Insights from Delivery.
Practitioner writing on AI governance, information security, and the regulatory pressure UK organisations are now navigating.
Book the Free Diagnostic
Curious about your own ISO 27001 readiness? Take our free 5-minute ISMS maturity self-assessment, calibrated by an ISO 27001 Lead Implementer (PECB).
62 insights
5 min read
Do we need a Data Protection Officer?
By Alfred Obeng, Founder, Goldline Consultancy
CISSP | Project Management Professional (PMP)® | ISO 27001 LI & LA | ISO 42001 LI & LA
The three UK GDPR tests that make a Data Protection Officer compulsory, why customers ask for one anyway, and what an outsourced DPO does.
- UK GDPR
- DPO
4 min read
The data protection complaints duty that started on 19 June 2026
By Alfred Obeng, Founder, Goldline Consultancy
CISSP | Project Management Professional (PMP)® | ISO 27001 LI & LA | ISO 42001 LI & LA
Since 19 June 2026, every UK controller must help people complain, acknowledge each complaint within 30 days and respond without undue delay. What that means in practice.
- UK GDPR
- DPO
4 min read
Moving ISO 27701 from the 2019 edition to 2025 by 31 October 2028
By Alfred Obeng, Founder, Goldline Consultancy
CISSP | Project Management Professional (PMP)® | ISO 27001 LI & LA | ISO 42001 LI & LA
ISO/IEC 27701:2025 is now a standalone management system standard. What changed from 2019, the UKAS transition deadline, and how to plan the move.
- ISO 27701
3 min read
SOC 2 cost in the UK: what affects the fees?
By Alfred Obeng, Founder and Principal Consultant
CISSP | Project Management Professional (PMP)® | ISO 27001 LI & LA | ISO 42001 LI & LA
SOC 2 cost for UK companies: readiness, the CPA firm's fee, internal time, remediation and tooling. Goldline's SOC 2 Readiness Sprint: £7,000 plus VAT.
- SOC 2
8 min read
DCC Level 0 scope: what counts as an essential function
By Alfred Obeng, Founder, Goldline Consultancy
CISSP | Project Management Professional (PMP)® | ISO 27001 LI & LA | ISO 42001 LI & LA
What goes inside a DCC Level 0 scope, what you can leave out, how it fits your Cyber Essentials scope, and the worksheet to settle it. Read 28 Oct 2026.
- DCC
- Cyber Essentials
- Defence
11 min read
What is DEFCON 658? A guide for UK Tier 2 and Tier 3 suppliers
By Alfred Obeng, Founder, Goldline Consultancy
ISO 42001 Lead Implementer (PECB) · ISO 42001 Lead Auditor (PECB) · ISO 27001 Senior Lead Implementer (PECB) · ISO 27001 Lead Auditor (PECB) · CISSP · Project Management Professional (PMP)®
What DEFCON 658 asks of UK Tier 2 and Tier 3 defence suppliers: Cyber Risk Profiles, the SAQ, the Cyber Improvement Plan and what to check in your contract.
- DEFCON 658
- Defence
- DEFSTAN 05-138
- MOD
12 min read
DEF STAN 05-138 risk profiles explained: Levels 0 to 3
By Alfred Obeng, Founder, Goldline Consultancy
ISO 42001 Lead Implementer (PECB) · ISO 42001 Lead Auditor (PECB) · ISO 27001 Senior Lead Implementer (PECB) · ISO 27001 Lead Auditor (PECB) · CISSP · Project Management Professional (PMP)®
The four Cyber Risk Profiles in Def Stan 05-138 Issue 4, from Level 0 to Level 3: control counts, Cyber Essentials needs, and what to check in your contract.
- DEFSTAN 05-138
- Defence
- DCC
- ISO 27001
12 min read
How to Choose an ISO 42001 Consultant in the UK
By Alfred Obeng, Founder, Goldline Consultancy
ISO 42001 Lead Implementer (PECB) · ISO 42001 Lead Auditor (PECB) · ISO 27001 Senior Lead Implementer (PECB) · ISO 27001 Lead Auditor (PECB) · CISSP · Project Management Professional (PMP)®
What an ISO 42001 consultant can and cannot do, the checks to run before you appoint one, and what a competent AI management system implementation produces.
