Retainer capacity is full until mid-2027.Fixed-scope projects available on request.
ISO 27001 readiness
We build the ISMS ISMS Information Security Management System. The policies, risk treatment, controls, evidence and review cycles that run security as a business function. ISO 27001 certifies the system, not a single control. , implement the controls, and prepare you for audit over time - structured so the system holds up when an auditor, a customer, or an incident tests it.
ISO 27001 works once it becomes the way your team runs security day to day.
Where This Fits
Who this is for
This is you
Your company
- 20-50+ people and growing
- Security is becoming a real function
- You face formal demands for evidence
What is pushing you
- Enterprise customers expect certification
- Tenders require ISO 27001
- Investors raise it during due diligence
- Internal maturity makes it the next step
How we do it
-
Instead of a template ISMS bought off the shelf, we build an ISMS scoped to your real business.
-
Instead of treating certification as a one-off documentation exercise, we give every control a named, accountable owner.
-
Instead of a certificate over a system nobody runs, we leave you with a system that holds up at the next audit.
The Certificate
Who does what
We build the ISMS and take it to the audit door. An accredited certification body Accredited certification body The organisation that audits your ISMS and issues the certificate. Accredited bodies are barred from consulting on a system they certify, so the firm that builds it and the firm that audits it are always different. runs the audit and issues the certificate.
The dashed line is the impartiality rule. No firm is allowed to work on both sides of it, which is why the company that builds your ISMS can never be the one that certifies it.
SteadySec
Implementation
ISMS, risk treatment, controls, evidence
Certification body
Certification audit
Stage 1, Stage 2, certificate
SteadySec
Maintenance
Audit-ready between audits
Certification body
Surveillance
Yearly audits
The two lanes never mix. No firm is allowed to work on both sides of that split, which is why the company that builds your ISMS can never be the one that certifies it.
The Roadmap
Five phases
Readiness assessment
Scope, interested parties, customer and security drivers, an asset and process overview, existing controls, and a clear gap analysis against ISO 27001.
ISMS foundation
ISMS scope, risk methodology, asset register, risk register, statement of applicability, the policy set, and named control owners.
Control implementation
Access control, supplier management, incident management, backup and recovery, vulnerability management, logging and monitoring, security awareness, and secure development where relevant.
Evidence and internal audit preparation
Evidence collection, management review, internal audit support, corrective actions, and coordination with the certification body.
Retainer maintenance
Ongoing ISMS operations, quarterly risk register updates, control checks, supplier evidence, and audit readiness between certification cycles.
Start Here
How to start
The same four steps for every engagement here. You can stop after step two and owe nothing.
- 1
Run the Discovery Calculator
FreeAbout four minutes, no sign-up. It runs in your browser and nothing is sent anywhere unless you choose to send it.
- 2
Send me the result
FreeI reply with a recommendation for your situation - including when the honest answer is that you do not need me yet.
- 3
Starter Assessment (€1,900) or Starter Month (€2,900)
Fixed price, one-offThe paid entry, and the only one. It ends with a roadmap of the major milestones and a recommended retainer tier.
- 4
Continue on a retainer
From €950 a monthIf the roadmap makes sense to both of us, implementation runs inside the retained engagement.
How this becomes a retainer
An ISMS only holds if it is operated: the review cycle, the risk register, and audit readiness between certification cycles all keep running. The starter door produces the roadmap; the retained engagement is where it gets built. One senior practitioner, a fixed monthly hour cap, and a tier set after the starter door.
What is not included
The audit and the certificate come from the accredited body you appoint. We prepare you for it and coordinate with the body; risk acceptance and the final security decisions stay with your management.
Certification is a milestone. What lasts is an ISMS your company uses every day.