Who it is for
A proportionate engagement with clear boundaries.
Technology SMEs that want one proportionate operating model rather than disconnected security and privacy programmes.
Advisory & readiness
Integrated ISMS and PIMS implementation support
Build coordinated security and privacy governance while keeping ownership, risks and evidence clear for each system.
ISMS operating modelFrom policy to practice
Acceptance and competence boundary
Acceptance is subject to a documented review of privacy-management competence, capacity, processing context, relevant jurisdictions and any need for legal or specialist input. Mang Morgan does not provide legal advice; an engagement may require an approved specialist or be declined if the required competence or independence cannot be demonstrated.
What is included
- Integrated context, scope and governance design
- Coordinated security and privacy risk methods
- Shared and system-specific documentation
- Control and privacy-process implementation planning
- Evidence and review cadence
- Capability transfer to accountable owners
Typical outputs
- Integrated management-system framework
- Coordinated document set
- Security, privacy and processing registers
- Phased implementation roadmap
- Operating guidance
What we need from you
- Business, technical and processing context
- Existing ISMS and privacy materials
- Security and privacy owners
- Leadership decisions on scope and accountability
Timing
Phased after discovery; sequencing depends on current maturity, processing complexity, architecture and owner availability.
Pricing basis
Phased fixed-fee or time-based support with shared activities and system-specific work estimated separately.
Important exclusions
- Owning management decisions, risks or processing purposes
- Legal advice
- Certification
- Independent audit of Mang Morgan’s own implementation work without safeguards
Frequently asked questions
Does this service result in certification?
No. Mang Morgan does not issue ISO/IEC 27001 or ISO/IEC 27701 certificates or guarantee a certification outcome. A certification decision remains outside this engagement.
How is the scope confirmed?
We confirm the intended outcome, management-system boundary, criteria, locations, processing context, evidence, stakeholders, dates and limitations before issuing the final proposal.
Can the work use a client platform?
We can work in authorised client-owned GRC or privacy-management platforms where appropriate. Platform status helps organise evidence but does not replace testing or professional judgement, and platform experience does not imply partnership.
What happens if the scope changes?
Additional sites, products, processing activities, jurisdictions, frameworks, interviews, revisions, travel, remediation or accelerated dates are assessed through agreed change control.
Start with a defined scope
A clear plan. An agreed fee.
Tell us your objectives and timing. Your proposal will set out the work, deliverables and responsibilities.