ISO 42001
The international standard for AI Management Systems.
TimelineAgreed at scoping
Best forProving AI Governance to Buyers, Investors and Regulators
FRAMEWORKS
Reference guides to the frameworks buyers ask about.
Goldline delivers ISO 42001 and ISO 27001 as headline programmes. These guides explain the wider framework landscape, where each one applies, and how it relates to the management systems we implement.
DELIVERED BY GOLDLINE
View framework
ISO 27001
The international standard for Information Security Management Systems.
TimelineAgreed at scoping
Best forUnblocking UK and EU Enterprise Procurement
INFORMATION SECURITY AND PRIVACY
SOC 2
For UK companies whose US or enterprise customers ask for a SOC 2 report. Goldline scopes the Trust Services Criteria that apply, designs and documents the controls, builds the evidence inside the compliance platform the company chooses, and prepares the company for the examination. The report is issued by a licensed CPA firm after its own examination; Goldline does not issue it. Type I reports on control design at a point in time; Type II reports on operation over a period the company chooses, usually three to twelve months. Companies that also need ISO 27001 run both on one control set. Scoped on the diagnostic.
TimelineVaries by Type
Best forUS Enterprise Procurement
GDPR
The UK and EU data protection regime governing personal data processing.
TimelineOngoing Obligation
Best forAny Organisation Handling EU or UK Personal Data
ISO 27017
Cloud-specific security controls extending an ISO 27001 management system.
TimelineExtension to ISO 27001
Best forCloud Service Providers
ISO 27018
Protection of personally identifiable information in public cloud environments.
TimelineExtension to ISO 27001
Best forCloud Processors Handling Personal Data
ISO 27701
The privacy information management extension to ISO 27001.
TimelineExtension to ISO 27001
Best forDemonstrating Privacy Management Alongside Security
PCI DSS
The payment card industry standard for organisations handling cardholder data.
TimelineVaries by Merchant Level
Best forOrganisations Processing Payment Card Data
NHS DSPT
The Data Security and Protection Toolkit required of NHS suppliers and partners.
TimelineAnnual Submission
Best forNHS-Connected Organisations
NIS2
EU cybersecurity duties that reach UK suppliers through an EU customer's contract and questionnaire.
Who it reaches: Essential and important EU entities, and UK suppliers reached through their customers' supply-chain duties.
What Goldline does: Goldline maps Article 21 risk-management measures and Article 23 incident-reporting duties to the company's controls. ISO 27001 provides the management system evidence.
Issued by: Nobody. NIS2 has no certificate.
NIST Cybersecurity Framework 2.0
A voluntary six-function framework for describing current and target cybersecurity outcomes.
Who it reaches: Any organisation, including UK companies asked for a CSF profile by a US parent, investor or customer.
What Goldline does: Goldline develops current and target profiles against the six functions. The profiles map to the ISO 27001 Annex A controls the company runs or is building.
Issued by: Nobody. CSF has no certificate.
NIST SP 800-171
Requirements for non-federal organisations handling US Controlled Unclassified Information.
Who it reaches: Non-federal organisations handling US Controlled Unclassified Information, including UK suppliers reached by contract flow-down.
What Goldline does: Goldline assesses each requirement against the contract's named revision and prepares the System Security Plan and Plan of Action and Milestones. The evidence sits with the company's ISO 27001 and Cyber Essentials evidence.
Issued by: The supplier self-assesses and the prime or contracting officer accepts it.
CMMC
The assessment programme for contractors and subcontractors in the US Department of Defense supply chain.
Who it reaches: Contractors and subcontractors, including UK companies, once a US Department of Defense contract carries the CMMC clause.
What Goldline does: Goldline prepares organisations for Level 1 and Level 2 by scoping the boundary, assessing gaps and building the System Security Plan and evidence. A mock assessment takes place before the C3PAO arrives.
Issued by: An accredited C3PAO, or the Department of Defense for Level 3.
EU Cyber Resilience Act
EU cybersecurity requirements for products with digital elements placed on the EU market.
Who it reaches: Manufacturers, importers and distributors of hardware and software placed on the EU market, including UK manufacturers selling into the EU.
What Goldline does: Goldline classifies the product and assesses it against Annex I. Goldline develops the required secure development, vulnerability-handling, documentation and conformity route.
Issued by: The manufacturer for default products, or a notified body for important and critical classes.
FedRAMP
The authorisation route for cloud service providers selling to US federal agencies.
Who it reaches: Cloud service providers selling to US federal agencies, including UK SaaS companies with a federal buyer in view.
What Goldline does: Goldline establishes whether FedRAMP is the right ask and maps existing ISO 27001 or SOC 2 evidence to the 800-53 baseline. The resulting gap list is what the 3PAO will test.
Issued by: A federal agency, on a 3PAO's assessment.
AI GOVERNANCE
EU AI Act
The EU regulation classifying AI systems by risk and setting obligations for each tier.
TimelinePhased to 2027
Best forOrganisations Placing AI Systems on the EU Market
NIST AI RMF
The voluntary US framework for governing, mapping, measuring, and managing AI risk.
TimelineVoluntary Framework
Best forOrganisations Aligning to US AI Governance Expectations
SECTOR AND REGULATORY
DORA
The EU digital operational resilience regime for financial entities and their ICT providers.
TimelineIn Force
Best forEU Financial Services and Their ICT Suppliers
Cyber Essentials
The UK government-backed baseline of five technical controls.
TimelineAgreed at scoping
Best forUK Public Sector Tenders and Supply Chain Baseline
Cyber Essentials Plus
The independently audited version of the Cyber Essentials controls.
TimelineAgreed at scoping
Best forSupply Chains Requiring Independent Technical Audit
IASME Cyber Assurance
A broader UK assurance scheme covering fourteen governance and security themes.
TimelineVaries by Level
Best forCyber Resilience Beyond the Technical Baseline
Defence Cyber Certification
The MOD supply chain cyber requirement applied through Def Stan 05-138.
TimelineLevel 0 by 31 December 2026
Best forUK MOD Supply Chain Suppliers
DEFCON 658
The MOD contract condition that makes cyber risk assessment and supplier assurance contractual.
TimelineApplies at Contract Award
Best forSuppliers Holding MOD or Prime Contract Flowdown
Def Stan 05-138
The MOD standard grading contracts from Very Low to Very High risk and setting the control set for each.
TimelineIssue 4 Current
Best forEstablishing the Cyber Risk Level Behind DCC
GHANA PRACTICE
Goldline's Ghana practice serves Bank of Ghana regulated institutions, distinct from our UK programmes.
Bank of Ghana CISD
The Cyber and Information Security Directive for Bank of Ghana regulated institutions.
TimelineVaries by Institution
Best forBoG-Licensed Banks, SDIs, and Payment Service Providers
GDPR for Ghanaian companies
How EU and UK data protection duties reach Ghanaian organisations serving European clients.
TimelineOngoing Obligation
Best forGhanaian Organisations Serving UK or EU Data Subjects
Ghana Data Protection Act
The Data Protection Act 2012 and the duties it places on data controllers in Ghana.
TimelineOngoing Obligation
Best forAny Data Controller Operating in Ghana
QUALITY MANAGEMENT
ISO 9001
Quality management. 2026 edition published 16 September 2026.
View frameworkFrameworks outside our headline delivery share substantial control overlap with ISO 42001 and ISO 27001. Where a framework sits outside our direct focus, we route to partner referral. Discussed at scoping.
Not sure which framework applies?
A free 45 minute diagnostic establishes which frameworks your buyers, regulator, or supply chain actually require. No sales pitch.