Guides

• How to run a risk assessmentSet criteria, find and score risks, choose treatments and get owners to accept what remains, for ISO 27001, ISO 9001, ISO 13485, ISO 42001 and UK GDPR.
• How to write a Statement of ApplicabilityTurn your ISO 27001 or ISO 42001 risk treatment into an SoA row by row, with inclusion and exclusion reasons an auditor accepts and honest statuses.
• How to run a management reviewPlan, prepare and minute a management review that ends in decisions, for ISO 27001, ISO 9001, ISO 13485 and ISO 42001, with an agenda and checklist.
• How to plan and run an internal auditBuild a risk-based audit programme, use impartial auditors, grade findings and act on them, for ISO 27001, ISO 9001, ISO 13485 and SOC 2.
• Document controlNumber, review, approve, publish, change and retire your policies and procedures the way ISO 9001, ISO 13485 and ISO 27001 auditors expect.
• Root-cause analysis for a CAPAHow to find the cause that stops a nonconformity coming back, with ISO 13485 and ISO 27001 worked examples and an auditor's checklist.
• Adopting and rolling out policiesChoose, review and approve your policies, then get the right people to read and acknowledge each version, as ISO 27001 and ISO 9001 expect.
• Testing your business continuity planPick scenarios from your impact analysis, run tabletop or failover tests against recovery objectives, act on findings, for ISO 27001, SOC 2 and DORA.
• Incident response and breach notificationHow to run an incident from first report to closure and decide within 72 hours whether to notify, under ISO 27001, GDPR, SOC 2, NIS2 and DORA.
• How to handle a subject access requestHow to recognise, time, search, redact and answer a subject access request within the UK GDPR and EU GDPR deadlines, with the UK pause rules.
• How to carry out a DPIAHow to screen for, run and sign off a data protection impact assessment under UK GDPR and EU GDPR, with a worked example for an AI feature.
• Supplier due diligenceHow to tier, check, contract and re-review suppliers that touch your data or product, under ISO 27001, ISO 9001, ISO 13485, UK GDPR, SOC 2 and DORA.
• How to run an access reviewHow to check who can reach each system, remove what is not needed and keep evidence auditors accept, under ISO 27001, SOC 2, Cyber Essentials and UK GDPR.
• Backup and restore testingHow to prove your backups can be restored in time and intact, with the evidence ISO 27001, SOC 2 and UK GDPR auditors accept.
• Building a training and awareness programmeHow to work out who needs what training, deliver it, check it worked and keep records, for ISO 27001, ISO 9001, ISO 13485, UK GDPR and the EU AI Act.