Emergency incident response: [email protected]
GRC&Security

Governance. Risk. Compliance. Security.

Every standard you're held to.
One framework to meet them.

We map the standards, laws, contracts and customer requirements your organization answers to, then build one control framework that meets all of them. Each control is traced to its sources, so you implement it once and evidence it once.

Your framework, built from every source that matters.

Framework design is our core service and the foundation for every assessment, policy and programme we deliver.

  1. 1

    We collect your sources

    ISO and NIST standards, laws and regulations, customer security questionnaires, contract clauses, audit findings and your own policies.

  2. 2

    We map every requirement

    Our tooling breaks each source into individual requirements and maps them against each other, showing where they overlap, conflict or leave gaps.

  3. 3

    You get one framework

    A single control set organized by capability, with every control traced to the requirements it satisfies.

See a sample crosswalk → See the standards, frameworks, laws and regulations that we work with regularly →

Advisory services

We specialize in security governance and AI governance. The services below are examples of the work we deliver on your framework.

Core strength

Security Governance

An information security programme that leadership can direct and auditors can verify, aligned to ISO/IEC 27001, NIST CSF and the frameworks your customers ask for.

Core strength

AI Governance

Inventory, risk-tier and oversee your AI systems, and prepare for ISO/IEC 42001, the NIST AI RMF and the EU AI Act.

  • Governance & Compliance Assessments

    Find out where you stand against the standards and laws you answer to.

  • Security & Compliance Audits and Assessments

    Audits and assessments of your controls against the standards you are held to, with a focus on cloud environments.

  • Risk Management Framework Implementation

    A repeatable method to identify, rank and treat risk.

  • Cybersecurity Policy Development

    Policies written for the people who must follow them.

  • Security Awareness & Training

    Training that teaches staff to recognize and report threats.

  • Incident Response

    Plans that set out who does what during an incident, tested before you need them, and hands-on help when one is under way.

  • SIEM & SOC Consulting

    Logging, SIEM and SOC advice from people who built a SOC supporting 900 enterprise customers.

  • Third-Party Risk Assessment

    Assess suppliers' security before you share data or systems with them.

  • GRC & Security Software Procurement

    Vendor-neutral help selecting GRC and security tools that fit your requirements and budget.

  • Not sure where to start?

    Tell us what you are facing and we will recommend a first step.

    Talk to us →

From a stack of standards to a single plan.

We work regularly with ISO and NIST standards, industry frameworks, AI and privacy law, and sector regulations. Each engagement turns the ones you answer to into a single plan.

  1. 1

    Assess

    We identify the standards, laws and contracts you answer to, and review how your business operates today.

  2. 2

    Build

    We map the requirements, design the control framework, and write the policies and procedures that put it into practice.

  3. 3

    Sustain

    We train your people, test your controls and update the mapping when your obligations change.

Examples include ISO/IEC 27001, ISO/IEC 42001, NIST CSF 2.0, the NIST AI RMF, SOC 2, the EU AI Act, PIPEDA and Quebec Law 25, and we add new sources as clients need them. See the standards, frameworks, laws and regulations that we work with regularly →

Built around your business

Controls are designed for how your organization operates.

Security and AI together

One team covers security governance and AI governance on a single framework.

Recommendations in packages

Choose the scope that fits: the controls your obligations require, a wider set that also meets the standards relevant to you, or a comprehensive set that positions you for the standards you may need in future.

Contact us

Tell us which standards and obligations you answer to, and we will show you how they map.