GRCex

Managed services

Our experts run the programme.
The evidence stays with you.

GRCex Managed Services bring the team behind the platform to your security and compliance programme: a fractional CISO, gap analysis, certification consultancy, audit support and management system consultancy. Every engagement runs on a GRCex workspace we set up for you, or on the GRC tool you already use.

Talk to us See the services
  1. 01Expertise, not just software

    The people who design the controls, audits and workflows in GRCex do the work: assessments, documentation, audits, board reporting.

  2. 02A workspace comes with the service

    We set up a GRCex workspace for every engagement and run tasks, findings and reports in it, so you can see where the programme stands at any time.

  3. 03Your tools are welcome

    Already running another GRC tool? We work in it. Either way, deliverables and evidence stay with you when the engagement ends.

Services

Pick the service. Choose the rhythm.

Start with one service; add others as your programme matures. Each one is available on a monthly, annual or project basis.

01 vCISO 02 GAP Analysis 03 Certification Consultancy 04 Audit Support 05 Management System Consultancy 06 Vulnerability Management 07 Supplier Risk Programme 08 Awareness & Training
Monthly

A fixed number of consultant days per month for services that run continuously: vCISO, vulnerability management, supplier programme.

Annual

A yearly agreement planned at the start of the year: internal audit programme, training plan, periodic reviews, surveillance preparation.

Project

Fixed scope, milestones and deliverables: gap analysis, certification, management system design, a single audit.

We quote per engagement after a scoping call. One rule applies to every service: the consultant who builds your management system does not audit it; internal audits are performed by a different auditor.

01

vCISO

Fractional CISO: a senior security leader who owns your programme, without the full-time hire.

The vCISO sets the direction of your security programme, makes risk decisions together with management, reports to the board and oversees incidents. The programme is tracked in a shared workspace, so its state is visible to you at any time, not only in the monthly meeting.

Who it is for

Organisations that need CISO-level ownership but cannot justify a full-time role; companies facing NIS2 or DORA management-accountability obligations; teams between two CISOs.

Engagement Monthly or annual, sized in consultant days per month.

Talk to us about vCISO

What you get

  • Security programme and 12-month roadmap, reviewed every quarter
  • Ownership of the risk register: assessment cadence, treatment decisions, documented risk acceptance
  • Monthly management report and quarterly board report
  • Policy framework with a review cycle and approvals
  • Incident oversight: playbook, severity decisions, post-incident review
  • A single counterpart for auditors, customers and regulators on security matters

How it works

  1. Onboarding, first four weeks. Current-state review, risk register baseline, stakeholder map, reporting format agreed with management.
  2. Monthly cadence. Steering meeting, risk review, follow-up of open actions, KPI report.
  3. Quarterly. Board report, roadmap review, input to the management review.
  4. On event. Incident oversight, audit or regulator requests, security assessment of major changes.

Where the work lives

Risks, actions, meetings and objectives are tracked in the GRCex workspace set up for the engagement; the board report is generated from its Reports module. If you run your own GRC tool, we work in it. When the engagement ends, the programme stays with you.

02

GAP Analysis

Readiness assessment against ISO 27001, NIS2, DORA and GDPR, scored control by control.

A structured assessment of where you stand against the framework you have chosen, or a combination of them, and what to do first. Each clause and control is scored, each gap becomes a finding and each roadmap item becomes an action with an owner and a date.

Who it is for

Organisations starting a certification or regulatory programme; companies asked by a customer or regulator for their compliance status; management that wants a baseline before committing a budget.

Engagement Fixed-scope project.

Request a gap analysis

What you get

  • Scored gap report per clause and control: implemented, partial or missing, with the evidence reviewed
  • Prioritised roadmap with effort, dependencies and a proposed owner per item
  • Executive summary for management
  • Findings and actions ready to work on, not only a document

How it works

  1. Scope. Framework selection, boundaries, document request list.
  2. Review. Document review and interviews with control owners.
  3. Technical checks. Where you use GRCex, agent, configuration and external scan data feed the assessment.
  4. Scoring workshop. Results validated with control owners before they are final.
  5. Report. Gap report, roadmap and management presentation.

Where the work lives

Scoring, findings and the roadmap are created in the GRCex workspace: each control scored, each gap a finding, each roadmap item an action with an owner and a date. A second assessment measures change against the same baseline. If you prefer, the same results are delivered into your own GRC tool.