- ISO 42001
- AI Governance
- Procurement
10 min read
How to choose and book an ISO 27001 certification body
By Alfred Obeng, Founder and Principal Consultant
CISSP | Project Management Professional (PMP)® | ISO 27001 LI & LA | ISO 42001 LI & LA
Check a certification body's UKAS accreditation, shortlist, request written quotes and book Stage 1 and Stage 2. A UK buyer's guide. Goldline does not certify.
- ISO 27001
- Certification
- UKAS
10 min read
How to Choose an ISO 27001 Consultant in the UK
By Alfred Obeng, Founder and Principal Consultant
CISSP | Project Management Professional (PMP)® | ISO 27001 LI & LA | ISO 42001 LI & LA
How to choose an ISO 27001 consultant in the UK: what a consultant does, who certifies, and a checklist for comparing proposals before you appoint.
- ISO 27001
- Procurement
4 min read
Can an ISO 27001 consultant certify you?
By Alfred Obeng, Founder and Principal Consultant
CISSP | Project Management Professional (PMP)® | ISO 27001 LI & LA | ISO 42001 LI & LA
No. A consultant gets you ready; only an accredited certification body issues the certificate. What ISO/IEC 17021-1 says, and how to check a certificate.
- ISO 27001
- Certification
4 min read
ISO 27001 on your own or with a consultant?
By Alfred Obeng, Founder and Principal Consultant
CISSP | Project Management Professional (PMP)® | ISO 27001 LI & LA | ISO 42001 LI & LA
You can implement ISO 27001 without a consultant. What the work is either way, what does not change, and the published options if you build it yourself.
- ISO 27001
- Implementation
7 min read
ISO 27001 or Cyber Essentials? Which one your UK business needs in 2026
By Alfred Obeng, Founder, Goldline Consultancy
ISO 42001 Lead Implementer (PECB) · ISO 42001 Lead Auditor (PECB) · ISO 27001 Senior Lead Implementer (PECB) · ISO 27001 Lead Auditor (PECB) · CISSP · Project Management Professional (PMP)®
ISO 27001 or Cyber Essentials? Which one UK buyers ask for, what changed in Cyber Essentials v3.3 in April 2026, what each costs and how long each takes.
- ISO 27001
- Cyber Essentials
- Procurement
6 min read
How long does ISO 27001 take?
By Alfred Obeng, Founder and Principal Consultant
CISSP | Project Management Professional (PMP)® | ISO 27001 LI & LA | ISO 42001 LI & LA
A typical single-entity ISO 27001 project reaches audit-ready in 8 to 12 weeks. What that assumes, what moves you to 12 to 24 weeks, and what the certification body decides.
- ISO 27001
- Implementation
- Timeline
10 min read
ISO 42001 for UK Public Sector Suppliers: Transparency Records, Procurement, and the Accountability Question
By Alfred Obeng, Founder, Goldline Consultancy
ISO 42001 Lead Implementer (PECB) · ISO 42001 Lead Auditor (PECB) · ISO 27001 Senior Lead Implementer (PECB) · ISO 27001 Lead Auditor (PECB) · CISSP · Project Management Professional (PMP)®
What central government AI transparency obligations mean for suppliers and how AI governance appears in public procurement.
- ISO 42001
- AI Governance
- Public Sector
10 min read
ISO 42001 for Recruitment and HR Technology: The Highest-Risk AI Category Nobody Planned For
By Alfred Obeng, Founder, Goldline Consultancy
ISO 42001 Lead Implementer (PECB) · ISO 42001 Lead Auditor (PECB) · ISO 27001 Senior Lead Implementer (PECB) · ISO 27001 Lead Auditor (PECB) · CISSP · Project Management Professional (PMP)®
Employment and worker management AI is named as high-risk under the EU AI Act. What that means for UK recruitment and HR tech, alongside Equality Act and the Information Commission (formerly the Information Commissioner's Office, ICO) exposure.
- ISO 42001
- AI Governance
- HR Technology
10 min read
Running a DPIA and an AI Impact Assessment as One Exercise
By Alfred Obeng, Founder, Goldline Consultancy
ISO 42001 Lead Implementer · ISO 42001 Lead Auditor · ISO 27001 Senior Lead Implementer · ISO 27001 Lead Auditor · CISSP · Project Management Professional (PMP)®
UK GDPR requires a DPIA. ISO 42001 requires an AI impact assessment. The EU AI Act adds a FRIA. Where they overlap, and how to run them once.
