Built for AI startups. Leicester-based.Built for AI startups. Leicester-based.
First 30 days free. Flexible payments.
ISO 42001, ISO 27001 or SOC 2 readiness for UK startups of up to 50 people, as one Startup Compliance Sprint. A free 45 minute diagnostic with a senior practitioner. No pitch.
ISO 42001 Lead Implementer and Lead Auditor, ISO 27001 Senior Lead Implementer and Lead Auditor, CISSP.
Trusted by
WHO WE WORK WITH
Your first certificate
Usually owned by: the founder or CTO
Early stageOne security lead, a growing list of asks
Usually owned by: a Head of Security or IT, often working alone
ScalingEvidence that holds across the group
Usually owned by: the CISO, CIO, or Head of GRC, Compliance or Risk
EstablishedTWO WAYS IN
Get ready to apply for Cyber Essentials with a certification body.
ISO 27001, ISO 42001 or SOC 2, as one Startup Compliance Sprint.
From £7,000 fixed, plus VAT
See the SprintHOW IT RUNS
One management system, built with your named owner, from scope to independent assessment.
Before Phase 1: a free 45 minute diagnostic with a senior practitioner. You leave with a written note the same day, yours to keep whether or not you buy anything.
PHASE 01
We agree your boundary and assess the controls against where you are today.
You get: a gap register with an owner and a date on every line, and a drafted Statement of Applicability.
PHASE 02
We build the policies, procedures and evidence with the people who will maintain them.
You get: policies, procedures and the records that evidence them.
PHASE 03
The clause 9.2 internal audit and the management review happen before Stage 2. The internal audit is carried out by our audit partner.
You get: the internal audit and management review, completed and evidenced.
PHASE 04
A senior practitioner supports your independent ISO assessments, with Stage 1 findings closed before Stage 2.
You get: Stage 1 findings closed before Stage 2, with a senior practitioner in the room.
PHASE 01
We agree your boundary and assess the controls against where you are today.
You get: a gap register with an owner and a date on every line, and a drafted Statement of Applicability.
PHASE 02
We build the policies, procedures and evidence with the people who will maintain them.
You get: policies, procedures and the records that evidence them.
PHASE 03
The clause 9.2 internal audit and the management review happen before Stage 2. The internal audit is carried out by our audit partner.
You get: the internal audit and management review, completed and evidenced.
PHASE 04
A senior practitioner supports your independent ISO assessments, with Stage 1 findings closed before Stage 2.
You get: Stage 1 findings closed before Stage 2, with a senior practitioner in the room.
PHASE 01
We agree your boundary and assess the controls against where you are today.
You get: a gap register with an owner and a date on every line, and a drafted Statement of Applicability.
PHASE 02
We build the policies, procedures and evidence with the people who will maintain them.
You get: policies, procedures and the records that evidence them.
PHASE 03
The clause 9.2 internal audit and the management review happen before Stage 2. The internal audit is carried out by our audit partner.
You get: the internal audit and management review, completed and evidenced.
PHASE 04
A senior practitioner supports your independent ISO assessments, with Stage 1 findings closed before Stage 2.
You get: Stage 1 findings closed before Stage 2, with a senior practitioner in the room.
After certification. Managed compliance: surveillance audits, the annual cycle, questionnaire responses and governance upkeep. Priced separately, and only if you want it.
Your diagnostic sets the timetable. Certification body fees are separate and paid to the body.
Goldline Consultancy Ltd · Companies House 10901798
FREE TOOL
An instant fixed Sprint figure, plus an estimate of what your certification body will charge on top.
GRC PLATFORMS
Goldline never sells implementation and certification to the same organisation for the same scope. The internal audit in every Sprint is carried out by our audit partner.
A GRC platform automates evidence collection and continuous control monitoring, and it does that well. It does not write your Statement of Applicability, run your risk assessment, or sit in the room at Stage 2. Set up on a GRC platform, licence bought direct.
See our platform and certification partners
For ISO 27001 and ISO 42001, certification body audit fees are separate and paid to the body. For SOC 2, the CPA firm's fee is separate and paid to the firm.
INSIGHTS
Practitioner writing on AI governance, information security, and the regulatory pressure UK organisations are now navigating.
8 min read
What the ISO 42001 standard requires, what credentials to verify, and how to assess AI governance delivery capability before you engage.
10 min read
How ISO 42001 maps to the EU AI Act's high-risk obligations, and what a board-ready AI assurance programme looks like.
9 min read
Honest timelines for ISO 27001:2022 implementation calibrated by an ISO 27001 Lead Implementer (PECB). The factors that determine how long an implementation runs.
FREQUENTLY ASKED
FRAMEWORKS WE WORK IN
Goldline prepares organisations for assessment. Certificates are issued by accredited certification bodies.
Senior practitioner conversation about your AI governance or information security programme. ISO 42001, ISO 27001, or both. No sales pitch. No follow-up sequence unless you ask.
Or email info@goldlineconsultancy.co.uk
We use cookies and similar technologies to measure how this site is used, to see which organisations visit and to measure our advertising. Until you choose, Google tags run in a consent-limited mode that sets no cookies. If you accept, we load Google Analytics 4 and Google Ads with cookies, PostHog, Plausible, Microsoft Clarity, which records session replays, and Apollo. Read our Cookies policy.
