common. The first step is a review of what exists: the scope, the policies written so far, the platform configuration if there is one, and the evidence already collected. What holds up is kept, what does not is rewritten, and the route from there is set out before the engagement is priced.

    The fee is fixed before work starts and depends on the scope, the framework and whether a platform is already in place. Published prices for the underlying programmes and assessments are set out on the pricing page. See pricing.

    Find out which certificate the deal actually needs

    A free diagnostic call with the practitioner who would do the work. Bring the questionnaire or the contract clause and we will tell you what it is really asking for.

    The certification decision rests with your certification body. What Goldline commits to is the scope, the fee and the practitioner.

    Book the Free Diagnostic

    45 minutes, video, with the practitioner who would do the work. No sales pitch.