- AI Governance
- Data Protection
- ISO 42001
10 min read
ISO 42001 for UK Healthtech: MHRA, Clinical Safety, and NHS Procurement
By Alfred Obeng, Founder, Goldline Consultancy
ISO 42001 Lead Implementer (PECB) · ISO 42001 Lead Auditor (PECB) · ISO 27001 Senior Lead Implementer (PECB) · ISO 27001 Lead Auditor (PECB) · CISSP · Project Management Professional (PMP)®
Where AI governance sits alongside medical device regulation, DCB clinical safety standards, and NHS procurement requirements for UK healthtech suppliers.
- ISO 42001
- AI Governance
- Healthtech
6 min read
Does PPN 014 require Cyber Essentials?
By Alfred Obeng, Founder, Goldline Consultancy
ISO 42001 Lead Implementer (PECB) · ISO 42001 Lead Auditor (PECB) · ISO 27001 Senior Lead Implementer (PECB) · ISO 27001 Lead Auditor (PECB) · CISSP · Project Management Professional (PMP)®
It requires it, and in the same sentence it expressly accepts equivalent controls instead. Both halves of that are in the primary text.
- Cyber Essentials
- Public Procurement
6 min read
Does Microsoft's SSPA require ISO 42001?
By Alfred Obeng, Founder, Goldline Consultancy
ISO 42001 Lead Implementer (PECB) · ISO 42001 Lead Auditor (PECB) · ISO 27001 Senior Lead Implementer (PECB) · ISO 27001 Lead Auditor (PECB) · CISSP · Project Management Professional (PMP)®
No. It names ISO 42001 as one of exactly two ways to satisfy a requirement it does make, and that requirement is a great deal more specific than most suppliers realise.
- ISO 42001
- AI Governance
10 min read
How to Answer the AI Section of an Enterprise Security Questionnaire
By Alfred Obeng, Founder, Goldline Consultancy
ISO 42001 Lead Implementer · ISO 42001 Lead Auditor · ISO 27001 Senior Lead Implementer · ISO 27001 Lead Auditor · CISSP · Project Management Professional (PMP)®
Enterprise vendor assessments now carry dedicated AI domains. What CAIQ, SIG and sector instruments actually ask, and the artefacts that answer them.
- AI Governance
- Enterprise Procurement
- ISO 42001
11 min read
Second-Party AI Vendor Audit versus a Supplier Questionnaire
By Alfred Obeng, Founder, Goldline Consultancy
ISO 42001 Lead Implementer (PECB) · ISO 42001 Lead Auditor (PECB) · ISO 27001 Senior Lead Implementer (PECB) · ISO 27001 Lead Auditor (PECB) · CISSP · Project Management Professional (PMP)®
A questionnaire is the supplier's account of itself. An audit tests it against evidence. When the second instrument earns its cost, and when it does not.
- AI Governance
- ISO 42001
- Enterprise Procurement
- Supplier Assurance
10 min read
ISO 42001 for UK Financial Services: FCA Expectations, Consumer Duty, and Automated Decisioning
By Alfred Obeng, Founder, Goldline Consultancy
ISO 42001 Lead Implementer (PECB) · ISO 42001 Lead Auditor (PECB) · ISO 27001 Senior Lead Implementer (PECB) · ISO 27001 Lead Auditor (PECB) · CISSP · Project Management Professional (PMP)®
How FCA-regulated firms are being asked about AI governance, where Consumer Duty and SM&CR create accountability exposure, and what ISO 42001 evidences. From £2,500.
- ISO 42001
- AI Governance
- Financial Services
8 min read
EU AI Act Article 53 Binds Model Providers, Not Organisations Using Third-Party Models
By Alfred Obeng, Founder, Goldline Consultancy
ISO 42001 Lead Implementer · ISO 42001 Lead Auditor · ISO 27001 Senior Lead Implementer · ISO 27001 Lead Auditor · CISSP · Project Management Professional (PMP)®
Article 53 general purpose AI obligations apply to model providers. Organisations deploying third-party models are not caught, though buyers still ask the provenance question.