03

Certification Consultancy

From decision to certificate: ISO 27001, ISO 27701, ISO 22301 and ISO 9001.

End-to-end guidance for a first certification, an extension to a new standard or site, or a stalled programme: scope, documentation, risk assessment, Statement of Applicability, internal audit and readiness for the certification body. We are not a certification body and do not issue certificates; we prepare you for an accredited one.

Who it is for

First-time certification; organisations extending an existing certificate; companies whose certification project has lost momentum.

Engagement Project with milestones; duration depends on scope and maturity and is fixed in the project plan.

Plan your certification

What you get

  • Scope definition and context analysis: boundaries, interested parties, interfaces
  • Document set: policies, procedures and records with an approval workflow
  • Risk assessment and treatment plan with a methodology that fits your organisation
  • Statement of Applicability with a justification per control
  • Internal audit and management review before the certification audit
  • Stage 1 and Stage 2 preparation, support during the audit, closure of audit findings

How it works

  1. Readiness. Gap analysis and a project plan with milestones.
  2. Design. Scope, policy framework, risk methodology, Statement of Applicability.
  3. Build. Procedures, control implementation support, evidence collection cadence.
  4. Verify. Internal audit, management review, corrective actions.
  5. Certify. Certification body selection, Stage 1 and Stage 2 accompaniment, finding closure.

Where the work lives

Scope, Statement of Applicability, risk register, documents, internal audit and management review are built as records in the GRCex workspace, so the certification body sees a working management system rather than a folder of templates, and the same records carry the surveillance cycle after the certificate. If you have your own document system or GRC tool, the deliverables are produced there.

04

Audit Support

Internal audit as a service, pre-certification audits, surveillance preparation and audit accompaniment.

Audit capacity when you need it: an independent internal audit programme, a mock audit before the certification body arrives, preparation for surveillance and recertification, accompaniment during customer or regulator audits, and closure of the findings that come out of them.

Who it is for

Organisations without an independent internal audit function; teams facing a surveillance audit with open findings; companies audited by customers or regulators under NIS2 or DORA.

Engagement Annual agreement for the internal audit programme, or per audit as a project.

Get audit support

What you get

  • Annual internal audit programme and a plan per audit
  • Internal audit execution: working papers, evidence sampling, report
  • Pre-certification audit with findings graded the way a certification body would grade them
  • Surveillance and recertification preparation: open-finding review, evidence check
  • Audit-day accompaniment: auditee preparation, response coordination, clarification of findings
  • Finding closure: root cause, corrective action, verification of effectiveness

How it works

  1. Programme. Scope, criteria, frequency and auditor independence agreed.
  2. Plan. Audit plan and document request per audit.
  3. Fieldwork. Interviews, sampling and evidence review.
  4. Report. Findings, nonconformities and observations with their evidence.
  5. Follow-up. Corrective actions tracked to verified closure.

Where the work lives

Programme, plan, checklist, evidence links and findings are kept in the Audits module of the GRCex workspace; each finding opens a corrective action and closure is verified in the same record. External audit findings go into the same ledger, so one trail covers internal and external audits. Your own audit tool works too.

05

Management System Consultancy

Design and operation of ISMS, PIMS, BCMS and QMS, as one integrated system.

A management system that works is more than a certificate on the wall. We design the structure, the document system, the KPIs and the management review, integrate several standards into one set of controls and documents, and run the first cycle with you, or keep operating it for you.

Who it is for

Organisations with a certificate on paper but no working system; companies running several standards in separate silos; growing companies whose system must scale beyond the people who built it.

Engagement Project for the design; monthly or annual agreement for the operation.

Discuss your management system

What you get

  • Management system architecture: process map, roles and responsibilities, integration across standards
  • Document system: hierarchy, templates, review cycle, approval flow
  • KPI framework and measurement plan
  • Management review: agenda, inputs, outputs, decisions tracked as actions
  • Operating calendar: risk reviews, audits, training, supplier reviews, management reviews
  • Ongoing operation of the system, if you want it

How it works

  1. Assess. Current documents and records, and how the work is actually done.
  2. Design. Integrated structure, process owners, document hierarchy, KPIs.
  3. Build and migrate. Documents into the workspace, one control set mapped to every standard in scope.
  4. Run the first cycle. Audits, management review, improvement.
  5. Hand over or operate. Your team takes over, or we keep running it.

