Who it is for
A proportionate engagement with clear boundaries.
Organisations preparing aligned management systems that need one decision-ready view of common foundations and distinct gaps.
Advisory & readiness
Integrated ISMS and PIMS readiness assessment
A coordinated baseline of security and privacy readiness, shared governance and remaining system-specific work.
ISMS operating modelFrom policy to practice
Acceptance and competence boundary
Acceptance is subject to a documented review of privacy-management competence, capacity, processing context, relevant jurisdictions and any need for legal or specialist input. Mang Morgan does not provide legal advice; an engagement may require an approved specialist or be declined if the required competence or independence cannot be demonstrated.
What is included
- Scope-alignment review
- Shared governance and risk-method assessment
- ISMS and PIMS evidence-readiness review
- Selected integrated process walkthroughs
- Sequenced readiness roadmap
Typical outputs
- Integrated readiness assessment
- Common and system-specific gap view
- Evidence action list
- Leadership roadmap
What we need from you
- Proposed ISMS and PIMS scopes
- Security and privacy risks
- PII processing context and Statement of Applicability
- Target assessment or certification timetable
Timing
Confirmed after the two system boundaries, overlap, evidence maturity and stakeholder plan are understood.
Pricing basis
Fixed-fee where scope and evidence are stable; phased discovery may be proposed where system boundaries remain uncertain.
Important exclusions
- Formal internal-audit conclusions unless separately scoped
- Certification
- Legal advice
- Guaranteed assessment outcomes
Frequently asked questions
Does this service result in certification?
No. Mang Morgan does not issue ISO/IEC 27001 or ISO/IEC 27701 certificates or guarantee a certification outcome. A certification decision remains outside this engagement.
How is the scope confirmed?
We confirm the intended outcome, management-system boundary, criteria, locations, processing context, evidence, stakeholders, dates and limitations before issuing the final proposal.
Can the work use a client platform?
We can work in authorised client-owned GRC or privacy-management platforms where appropriate. Platform status helps organise evidence but does not replace testing or professional judgement, and platform experience does not imply partnership.
What happens if the scope changes?
Additional sites, products, processing activities, jurisdictions, frameworks, interviews, revisions, travel, remediation or accelerated dates are assessed through agreed change control.
Start with a defined scope
A clear plan. An agreed fee.
Tell us your objectives and timing. Your proposal will set out the work, deliverables and responsibilities.