- AI Governance
- EU AI Act
- ISO 42001
9 min read
DEFCON 658 versus Def Stan 05-138
By Alfred Obeng, Founder, Goldline Consultancy
ISO 42001 Lead Implementer (PECB) · ISO 42001 Lead Auditor (PECB) · ISO 27001 Senior Lead Implementer (PECB) · ISO 27001 Lead Auditor (PECB) · CISSP · Project Management Professional (PMP)®
One is the contract clause that binds you. The other is the control set you are bound to. Confusing them is why suppliers buy the certificate before doing the thing the contract actually asks for.
- Defence
- DEFCON 658
- DEFSTAN 05-138
- Cyber Security Model
8 min read
DCC versus Cyber Essentials
By Alfred Obeng, Founder, Goldline Consultancy
ISO 42001 Lead Implementer (PECB) · ISO 42001 Lead Auditor (PECB) · ISO 27001 Senior Lead Implementer (PECB) · ISO 27001 Lead Auditor (PECB) · CISSP · Project Management Professional (PMP)®
It is not a choice. Cyber Essentials is a prerequisite for every level of Defence Cyber Certification, and Cyber Essentials Plus for Levels 2 and 3. What each one actually measures.
- Defence
- DCC
- Cyber Essentials
- DEFSTAN 05-138
7 min read
What DCC Level 2 Requires That Level 1 Does Not
By Alfred Obeng, Founder, Goldline Consultancy
ISO 42001 Lead Implementer (PECB) · ISO 42001 Lead Auditor (PECB) · ISO 27001 Senior Lead Implementer (PECB) · ISO 27001 Lead Auditor (PECB) · CISSP · Project Management Professional (PMP)®
The obvious answer is thirty eight controls. The expensive answer is that you cannot upgrade, Cyber Essentials Plus becomes a prerequisite, and the assessor starts looking for governance.
- Defence
- DCC
- DEFSTAN 05-138
- Cyber Essentials
8 min read
DCC versus JOSCAR
By Alfred Obeng, Founder, Goldline Consultancy
ISO 42001 Lead Implementer (PECB) · ISO 42001 Lead Auditor (PECB) · ISO 27001 Senior Lead Implementer (PECB) · ISO 27001 Lead Auditor (PECB) · CISSP · Project Management Professional (PMP)®
One is a certification against a defence standard, owned by the MOD. The other is a commercially operated supplier data platform. Neither substitutes for the other, and different people decide whether you need each.
- Defence
- DCC
- JOSCAR
- Supply Chain
8 min read
Choosing a DCC Certification Body
By Alfred Obeng, Founder, Goldline Consultancy
ISO 42001 Lead Implementer (PECB) · ISO 42001 Lead Auditor (PECB) · ISO 27001 Senior Lead Implementer (PECB) · ISO 27001 Lead Auditor (PECB) · CISSP · Project Management Professional (PMP)®
One rule matters more than price or availability. Your certification body can advise you or assess you, not both, and IASME write that separation into the scheme rather than leaving it to conscience.
- Defence
- DCC
- Certification
- DEFSTAN 05-138
7 min read
Who Can Issue an ISO 42001 Certificate in the UK?
By Alfred Obeng, Founder, Goldline Consultancy
ISO 42001 Lead Implementer (PECB) · ISO 42001 Lead Auditor (PECB) · ISO 27001 Senior Lead Implementer (PECB) · ISO 27001 Lead Auditor (PECB) · CISSP · Project Management Professional (PMP)®
Anyone can issue a certificate. Accredited certification is a different thing, it was unavailable for twenty five months, and no published list stays current. How to check the register yourself.
- ISO 42001
- Certification
- UKAS
- AI Governance
7 min read
What ISO 42001 Costs in the UK
By Alfred Obeng, Founder, Goldline Consultancy
ISO 42001 Lead Implementer (PECB) · ISO 42001 Lead Auditor (PECB) · ISO 27001 Senior Lead Implementer (PECB) · ISO 27001 Lead Auditor (PECB) · CISSP · Project Management Professional (PMP)®
Four different costs with four different owners, and only two of them are published by anyone. How to separate them, and the two variables that actually move your total.
- ISO 42001
- Pricing
- Certification
- AI Governance
6 min read
What ISO 19011 Requires of an Internal Auditor
By Alfred Obeng, Founder, Goldline Consultancy
ISO 42001 Lead Implementer (PECB) · ISO 42001 Lead Auditor (PECB) · ISO 27001 Senior Lead Implementer (PECB) · ISO 27001 Lead Auditor (PECB) · CISSP · Project Management Professional (PMP)®
Strictly, nothing. It is guidance, not requirements. And the edition most procedures name was withdrawn in May 2026. What actually binds you, and what an internal auditor genuinely needs.
