Stage 1
Discover what already exists.
The opening diagnostic identifies the current certification position, risk process, evidence library, security suppliers, contractual promises and timing of external assessments. We distinguish an operationally mature ISMS from a programme that first needs substantial remediation.
Inputs should be proportionate: scope statement, Statement of Applicability if applicable, action register, recent audit findings and a walkthrough with the people responsible. Sensitive documents must be exchanged using an approved, access-controlled channel rather than uploaded through an open website form.
- Identify executive sponsor and technical control owners
- Confirm standards, regulatory touchpoints and customer requirements
- Establish imminent deadlines and any unresolved critical risks
- Classify work into monthly operations, onboarding backlog or specialist project
Stage 2
Agree a responsibility matrix and service levels.
The scope sets out what the security lead will do, what the client must approve, what the IT provider owns and which third parties are required. It also defines the limits on internal-audit independence, questionnaires, urgent assistance and response capacity.
Every recurring deliverable should have an owner and a review cadence. A named specialist is only valuable if the available time and escalation route are realistic.
- Named lead and agreed backup arrangements
- Capacity and output limits for each month
- Written approval rules for customer-facing claims
- Escalation, incident interfaces and exception handling
- Onboarding fee, monthly fee and out-of-scope rates
Stage 3
Operate in the client’s environment.
The proposed model works with the client’s approved document and identity systems, not a hidden vendor-held folder. Evidence stays versioned, requests are traceable and access follows least privilege.
AI assistance may sort records, suggest relevant evidence or prepare first drafts, but it does not independently approve a security control or a representation to a customer. Human review and an identifiable accountable owner remain essential.
- A live control and evidence calendar
- Reviewed risk, action and supplier registers
- Board-level reporting at an agreed cadence
- A standing list of decisions awaiting management approval
Stage 4
Report outcomes and make handover simple.
Every month should show what was reviewed, what changed, what is overdue, what matters commercially and what management needs to decide. The report should not merely count documents produced.
When a client recruits internally or changes advisers, the system and its records should remain understandable and exportable. The exit process belongs in the original statement of work, not as an afterthought.
Month-one acceptance
How to tell whether the handover was completed.
The first month should not end with a vague assurance that the consultant 'has everything under control'. Management should be able to inspect a list of systems in scope, named control owners, the upcoming audit and management-review calendar, open findings and any critical evidence that cannot be located.
A signed responsibility matrix is especially important where an outsourced IT provider implements controls but a governance specialist reports on them.
| Acceptance item | What to inspect |
|---|---|
| Scope and access | Approved systems, authorised users, subcontractor list |
| Current obligations | Certification schedule, material customer commitments |
| Risk baseline | Registered risks with owners, dates and decision status |
| Evidence baseline | Available records, missing proof, retention and confidentiality |
| Monthly cadence | Meeting dates, report owner, issue escalation and SLA |
Exit designed in
An outsourced office should not become the only place your evidence exists.
The contract should specify exportable records, naming and versioning conventions, access revocation, treatment of confidential files and how outstanding actions transfer to an internal replacement. Demonstrating that handover can work is a stronger trust signal than claiming that clients will never leave.
Scope the service