Predictability
A defined nineteen-activity structure means scope, sequencing, and outputs are knowable on day one. Procurement, finance, and the audit committee see the same plan.
A structured nineteen-activity methodology
Every Goldline ISO 27001 engagement runs through a defined nineteen-activity methodology across four phases. AI-accelerated where leverage is available; senior practitioner judgement where it is required.
Methodology overview
The methodology is organised into four phases: Define and Establish, Implement and Operate, Monitor and Review, and Maintain and Improve. Nineteen discrete activities sit within these phases, each with a defined input, output, and senior practitioner intervention point.
Phase 1: Define and Establish
Scope, context, governance baseline, leadership engagement, risk methodology selection, and ISMS boundary definition.
Phase 2: Implement and Operate
Risk assessment, Statement of Applicability, control treatment, policy authoring, evidence design, and operational embedding.
Phase 3: Monitor and Review
Internal audit, management review, performance evaluation, corrective action, and Stage 1 readiness validation.
Phase 4: Maintain and Improve
Surveillance preparation, control change management, recertification planning, and continual improvement loop.
Methodology infographic
19-activity methodology infographic
Why structured methodology matters
Audit-readiness
Every activity produces an artefact a certification body expects to see. The evidence pack is built as the work happens, not assembled at the end.
AI-acceleration leverage
Mechanical activities, evidence collection, control mapping, policy drafting, are accelerated through proprietary AI tooling. Senior practitioner judgement is reserved for the activities that require it.
Frameworks this methodology supports
ISO 27001, ISO 42001, SOC 2 (with adaptations for AICPA Trust Services Criteria), Cyber Essentials Plus, Defence Cyber Certification (DCC), and GDPR.