- Internal Audit
- ISO 42001
- ISO 27001
- Certification
7 min read
What a Stage 2 Auditor Asks About Clause 9.2
By Alfred Obeng, Founder, Goldline Consultancy
ISO 42001 Lead Implementer (PECB) · ISO 42001 Lead Auditor (PECB) · ISO 27001 Senior Lead Implementer (PECB) · ISO 27001 Lead Auditor (PECB) · CISSP · Project Management Professional (PMP)®
Seven questions your internal audit programme has to answer, in the order they become answerable, and the three patterns that draw the most attention.
- Internal Audit
- ISO 42001
- Certification
- ISO 27001
6 min read
ISO 42001 Internal Audit versus Pre-Certification Readiness Audit
By Alfred Obeng, Founder, Goldline Consultancy
ISO 42001 Lead Implementer (PECB) · ISO 42001 Lead Auditor (PECB) · ISO 27001 Senior Lead Implementer (PECB) · ISO 27001 Lead Auditor (PECB) · CISSP · Project Management Professional (PMP)®
Bought at the same point, priced by scope, and routinely assumed to be the same thing. One discharges clause 9.2. The other cannot, and the sequencing is where the money leaks.
- Internal Audit
- ISO 42001
- Certification
6 min read
Readiness Assessment, Internal Audit, Certification Audit: Three Different Things
By Alfred Obeng, Founder, Goldline Consultancy
ISO 42001 Lead Implementer (PECB) · ISO 42001 Lead Auditor (PECB) · ISO 27001 Senior Lead Implementer (PECB) · ISO 27001 Lead Auditor (PECB) · CISSP · Project Management Professional (PMP)®
Three exercises, three purposes, three different answers to who is allowed to perform them. The test that cuts through it is asking what the report is evidence of, and to whom.
- Certification
- Internal Audit
- ISO 27001
- ISO 42001
8 min read
Can the Consultancy That Built Your AIMS Also Audit It?
By Alfred Obeng, Founder, Goldline Consultancy
ISO 42001 Lead Implementer (PECB) · ISO 42001 Lead Auditor (PECB) · ISO 27001 Senior Lead Implementer (PECB) · ISO 27001 Lead Auditor (PECB) · CISSP · Project Management Professional (PMP)®
The rule everyone quotes is about your certification body, not your consultant. What ISO/IEC 17021-1 actually restricts, and where the real constraint lands.
- ISO 42001
- Internal Audit
- Certification
- AI Governance
9 min read
Why a GRC Platform Is Not an AI Management System
By Alfred Obeng, Founder, Goldline Consultancy
ISO 42001 Lead Implementer (PECB) · ISO 42001 Lead Auditor (PECB) · ISO 27001 Senior Lead Implementer (PECB) · ISO 27001 Lead Auditor (PECB) · CISSP · Project Management Professional (PMP)®
What compliance platforms do well for ISO 42001, what they cannot do, and where the practitioner work actually sits.
- ISO 42001
- AI Governance
- GRC
9 min read
Defence Cyber Certification: the four levels, and what each one actually asks
By Alfred Obeng, Founder, Goldline Consultancy
ISO 42001 Lead Implementer · ISO 42001 Lead Auditor · ISO 27001 Senior Lead Implementer · ISO 27001 Lead Auditor · CISSP · Project Management Professional (PMP)®
The four levels, the control counts, and the three things that catch suppliers out.
- Defence
- DCC
- DEFCON 658
- DEFSTAN 05-138
10 min read
Why ISO 42001 Certification Does Not Answer an AI Security Questionnaire
By Alfred Obeng, Founder, Goldline Consultancy
ISO 42001 Lead Implementer · ISO 42001 Lead Auditor · ISO 27001 Senior Lead Implementer · ISO 27001 Lead Auditor · CISSP · Project Management Professional (PMP)®
ISO 42001 certifies a management system. Enterprise AI questionnaires ask for artefacts the standard does not require. What the gap is, and what closes it.
