Who it is for
A proportionate engagement with clear boundaries.
Organisations needing evidence-based assurance over a supplier against agreed contractual, control or risk criteria.
Independent assurance
Supplier security audit
Proportionate assurance over critical third parties, outsourced processes and cloud services.
How we assess your ISMSCheck what happens. Explain the result.
AgreeConfirm the scope and requirements to check
ReviewUnderstand your processes and supporting records
SelectChoose records and activities based on risk
TestCheck whether controls work in practice
ReportExplain what works and where requirements are not met
What is included
- Criteria and reliance scoping
- Supplier evidence request
- Interviews and walkthroughs
- Risk-based testing
- Exception and residual-risk reporting
Typical outputs
- Supplier audit plan
- Evidence and test record
- Findings register
- Decision-ready assurance report
What we need from you
- Contract and security schedule
- Risk assessment
- Supplier service scope
- Access and cooperation arrangements
Timing
Usually 2–6 working days, subject to supplier responsiveness.
Pricing basis
Estimated from criteria breadth, service complexity, access and reporting requirements.
Important exclusions
- Penetration testing
- Legal contract review
- Guarantees about supplier security
Frequently asked questions
Does this service result in certification?
No. Mang Morgan does not issue ISO/IEC 27001 or ISO/IEC 27701 certificates or guarantee a certification outcome. A certification decision remains outside this engagement.
How is the scope confirmed?
We confirm the intended outcome, management-system boundary, criteria, locations, processing context, evidence, stakeholders, dates and limitations before issuing the final proposal.
Can the work use a client platform?
We can work in authorised client-owned GRC or privacy-management platforms where appropriate. Platform status helps organise evidence but does not replace testing or professional judgement, and platform experience does not imply partnership.
What happens if the scope changes?
Additional sites, products, processing activities, jurisdictions, frameworks, interviews, revisions, travel, remediation or accelerated dates are assessed through agreed change control.
Start with a defined scope
A clear plan. An agreed fee.
Tell us your objectives and timing. Your proposal will set out the work, deliverables and responsibilities.