EARLY STAGE
The first customer who asks for a certificate.
Nobody plans for ISO 27001. It arrives in a security questionnaire from the first enterprise customer who wants to buy, and suddenly the deal is waiting on a document you have never written.
- Free 45 minute diagnostic
- Free one-page roadmap
- Fixed fee once agreed
- Works inside your platform, or without one
What this stage looks like
A named customer has asked for a certificate, or sent a questionnaire you cannot answer.
There is no security lead, and the founder or the first engineer owns it by default.
A compliance platform has been bought, or is about to be, and nobody is sure what it does not cover.
Budget exists because a deal is blocked, not because compliance is on the roadmap.
The usual shape for a company like yours
At this stage the certificate is almost always driven by one customer's questionnaire. The usual shape is a build your own team can run, directed and reviewed by us, and then an operating rhythm that keeps the certificate alive once it is issued.
ISO 42001 for startups: both certificates on one system, at a fixed published price.
ISO 27001 Sprint: Goldline builds the management system with your named owner.
ISO 42001 alongside it where AI is in the product, on the same management system.
Then Evidence Essentials to keep the controls running and the evidence current.
Managed compliance and security
Three packages on a 12-month term, billed monthly, keep the controls running and the evidence current, with independent verification.
See all three packagesThe packages run inside whichever compliance platform you already use, and the licence stays yours, bought direct. If you have no platform, say so on the scope check and we will set out the options.
Modules
Annual penetration test
What it is
An annual independent penetration test and a retest of the fixes.
What it produces
A test report and a retest report.
Delivered by our security partner, with any commission disclosed on your proposal.
Priced at the diagnostic, fixed once agreed.
Reserved hours
What it is
Blocks of fractional security lead time.
What it produces
Decisions made and recorded, questionnaires reviewed, and audit sessions attended within an agreed scope.
Goldline never audits a system it implemented.
Priced at the diagnostic, fixed once agreed.
Questionnaire desk
What it is
Human review of what your platform drafts, and the answers it can't give, on scope and exceptions.
What it produces
Reviewed answers ready for your sign-off.
Goldline reviews the answers; your organisation approves and sends them.
Priced at the diagnostic, fixed once agreed.
AI system security testing
What it is
Your AI systems tested for security weaknesses, including prompt injection, data leakage and agent misuse.
What it produces
One report, findings mapped to ISO 42001 and ISO 27001 controls, and a retest statement confirming which findings are closed.
Delivered by a specialist tester under Goldline's scope and rules of engagement. Where Goldline implemented your ISO 42001, the report is verification evidence, not an independent audit.
From £4,500 fixed, set at scoping.
Start with the free 45-minute diagnostic
You keep a one-page roadmap either way.