- ISO 42001
- AI Governance
- Enterprise Procurement
9 min read
ISO 42001 vs NIST AI RMF: Which AI Governance Framework Your Buyers Actually Want
By Alfred Obeng, Founder, Goldline Consultancy
ISO 42001 Lead Implementer (PECB) · ISO 42001 Lead Auditor (PECB) · ISO 27001 Senior Lead Implementer (PECB) · ISO 27001 Lead Auditor (PECB) · CISSP · Project Management Professional (PMP)®
A certifiable international standard and a voluntary US framework. What each covers, which buyers recognise which, and when holding both makes sense.
- AI Governance
- ISO 42001
- NIST AI RMF
10 min read
NHS Digital Assurance Is Moving Beyond DTAC: What AI Vendors Need
By Alfred Obeng, Founder, Goldline Consultancy
ISO 42001 Lead Implementer · ISO 42001 Lead Auditor · ISO 27001 Senior Lead Implementer · ISO 27001 Lead Auditor · CISSP · Project Management Professional (PMP)®
NHS digital assurance is shifting from a single DTAC pack toward framework-specific routes. What AI vendors bidding into the NHS should prepare, and what to verify.
- AI Governance
- Healthtech
- NHS
12 min read
ISO 42001 and the EU AI Act: What the Standard Covers and What It Does Not
By Alfred Obeng, Founder, Goldline Consultancy
ISO 42001 Lead Implementer (PECB) · ISO 42001 Lead Auditor (PECB) · ISO 27001 Senior Lead Implementer (PECB) · ISO 27001 Lead Auditor (PECB) · CISSP · Project Management Professional (PMP)®
Where ISO 42001 supports EU AI Act readiness, which obligations the standard does not reach, and how to sequence a compliance programme against the enforcement timetable.
- AI Governance
- ISO 42001
- EU AI Act
9 min read
Microsoft's Supplier Requirements Put ISO 42001 on the Table for AI Suppliers
By Alfred Obeng, Founder, Goldline Consultancy
ISO 42001 Lead Implementer · ISO 42001 Lead Auditor · ISO 27001 Senior Lead Implementer · ISO 27001 Lead Auditor · CISSP · Project Management Professional (PMP)®
Microsoft's Supplier Data Protection Requirements v12 add a dedicated AI section and accept ISO 42001 as an assurance route. What that means for AI suppliers.
- AI Governance
- ISO 42001
- Enterprise Procurement
10 min read
ISO 42001 on a GRC platform: how the management system layers onto the platform
By Alfred Obeng, Founder, Goldline Consultancy
ISO 42001 Lead Implementer (PECB) · ISO 42001 Lead Auditor (PECB) · ISO 27001 Senior Lead Implementer (PECB) · ISO 27001 Lead Auditor (PECB) · CISSP · Project Management Professional (PMP)®
How an AI management system layers onto a GRC platform, which evidence can be reused and where AI-specific work is still needed.
- ISO 42001
- AI Governance
- GRC Platform
11 min read
ISO 27001 vs ISO 42001: What Each Standard Actually Governs
By Alfred Obeng, Founder, Goldline Consultancy
ISO 42001 Lead Implementer (PECB) · ISO 42001 Lead Auditor (PECB) · ISO 27001 Senior Lead Implementer (PECB) · ISO 27001 Lead Auditor (PECB) · CISSP · Project Management Professional (PMP)®
The practical difference between an information security management system and an AI management system, where the controls overlap, and which one to implement first.
- ISO 42001
- ISO 27001
- AI Governance
9 min read
ISO 42001 for UK SaaS at Series A: What Changes When You Raise
By Alfred Obeng, Founder, Goldline Consultancy
ISO 42001 Lead Implementer (PECB) · ISO 42001 Lead Auditor (PECB) · ISO 27001 Senior Lead Implementer (PECB) · ISO 27001 Lead Auditor (PECB) · CISSP · Project Management Professional (PMP)®
UK SaaS Series A and AI governance maturity. What investors ask, what enterprise procurement exposes, and why ISO 42001 before the gate beats ISO 42001 after.
- ISO 42001
- AI Governance
- UK SaaS
- Series A
11 min read
EU AI Act for UK SaaS Founders: August 2026 in Practical Terms
By Alfred Obeng, Founder, Goldline Consultancy
ISO 42001 Lead Implementer (PECB) · ISO 42001 Lead Auditor (PECB) · ISO 27001 Senior Lead Implementer (PECB) · ISO 27001 Lead Auditor (PECB) · CISSP · Project Management Professional (PMP)®
UK SaaS founder selling into EU customers? Practitioner read on what changes 2 August 2026, how the Digital Omnibus moved the high-risk dates, and where ISO 42001 fits.