Where the work lives

In the GRCex workspace: one control set mapped to several standards, a single document module with versions and approvals, objectives and KPIs, and a management review whose decisions become tasks. The system runs in a tool, yours or ours, not in a consultant's spreadsheet.

Additional services

Operate the technical side with the same team.

Three services that keep the technical and third-party evidence flowing into the management system.

06

Vulnerability Management as a Service

External scanning through GRCex, triage, remediation tracking and reporting, as a continuous cycle.

We run your external vulnerability management cycle: scheduled scanning of your internet-facing assets, triage of the results, assignment to owners, remediation tracking and monthly reporting. Scanning is automated and non-intrusive; it is not a penetration test.

Who it is for

Organisations without a security team to own scan results; companies that need evidence of continuous vulnerability management for ISO 27001, NIS2 or DORA; teams receiving customer security demands.

Engagement Monthly or annual.

Start the scanning cycle

What you get

  • Asset scope confirmation and scan schedule
  • Monthly triage: false positives removed, severity validated, business context added
  • Remediation actions assigned with due dates by severity
  • Monthly report: new, open, closed and overdue findings, time to remediate
  • Re-scan verification after each fix

How it works

  1. Scope and authorisation. Asset list, ownership confirmation, scan windows.
  2. Baseline. First scan and triage.
  3. Monthly cycle. Scan, triage, assign, track, verify, report.
  4. Quarterly review. Trends, recurring root causes, process improvements.

Where the work lives

Scans run on the GRCex External Vulnerability Scanning module and findings are tracked in Vulnerability Tracking, linked to assets and risks, with the closure evidence kept on the finding. Findings can also be exported to your own ticketing or tracking tool.

07

Supplier Risk Programme

Supplier inventory, questionnaires, scoring, interviews and audits, contract clauses and periodic reassessment.

We set up and, if you want, run your supplier security programme: tier your suppliers by criticality, send the right questionnaire to each tier, score the answers, interview and audit the critical ones, put the right clauses in the contracts and reassess on a calendar.

Who it is for

Organisations with third-party obligations under NIS2 or DORA; companies with many suppliers and no assessment process; procurement teams asked to add security to onboarding.

Engagement Project for the set-up; monthly or annual agreement for the operation.

Set up supplier risk

What you get

  • Supplier inventory and criticality tiering
  • Questionnaire set per tier, aligned to ISO 27001 and your regulation
  • Scoring model and acceptance thresholds
  • Supplier interviews and supplier audits, remote or on site, for the critical tiers
  • Contract clause library: security, privacy, incident notification, audit rights, exit
  • Reassessment calendar and escalation path

How it works

  1. Inventory. Supplier list and tiering workshop.
  2. Design. Questionnaires and scoring, piloted with a small group of suppliers.
  3. Assess. Questionnaires sent and scored; interviews and audits for critical suppliers.
  4. Contracts. Clause review and support in negotiations.
  5. Operate. Reassessment, incident follow-up, reporting.

Where the work lives

The Suppliers module of the GRCex workspace sends the questionnaires and stores answers, scores, audit reports and contracts per supplier; supplier risks link to the risk register. Your own supplier management tool works too.

08

Awareness & Training

Role-based security and compliance training that leaves evidence behind.

Management briefings, all-staff awareness sessions and targeted training for IT, development, HR and procurement, plus internal auditor training for your own team. Every session produces attendance and assessment records that satisfy the training clauses of the standards and regulations you follow.

Who it is for

Organisations with a training obligation to satisfy, including the management-body training required by NIS2; companies after an incident; teams with a new management system to roll out.

Engagement Per session as a project, or an annual plan.

Plan the training

What you get

  • Annual training plan by role
  • Session materials and delivery, on site or remote
  • Attendance and assessment records
  • Management briefing on obligations and personal accountability
  • Internal auditor training for your team

How it works

  1. Needs analysis. Roles, obligations, current level.
  2. Plan. Calendar and content per role.
  3. Delivery. Sessions, assessments, records.
  4. Review. Effectiveness check and next year's plan.

Where the work lives

The training plan runs as tasks with owners, and attendance and assessment records are stored as evidence against the awareness control, in the GRCex workspace or your own tool, ready for the next audit.

Next step

Start with a scoping call.

Tell us which standard or regulation you are working towards and where you are today. We come back with a scope, a team and an engagement model.

Talk to us Explore the platform