Certification-ready, because the controls are in the system.
ISO 27001, ISO 9001 and SOC 2 preparation delivered by people who build software for a living. Controls designed into your pipeline and your cloud account, evidence generated as a by-product of the work, and no theatre staged for the week of the audit.
What you leave with
- Which standard your customers are actually asking for, and when
- A rough gap between where you are and what an auditor will look for
- The order to close the gaps in, and what you can do yourselves
With a senior architect, not a salesperson. Sixty minutes, no cost, no obligation.
We prepare you for the audit. We do not issue the certificate.
Certification is granted by an accredited certification body after a formal audit: that is deliberately not us, and any consultancy claiming otherwise is worth walking away from. What we do is the engineering half: building the controls, the evidence and the working practices into how your teams already operate, so that when the auditor arrives there is nothing to stage.
ISO/IEC 27001
Information security management. Scope and risk assessment, the Statement of Applicability, Annex A controls that map to real engineering practice, and the evidence trail that proves they run.
ISO 9001
Quality management. Process documentation that matches reality, corrective action that actually closes, and management review that produces decisions rather than minutes.
SOC 2 readiness
For selling into the United States. Trust services criteria, control design, and the continuous evidence collection an observation window demands.
Controls that live in the pipeline, not in a binder.
The difference between a certification that helps and one that hurts is whether the controls are part of the working system or a parallel exercise performed twice a year. We only build the first kind.
Gap assessment
Where you are against the standard today, control by control, with an honest severity on each. Usually less frightening than expected, and differently distributed.
Design
Controls mapped onto how your teams actually work: access review in your identity provider, change control in your pipeline, evidence generated as a by-product of doing the work.
Implement
Engineering work: logging, access management, backup and recovery testing, secure SDLC, supplier review, incident runbooks that have been rehearsed.
Evidence
Automated collection where possible, plus the internal audit and management review cycle the standard requires, running before the external auditor arrives.
Cloud and AI in scope
Most of the controls that trip organisations up now sit in cloud configuration and, increasingly, in AI systems: data residency, model and prompt versioning, retention, decision logging and human review points. We build the systems, so we can build the controls into them rather than describing them afterwards.
AI governanceRealistic timelines
For a small engineering organisation starting from a reasonable baseline, ISO 27001 readiness is typically a six to nine month exercise, with the certification audit after that. Anyone promising it in six weeks is selling you a binder, and the auditor will notice.
What readiness covers
ISO 27001, ISO 9001 and SOC 2 preparation, built into how you already work.
Gap assessment
Your controls, policies and evidence against the standard, with a clear list of what is missing.
Information security
Access control, asset management, supplier risk and incident response, sized to your organisation.
Engineering evidence
Change management, secure development and monitoring that produce evidence as a side effect of normal work.
Cloud controls
Configuration on AWS, Azure or Google Cloud mapped to the controls an auditor will test.
Policies people use
Short, accurate policies rather than a binder nobody reads.
Audit support
Preparation for the certification audit and help answering findings.
Sound familiar?
- A customer tender asks for ISO 27001 or SOC 2
- Security questionnaires take days to answer
- Policies exist but nobody follows them
- You are preparing for an EU AI Act or NIS2 conversation and need a baseline
- An audit is booked and the evidence is scattered
A small, senior team that stays accountable.
- Architect-led. Every engagement is led by a senior architect who stays accountable for the decisions, from the first hour to the handover.
- Over twenty years of building and integrating software. Enterprise integration, cloud platforms, product delivery and now AI agents, across sectors where systems cannot fail.
- Independent and vendor-neutral. AWS, Azure and Google Cloud, and whatever platforms you already run. We recommend what fits, including doing less.
- Research, applied. The patterns we use are published openly on The Software Lens and applied by our R&D Wing, so you can read the reasoning before you hire us.
- We run what we recommend. We build our own product, Nexcubator, on the same architecture we design for clients.
- You own everything. Your repository, your cloud account and your documentation from the first week. Based in Ireland, working across the EU and beyond.
Questions we get asked
Can you certify us?▼
No, and no consultancy can. Certification is issued by an accredited certification body after an independent audit: keeping those roles separate is the entire point of the scheme. We prepare you, and we can help you select and work with a certification body.
Do we need to buy a compliance platform?▼
Sometimes they earn their cost, particularly for evidence collection at SOC 2. Often they become an expensive parallel universe that describes controls you do not really run. We will give you a straight opinion for your situation and we take no commission either way.
How long does ISO 27001 realistically take?▼
For a small engineering organisation with reasonable practices already, six to nine months of readiness work before the Stage 1 audit is a realistic plan. Less if your baseline is strong, considerably more if access management and logging need building from scratch.
A customer is demanding it by a specific date. What now?▼
Start with the gap assessment, because the answer to 'can we make that date' is a question of facts and a few weeks' work to establish. Frequently an interim option (a security summary, a signed control attestation, a scoped Stage 1) keeps the deal alive while the real programme runs.
One free hour. No pitch, no obligation.
Bring the problem you are stuck on: an integration that keeps breaking, a cloud bill nobody can explain, an AI project that is all demo and no product, or a platform you are about to invest in. You will leave with a straight answer and a written summary, whether or not you ever work with us.
- Architecture and integration review
- AI feasibility: what will actually work, and what will not
- AWS, Azure and Google Cloud cost and design
- Business process audit and ISO readiness
- Technical due diligence before you invest or acquire