- EU AI Act
- ISO 42001
- AI Governance
- UK SaaS
10 min read
Running SOC 2 and ISO 27001 in Parallel: A UK Scaleup Playbook for 2026
By Alfred Obeng, Founder, Goldline Consultancy
ISO 42001 Lead Implementer (PECB) · ISO 42001 Lead Auditor (PECB) · ISO 27001 Senior Lead Implementer (PECB) · ISO 27001 Lead Auditor (PECB) · CISSP · Project Management Professional (PMP)®
UK scaleup running SOC 2 and ISO 27001 together? Practitioner playbook on overlap, sequencing, GRC platform choice, audit timing, and what stops most teams.
- SOC 2
- ISO 27001
- Scaleup
- GRC Platform
10 min read
Board-Ready Cyber Governance: The DSIT Cyber Governance Code in Practice (2026)
By Alfred Obeng, Founder, Goldline Consultancy
ISO 42001 Lead Implementer (PECB) · ISO 42001 Lead Auditor (PECB) · ISO 27001 Senior Lead Implementer (PECB) · ISO 27001 Lead Auditor (PECB) · CISSP · Project Management Professional (PMP)®
UK Cyber Governance Code of Practice for boards. Senior practitioner read on what the DSIT Code requires, board accountability, and building board-ready governance.
- ISO 27001
- AI Governance
- Mid-Market
- Board Governance
8 min read
Third-Party Risk Management for BoG-Regulated Institutions
By Alfred Obeng, Founder, Goldline Consultancy
ISO 42001 Lead Implementer (PECB) · ISO 42001 Lead Auditor (PECB) · ISO 27001 Senior Lead Implementer (PECB) · ISO 27001 Lead Auditor (PECB) · CISSP · Project Management Professional (PMP)®
Third-party risk is the most common BoG CISD gap. Practitioner guide to supplier risk programmes that satisfy BoG supervisory and ISO 27001 audit expectations.
- Bank of Ghana
- CISD
- Third-Party Risk
- ISO 27001
11 min read
JOSCAR Stage 2: What UK Tier-2 Defence SMEs Miss
By Alfred Obeng, Founder, Goldline Consultancy
ISO 42001 Lead Implementer (PECB) · ISO 42001 Lead Auditor (PECB) · ISO 27001 Senior Lead Implementer (PECB) · ISO 27001 Lead Auditor (PECB) · CISSP · Project Management Professional (PMP)®
JOSCAR Stage 2 explained for UK tier-2 defence SMEs. The cyber security module, the evidence gaps, and the seven-question readiness checklist.
- JOSCAR
- Defence
- ISO 27001
- Cyber Essentials Plus
9 min read
ISO 27001 for Ghanaian Fintechs: The International Contract Unlock
By Alfred Obeng, Founder, Goldline Consultancy
ISO 42001 Lead Implementer (PECB) · ISO 42001 Lead Auditor (PECB) · ISO 27001 Senior Lead Implementer (PECB) · ISO 27001 Lead Auditor (PECB) · CISSP · Project Management Professional (PMP)®
Why UK and EU enterprise buyers require ISO 27001 from Ghanaian fintechs. Practitioner guide to certification for international SaaS contract pipelines.
- ISO 27001
- Ghana
- Fintech
- Enterprise Sales
11 min read
Cyber Security and Resilience Bill: what UK organisations need to know
By Alfred Obeng, Founder and Principal Consultant
CISSP | Project Management Professional (PMP)® | ISO 27001 LI & LA | ISO 42001 LI & LA
The CSRB is the UK's response to NIS2. What it means for UK essential service operators, managed service providers, data centres, and how it intersects with ISO 27001.
- Regulation
- CSRB
- NIS2
11 min read
EU AI Act enforcement timeline for UK organisations
By Alfred Obeng, Founder and Principal Consultant
CISSP | Project Management Professional (PMP)® | ISO 27001 LI & LA | ISO 42001 LI & LA
UK organisations selling AI products into the EU are in scope of the EU AI Act. The enforcement timeline, key milestones, the Digital Omnibus deferral question, and what to do now.
