FAQ

Frequently Asked Questions

  • Most clients achieve certification in under six months. We work efficiently by embedding into your team, using your Microsoft 365 environment, and guiding every step with a clear plan. This timeline allows you to build an effective system and demonstrate the internal audits and management reviews required by the standard.

  • Our fixed monthly fee covers everything except External Auditing. That includes expert consulting, documentation, risk registers, awareness training, audit preparation, and ongoing support. There are no licensing fees, no platform costs, and no hidden extras.

  • We are not a one-off project or a subscription tool. We become your Virtual Compliance Officer, working inside your Microsoft 365 environment. You get full access, full control, and real support that continues long after certification.

  • Yes. All your policies, registers, and evidence are built and stored in SharePoint. You control your ISMS completely, with no vendor lock-in or hidden processes.

  • Yes, and we make it easy. We provide tailored awareness training and help you roll it out using Microsoft Teams and SharePoint. Meaninggul and effective compliance involves understanding and accountability, not just reading a few policy pages.

  • ISO/IEC 27006-1:2024 requires clear evidence that your system is implemented, effective, and has gone through internal audits and management reviews. These steps cannot be meaningfully completed in a matter of days or weeks. While some vendors promise quick certification, they often skip the hard parts. We help you certify in under six months, with a system that meets the actual intent of the standard and holds up to audit.

  • Yes. We attend your Stage 1 and Stage 2 audits virtually, supporting your team and providing guidance in real time. We work with your chosen certification body and help you demonstrate your system clearly and confidently.

  • That is exactly what we are here for. Most of our clients begin with limited documentation or informal processes. We build everything with you from the ground up and stay involved through certification and beyond.

  • Yes. In addition to ISO/IEC 27001, we support ISO 9001, ISO 14001, ISO 45001, ISO/IEC 42001 and ISO 27701. We build one integrated system that supports multiple standards, using your existing Microsoft 365 environment.

  • Yes. We work with IT providers across Australia and New Zealand to support their clients with ISO certification. Whether you're referring clients, managing delivery, or co-owning the compliance journey, our partner model gives you flexibility and confidence.

  • Item descriptionInstead of paying for subscription-based GRC tools, you can build your ISO management system directly in Microsoft 365. ISO365 creates a SharePoint hub for policies, registers, risks and audits — without licence fees or vendor lock-in.

  • Yes. We specialise in moving clients out of platforms like Vanta, Drata, Sprinto and ISMS.online. We transfer your key content into Microsoft 365, fill any gaps, and ensure your new system is audit-ready.

  • No. We align your new SharePoint-based system to ISO requirements before you transition. This ensures you’re fully prepared for your next certification or surveillance audit without disruption.

  • Yes. Microsoft 365 provides everything you need — SharePoint for document control, Teams for collaboration, and strong built-in security. We design your ISO system around these tools so you don’t need extra software.

  • Most GRC platforms charge ongoing annual licence fees per user or per certification. By moving to Microsoft 365, you avoid those recurring costs and keep full ownership of your ISO system. Clients often save thousands each year.

  • No. In fact, you gain flexibility. GRC tools can be rigid, while SharePoint is fully customisable and integrated with the tools your team already uses. Your system remains practical, audit-ready and easier to manage long-term.

Beyond ISO 27001

Many clients expand into additional standards over time. We build a single system that can support:

  • The global benchmark for managing information security.

    We help you design and implement an Information Security Management System (ISMS) that protects data, builds trust, and opens doors to new business. Most clients achieve certification in under six months, with a system built directly inside Microsoft 365.

  • ISO/IEC 27701 extends ISO/IEC 27001 to help you manage personal data and privacy risks.

    We help you implement a Privacy Information Management System (PIMS) that integrates into your existing ISMS, strengthening your approach to data protection, regulatory compliance and client trust.

    From data handling controls to privacy impact assessments, we guide you in building a practical, transparent and accountable privacy framework aligned with global expectations.

  • As one of the first Australian firms certified to ISO/IEC 42001, we help you build responsible AI governance into your existing compliance system.

    Whether you’re using, deploying or developing AI, we guide you through risk assessments, impact assessments, control design, and accountability structures — ensuring your AI practices are safe, transparent and aligned with emerging regulation.

  • ISO 9001 demonstrates that your organisation consistently delivers quality services and meets client expectations.

    We help you integrate a Quality Management System (QMS) into your operations, improving service delivery, customer satisfaction and tender success.

  • ISO 14001 certification shows your commitment to environmental responsibility.

    We help you implement an Environmental Management System (EMS) that aligns with sustainability goals, reduces environmental impact, and meets stakeholder expectations.

  • ISO 45001 focuses on the health, safety and wellbeing of your workforce.

    We guide you in building a practical Safety Management System that reduces risks, improves compliance with workplace regulations, and demonstrates your commitment to a safe and sustainable workplace.