Consulting · elemosecurity
Let us handle the audit
evidence for you.
Most GRC tools give you somewhere to put the evidence. We produce it: inside your organisation, filed against the right control, ready for your auditor.
What we do
Done with you, in your instance.
Done-for-you audit evidence
We collect the artefacts, take the configuration snapshots and file each one against its control, then keep them current.
ISMS stand-up
Scope, risk method, Statement of Applicability, policy suite, internal audit and the first management review.
Policies and procedures
Written for how you actually work, staged for your approval, and put into practice with their owners.
Readiness assessment
Every control given a real status, and a remediation plan ordered by what blocks the audit.
Implementation
Deployed, wired to your SSO, populated, and handed to a team that has already run it.
Audit preparation
A sealed package, defensible samples, rehearsed walkthroughs, and the request list run to empty.
Fractional GRC
A named practitioner a few days a month who owns the compliance calendar.
Migration
Off another GRC tool, with owners, review dates and past evidence intact.
Custom frameworks
A standard we do not ship yet, a regulator's schedule or a client's addendum, built as a pack.
How it works
Four steps,
no surprises.
- A free 45-minute call. What you sell, who is asking, and what it takes. We will tell you if you do not need us.
- A written scope and a fixed fee, signed before any access is granted, with an NDA and DPA.
- The work, in your instance. Named accounts, least privilege, and a short update every week.
- Handover. Your team runs the system back to us, then our access is revoked and logged.
Who does the work
The person who wrote Conformiti.
No bench and no juniors learning your environment on your budget. That keeps capacity finite: engagements usually book three to six weeks out.
What we will not sell you
- An audit. We prepare you; an independent assessor tests you.
- Penetration testing. We will help you scope one and read the report.
- Generated policies with your logo on them. If you cannot explain it, it is not evidence.
- "Certified in 30 days." The standard sets the observation window, not us.
Start here
Tell us where you are.
A few lines is enough. We reply within one business day with what it would take and whether you need us at all.
- No licence needed: most clients self-host the free Core.
- Your data stays in your instance, under your accounts.
- Fixed fee against a written scope, quoted after the call.