- ISO 42001
- EU AI Act
- AI Governance
10 min read
ISO 27001 Stage 1 vs Stage 2 audits: what to expect
By Alfred Obeng, Founder and Principal Consultant
CISSP | Project Management Professional (PMP)® | ISO 27001 LI & LA | ISO 42001 LI & LA
The difference between Stage 1 and Stage 2 certification audits, what auditors actually look for, common nonconformities, and how to avoid them.
- ISO 27001
- Audit
- Certification
11 min read
How ISO 27001 Implementation Satisfies BoG CISD Requirements
By Alfred Obeng, Founder, Goldline Consultancy
ISO 42001 Lead Implementer (PECB) · ISO 42001 Lead Auditor (PECB) · ISO 27001 Senior Lead Implementer (PECB) · ISO 27001 Lead Auditor (PECB) · CISSP · Project Management Professional (PMP)®
How ISO 27001 Annex A controls map to Bank of Ghana CISD requirements. Single-engagement compliance and certification for BoG-regulated institutions.
- ISO 27001
- Bank of Ghana
- CISD
- Ghana
9 min read
JOSCAR ISO 27001 Requirements Explained
By Alfred Obeng, Founder and Principal Consultant
CISSP | Project Management Professional (PMP)® | ISO 27001 LI & LA | ISO 42001 LI & LA
How JOSCAR assessors evaluate ISO 27001 evidence and what that means for defence supply chain bidders preparing for reassessment.
- JOSCAR
- ISO 27001
- Defence
11 min read
The UK Cyber Security and Resilience Bill: A Practical Guide
By Alfred Obeng, Founder and Principal Consultant
CISSP | Project Management Professional (PMP)® | ISO 27001 LI & LA | ISO 42001 LI & LA
What the incoming UK Cyber Security and Resilience Bill means for defence suppliers, regulated enterprise, and central government, and how to prepare your governance posture now.
- Regulation
- CSRB
- Defence
12 min read
Bank of Ghana CISD: A Practitioner Guide for Regulated Institutions
By Alfred Obeng, Founder, Goldline Consultancy
ISO 42001 Lead Implementer (PECB) · ISO 42001 Lead Auditor (PECB) · ISO 27001 Senior Lead Implementer (PECB) · ISO 27001 Lead Auditor (PECB) · CISSP · Project Management Professional (PMP)®
Practitioner guide to the Bank of Ghana Cyber and Information Security Directive. Scope, five domains, enforcement, and ISO 27001 alignment for regulated institutions.
- Bank of Ghana
- CISD
- ISO 27001
- Ghana
9 min read
The First Enterprise Security Questionnaire: A UK SaaS Founder's Survival Guide for 2026
By Alfred Obeng, Founder, Goldline Consultancy
ISO 42001 Lead Implementer (PECB) · ISO 42001 Lead Auditor (PECB) · ISO 27001 Senior Lead Implementer (PECB) · ISO 27001 Lead Auditor (PECB) · CISSP · Project Management Professional (PMP)®
First enterprise security questionnaire paused your UK SaaS deal? Practitioner read on what enterprises actually ask, why your deal stalled, and how to clear the gate.
- SOC 2
- ISO 27001
- Startup
- Enterprise Sales
10 min read
ISO 27001 vs Cyber Essentials Plus: What Really Differs
By Alfred Obeng, Founder and Principal Consultant
CISSP | Project Management Professional (PMP)® | ISO 27001 LI & LA | ISO 42001 LI & LA
The real difference between the two UK cyber standards, the twenty-three-control overlap, and realistic CE Plus to ISO 27001 timelines for SMEs.
- ISO 27001
- Cyber Essentials
11 min read
ISO 27001 for UK Defence Suppliers: The Practical Guide
By Alfred Obeng, Founder and Principal Consultant
CISSP | Project Management Professional (PMP)® | ISO 27001 LI & LA | ISO 42001 LI & LA
Why MOD prime contractors are mandating ISO 27001, what JOSCAR expects, how to budget and plan an implementation from a Cyber Essentials Plus baseline.
- ISO 27001
- Defence
- JOSCAR
New insights every month. No newsletter yet. We would rather write fewer better pieces than fill an inbox. Bookmark the page or follow us on LinkedIn.
JOSCAR RegisteredCyber Essentials Plus CertifiedFounder-Led Delivery
