TRUST UNDER SCRUTINY

You’re preparing for ISO, Cyber Essentials, or SOC 2 - and it’s messier than expected

Many organisations begin certification preparation with confidence.

Controls exist. Policies are written. People are doing sensible things. On paper, the gap to ISO, Cyber Essentials, or SOC 2 doesn’t look large.

Then preparation starts – and complexity appears.

Why certification prep often becomes chaotic

Certification frameworks assume structure. In reality, many organisations grow organically.

Decisions are made over time, responsibilities shift, and evidence accumulates without a single organising system. When certification prep begins, teams try to impose structure retrospectively.

The work becomes less about improving control and more about reconciling documents, risks, and narratives under time pressure.

What assessors are really trying to understand

Assessors rarely expect perfection. They look for clarity and consistency. Fragmentation – not absence of controls – is what most often causes friction during assessment.

In practice, they want to see that:

How Protects helps in this situation

Protects helps organisations bring structure to certification preparation without treating it as a one-off exercise.

By connecting risks, documents, training, and ownership, it creates a coherent view of how controls are managed day to day.

This reduces last-minute scrambling and makes future audits and renewals far less disruptive.

Relevant areas of Protects

Document Centre

Keeps policies, procedures, and supporting evidence aligned and version-controlled in one place.

Makes it easier to show that documentation reflects how the organisation actually operates, not just how it’s described for an audit.

Risk Manager

Provides a clear view of identified risks, how they’re assessed, and how often they’re reviewed.

Helps demonstrate to assessors that risk management is an ongoing process, not something created just for certification.

Training Zone

Shows that people have been trained and are aware of their responsibilities, not just that policies exist.

Supports certification by evidencing that controls are understood and applied in practice.

Prepare for certification without the scramble

Protects helps organise policies, risks, actions and evidence for assessment preparation. YDC offers separately agreed ISO 27001 implementation and readiness support, Cyber Essentials assessment, Cyber Essentials Plus assessment and SOC 2 readiness support. Software access does not include certification or assessment fees; optional preparation is scoped separately.

Independent certification bodies decide ISO 27001 certification; independent CPA firms conduct SOC 2 examinations and issue the reports.