GRC PLATFORM IMPLEMENTATION
ISO 27001 and ISO 42001, built inside your GRC platform account.
Goldline sets the scope, writes the risk assessment, Statement of Applicability and policies, and configures the platform around them, so the evidence it collects is the evidence your auditor asks for.
For any company that has bought a GRC platform and needs someone to build the management system behind it: scope, risk assessment, Statement of Applicability and policies, from a first hire to several hundred people.
Already on a platform and not audit-ready? Platform Rescue
- Cyber Essentials Plus Certified
- JOSCAR Registered
- Companies House 10901798
WHAT'S INCLUDED
What the GRC platform implementation includes
Six elements. The platform collects the evidence; the scope, the risk decisions and the policies still have to be written for your business.
Scope and boundary
The management system scope agreed first, so the platform's tests and integrations cover what the certificate will cover.
Integrations connected
Your cloud, identity, code and HR systems connected and checked, in your own GRC platform account.
Control mapping
the platform's controls mapped to your Statement of Applicability, with custom controls where your scope needs them.
Policies written for your business
Policies drafted for how you actually operate, and reviewed before they go to your team.
Evidence no integration can reach
Manual workflows for the risk assessment, management review and supplier review, kept in the platform.
Audit handover
Surveillance, internal audit and renewal dates set in the platform, and the certification body engagement coordinated.
OUTCOMES
What you walk away with
Tangible outcomes at programme completion.
GRC platform running against your real scope
Integrations live, tests passing against the controls you actually need.
An audit-ready evidence set
Evidence assembled in the platform for Stage 1 and Stage 2.
A team that can run it
Your owner trained to operate the platform without outside help.
Room for ISO 42001
ISO 42001 uses the same management system structure as ISO 27001, so it can be added on the same foundation.
METHODOLOGY
How Goldline delivers GRC platform implementation
Five phases, from scoping to audit handover. The sequence is fixed. The timeline is set at the free diagnostic.
PHASE 01
Scoping
Scope, boundary, frameworks and in-scope systems agreed at kickoff.
- Scope statement
- Integration plan
- Control set
PHASE 02
Platform configuration
GRC platform integrations connected and checked, controls mapped to the Statement of Applicability.
- Integrations live
- Controls mapped
- Tests reviewed
PHASE 03
Control implementation
Risk assessment completed, policies written and published, manual evidence workflows running.
- Risk assessment
- Policies published
- Evidence workflows
PHASE 04
Review and training
A readiness review against the standard, and your owner trained on the platform. The clause 9.2 internal audit is carried out by someone independent of the build.
- Readiness review
- Owner trained
- Internal audit arranged
PHASE 05
Audit handover
Certification body engagement coordinated and support through Stage 1 and Stage 2.
- Audit dates set
- Operations runbook
- Handover complete
What you get from a Goldline GRC platform implementation
Four things that separate an implementation from platform onboarding.
Senior practitioner delivery
The person who scopes it is the person who delivers it.
Fixed after scoping
The fee is set at the diagnostic and does not move unless the scope changes and both parties agree in writing.
Written for your business
Scope, risk assessment, Statement of Applicability and policies written for how you operate, not taken from a template.
Independence kept
Goldline does not audit a management system it implemented, and does not certify.
FREQUENTLY ASKED
Frequently Asked Questions
Set the platform up for a real audit
The scope and policies first, then the platform around them.
45 minutes, video, with the practitioner who would do the work. No sales pitch.