Who it is for
A proportionate engagement with clear boundaries.
Established ISMS teams that want insight beyond document presence or dashboard completion.
Independent assurance
ISMS effectiveness review
Focused assurance on whether governance, risk treatment and controls are producing the intended outcomes.
How we assess your ISMSCheck what happens. Explain the result.
AgreeConfirm the scope and requirements to check
ReviewUnderstand your processes and supporting records
SelectChoose records and activities based on risk
TestCheck whether controls work in practice
ReportExplain what works and where requirements are not met
What is included
- Objectives and metrics review
- Risk-treatment effectiveness testing
- Selected process walkthroughs
- Trend and exception analysis
- Management reporting review
Typical outputs
- Effectiveness assessment
- Evidence summary
- Findings and improvement opportunities
- Executive readout
What we need from you
- Security objectives and metrics
- Risk and incident records
- Audit and management-review history
- Operating evidence
Timing
Typically 2–5 working days for a focused scope.
Pricing basis
Scoped by review depth, number of processes and required sampling.
Important exclusions
- Certification
- Control operation by Mang Morgan
- Management responsibility for risk acceptance
Frequently asked questions
Does this service result in certification?
No. Mang Morgan does not issue ISO/IEC 27001 or ISO/IEC 27701 certificates or guarantee a certification outcome. A certification decision remains outside this engagement.
How is the scope confirmed?
We confirm the intended outcome, management-system boundary, criteria, locations, processing context, evidence, stakeholders, dates and limitations before issuing the final proposal.
Can the work use a client platform?
We can work in authorised client-owned GRC or privacy-management platforms where appropriate. Platform status helps organise evidence but does not replace testing or professional judgement, and platform experience does not imply partnership.
What happens if the scope changes?
Additional sites, products, processing activities, jurisdictions, frameworks, interviews, revisions, travel, remediation or accelerated dates are assessed through agreed change control.
Start with a defined scope
A clear plan. An agreed fee.
Tell us your objectives and timing. Your proposal will set out the work, deliverables and responsibilities.