GDPR document pack
Privacy statement, cookie statement, processing register and a data processing agreement template.
Compliance readiness for software and service companies
Your management system,
built and documented,
prepared for your audit.
Two ways to get there. Have Bram lead your certification project, or order standard compliance work at a fixed price and a fixed date.
Fixed published prices. Half at order, half at the audit milestone.Gap report, exampleISO 42001 readiness
68%Partly ready. 9 of 28 items open.
- 6.1.4AI system impact assessmentNot in place
- 5.3Roles and responsibilitiesIn place
- A.6.2AI system life cyclePartly
- A.7.4Quality of data for AI systemsPartly
Recommended pace: Versneld, ready in 4 months.MB-2026-0142
Work with BramBram leads your projectISO 42001 and ISO 27001 readiness, SOC 2 and ISAE 3402. Bram runs the work with your team, from scope to the auditor's visit.From EUR 6,000, fixed per engagementSee the engagements Standard servicesFixed price, fixed dateGDPR documents, DPIAs, internal audits, security questionnaires and more. Ordered online, delivered on a schedule, checked against a fixed method.From EUR 195See the standard services
Standards we prepare you forISO 42001ISO 27001SOC 2ISAE 3402NIS2DORAGDPR
Standard services
Fixed price, scheduled
Standard compliance work, done the same way every time by vetted specialists with a fixed method. Pick a start date, pay online, receive it in your portal.
Privacy
DPIA for one processing activity
A data protection impact assessment for one processing activity, from a two-hour session to a signed-off report.
Data processing agreement review
One data processing agreement checked against Article 28 GDPR, with the points to raise.
Security
Security questionnaire answered
A customer's security questionnaire answered from your own practices and evidence.
Information security policy pack
Eight information security policies written for your organisation, aligned to ISO 27001.
Information security risk assessment
A three-hour risk session with your team, a risk register and a treatment plan.
Incident response plan and exercise
An incident response plan for your organisation and a tabletop exercise to test it.
Security awareness session
A 90-minute online awareness session for up to 25 staff, with an attendance record.
Audit
ISO 27001 internal audit
An independent ISO 27001 internal audit on a date you book, with a report 5 working days later.
ISO 42001 internal audit
An independent ISO 42001 internal audit on a date you book, with a report 5 working days later.
Management review, prepared and minuted
Your yearly management review prepared, chaired and minuted as the standard requires.
Regulation
NIS2 and Cyberbeveiligingswet scan
Whether NIS2 and the Cyberbeveiligingswet apply to you, and the gaps against the required measures.
EU AI Act classification
Up to three AI systems classified under the EU AI Act, with your role and the obligations that follow.
DORA gap scan
A gap scan against DORA for financial entities and their ICT suppliers.
Surveillance retainer, after certification
A monthly retainer keeps your certified management system current: reviews, updates, the internal audit and the management review.
BasisEUR 250per month
PlusEUR 450per month
PremiumEUR 650per month
Work with Bram
Bram on your project
For a certification project, Bram leads the work himself: he builds the management system with your team, from scope to the handover to your certification body.
ISO 42001
AI system register, AI policy, risk and impact assessments, Annex A controls, evidence and audit preparation.
From EUR 6,000Deliverables and priceISO 27001
Information security management system, risk assessment, Statement of Applicability, control design and audit preparation.
From EUR 6,000Deliverables and priceISO 27001 and ISO 42001
One management system that covers both standards, built once and audited together.
Quoted on requestDeliverables and priceSOC 2 and ISAE 3402
Readiness for the assurance reports your customers ask for: scope, control design, evidence and auditor preparation.
EUR 1,100 per dayDeliverables and priceMethod
Four stages, each with an output
The same method for every standard. Each stage ends with something you can show to a customer or an auditor.
- 01
Readiness check
Score your organisation against the standard's clauses and controls in about ten minutes.
OutputA gap report
- 02
Readiness engagement
We build the management system with your team: scope, policy, registers, risk assessments, procedures and evidence.
OutputAn audit-ready management system
- 03
Certification audit
An accredited certification body audits you. It may not advise you, so we prepare you and hand over.
OutputThe auditor's decision
- 04
Surveillance
Certificates are audited every year and renewed every three. We keep the system current in between.
OutputA system that passes each yearly audit
Prices
Engagement prices
Every readiness engagement with Bram delivers the same set of documents and evidence. The pace sets the price. Order online, pay the first half, and the work starts.
Standaard
EUR 6,000
A steady pace for a first audit.
OrderVersneld
EUR 9,000
For an audit date that is already set.
OrderSpoed
EUR 12,000
When the auditor is booked and time is short.
OrderSOC 2, ISAE 3402 and other advisory work is billed at Bram's day rate: EUR 1,100 per day.
Indicative prices, excluding VAT. Half at order, half at the certification-audit milestone. Not included: the certification body's own audit fee, typically EUR 6,000 to EUR 12,000, paid directly to them.
Why us
A management system someone owns
Certificates are usually lost at the surveillance audit, when nobody owns the system any more. We build the ownership in: who decides, who reviews, and what happens when something changes.
Done from the inside
Bram led ISO 27001 certification as COO of a software company. He knows the questions an auditor asks because he has prepared for them.
Fixed scope and price
Three paces with published prices. Half at order, half at the audit milestone. No hourly billing on engagements.
Documents you keep
Policies, registers and procedures are written for your organisation and stored in your client portal. They are yours to adopt and keep.
ISO 42001 and ISO 27001 readiness check
Free readiness check
Pick a standard and answer the questions on its clauses and controls. The score is worked out in your browser and never leaves it.
About
Bram HirschFounder
Bram Hirsch
Twenty years running operations across more than 25 countries: shared services, process architecture, transitions and complex IT implementations, most recently as COO of a software company.
He treats compliance as a process your organisation owns, not a document to be produced. Specialists work with the same methods and templates.
- ISO 27001Led certification as COO, with a full Statement of Applicability
- SOC 2Implemented the programme, alongside FSQS for financial-services customers
- EU AI ActLed the company AI policy and aligned it to the Act
- ISAE 3402Built an ISAE 3402 and ISO 27001 ready operating model
Questions
Before you order
Who does the certification audit?
An accredited certification body that you choose and contract. It may not advise you, which is why you need a readiness partner. We never audit what we built.
Can you guarantee certification?
No. We prepare you; your certification body decides. The deliverables on each service page describe the work we do.
Can we start from what we already have?
Yes. The engagement starts from your existing processes and evidence and only builds what is missing.
What is not included?
The certification body's own audit fee, which you pay to them directly, and VAT.
How do we pay?
Half when you order and half at the certification-audit milestone. Online payment opens once the company's payment account is live.
Is this legal advice?
No. We are compliance specialists, not lawyers. We describe what a standard or regulation asks and how to organise it; decisions stay with your organisation. Where a contract or a legal position is at stake, involve your lawyer.
Next step
Start with the free readiness check
Ten minutes. A gap report you can keep.
Run the readiness checkResults stay in your browser.