ISO 27001 & 42001 Assurance Launch Roadmap

1.1 Where You Are Now

The research gives a clear structure. The practice's destination is the TOP opening: ISO 42001 readiness and internal audit for the UK public sector and defence supply chain, sold through G-Cloud and bundled onto ISO 27001, at £500 a day. The call on it is CAUTION. It becomes a GO the moment two things are true: a first public-sector reference, and security clearance or a cleared partner to deliver through. Neither is in place today, and going straight at the TOP from three projects and no clearance is the version that fails.

So the practice starts where it can start on Monday. The QUICK WIN: outsourced ISO 27001 internal audit and second-party supplier assurance for the roughly 3,300 to 4,500 UK organisations that already hold a certificate. Every one of them is required to run internal audits, and none of that work is gated by accreditation. It pays now at around £500 a day, Prasanna delivering and David selling. It builds the logged audit record the practice needs, and it is the correct on-ramp to everything above.

Position assessment

1.2 The Three Openings and Your Ramp

The research lays out three openings at increasing distance. The honest sequence is to earn from the first while building towards the third.

Ramp to a living income: 12 to 18 months, and only if the QUICK WIN line is running throughout. The honest sequence is to earn from internal audit now, use it to build both a logged audit record and a public-sector reference, then attack the 42001 gap from a position a buyer can actually score.

1.3 Verdict and Wedge

Primary call: ISO 42001 readiness and internal audit for the UK public sector and defence supply chain, sold through G-Cloud, bundled onto 27001. £500 a day. CAUTION, with a clear compliance path. Becomes a GO with a first public-sector reference and clearance or a cleared partner.

Secondary: integrated 27001 + 42001 for SaaS scaleups, CAUTION (297 competitors, platform-substituted). Not now: third-party contract auditing for certification bodies, NO-GO at 42001 in the UK, one accredited body.

The wedge: the 297-to-5 supply gap on G-Cloud is one a newcomer can capture. The listing gap is observed and counted live; the purchasing gap is an assumption, since no award or spend data confirming unmet demand was found. Overall confidence: medium. Call: CAUTION, becoming GO the moment a reference and clearance are in place.

2.1 Phase 1: the QUICK WIN (27 July to 4 September 2026)

Week 1 is taken directly from the research's "zero to first deliverable" plan. Weeks 2 to 6 extend it into an activation sequence; treat those as my construction on top of the source.

Week 1: Foundation and First Deliverable (27 to 31 July)

Goal: stand up the QUICK WIN and build the MIDWAY artefact in the same week.

The core artefact (Mon to Tue)

• PRASANNA Build the ISO 27001-to-42001 two-way control mapping. AI-draft it, then hand-verify every row against both standards. Never ship an unverified mapping. This is the artefact everything else hangs off.
• PRASANNA In parallel, draft the repeatable internal-audit programme template and report format. This is all the QUICK WIN needs technically, and it lets David sell from Monday.

Productise (Wed)

• DAVID PRASANNA Turn the mapping into a fixed-scope gap-analysis product on one page: scope, inputs required, day count, deliverable list and price. Prasanna scopes and sizes it; David prices and writes it for a buyer.

Free pilot (Thu)

• DAVID PRASANNA Run the gap analysis free, end to end, on one friendly existing 27001 contact. David sources and books the contact; Prasanna delivers it. This produces the first reference and exposes the parts of the method that do not work.

Publish (Fri)

• DAVID Write the anonymised findings up as a public piece, drawing on Prasanna's pilot notes. 35% of 42001 adverts cite "blog" and 35% "workshop facilitation"; visible explanatory work is how this niche is bought.

Week 2: Capability and Network Activation (1 to 7 August)

Goal: build the capabilities buyers assume, and open 3 to 5 conversations.

• PRASANNA Stand up a small Azure AI deployment; be able to discuss where a model runs, what data it touches and how logging works (45% of adverts cite Azure, 40% Microsoft).
• DAVID PRASANNA Read the government AI Playbook and the DSIT assurance roadmap; Prasanna checks the technical content against source, David turns it into a client-facing one-pager on each.
• DAVID Outreach to the existing 27001 network and targeted certificate-holders. Diagnose, do not pitch. Where pain and budget are real, offer the internal audit (earns now) or the gap analysis.

Week 3: First Paid Pitch (8 to 14 August)

Goal: submit your first paid proposal. Lead with the internal audit, which earns immediately.

• DAVID Proposal essentials: problem in the client's language; scope explicitly bounded and honouring impartiality (the practice cannot both consult and later certify the same client); measurable deliverables; fixed day rate; 50% deposit and 50% on delivery; stated assumptions.
• DAVID PRASANNA Legal minimum, arranged jointly: PI insurance covering ISO advisory and audit work; solicitor-reviewed terms of engagement with a data-handling clause; never present 42001 as EU AI Act compliance.

Weeks 4 to 6: Deliver, Document, Build the Record (15 August to 4 September)

Goal: win engagement #1, deliver, capture proof, and prepare the ground for TOP.

• DAVID PRASANNA If it signs: Prasanna executes the internal audit and logs every audit day; David captures a testimonial before the final invoice, writes the anonymised case study and asks who else needs this.
• DAVID If nothing signs by Week 4: diagnose offer, pricing, target or reach. Consider a pro-bono internal audit for a charity holding 27001 to generate a live reference. One week maximum.
• DAVID PRASANNA Learn in parallel, as TOP preparation: Prasanna covers the EU AI Act boundary (a liability topic, from source); David drafts the G-Cloud service definition, then has a model adversarially score it.

2.2 Phases 2 and 3: MIDWAY and TOP

Phase 2: MIDWAY, fixed-fee 42001 gap analysis (from October 2026)

Goal: convert warm 27001 contacts into paid gap-analysis engagements at £2,500 to £7,500.

• PRASANNA Finish the ISO 42001 course. Keep the control mapping current as the standards evolve.
• DAVID Sell the productised gap analysis first to the warm list built in Phase 1, using the published pilot as proof.

Phase 3: TOP, G-Cloud public-sector supplier (from 2027, clearance permitting)

Goal: become a named G-Cloud supplier for combined 27001 + 42001 public-sector programmes.

• PRASANNA Resolve the clearance gate: pursue own sponsorship or line up a cleared delivery partner.
• DAVID PRASANNA Convert a QUICK WIN or pro-bono engagement into the first public-sector reference.
• DAVID Write and submit the G-Cloud service definition, scored against the buyer guidance.

2.3 Month 2 Decision Tree (September 2026)

2.4 Lead Generation and Sales Track (David's Focus)

DAVID This is the engine that runs underneath every week and phase above. Prasanna's side produces a sellable, defensible thing; this track is what turns it into booked, paid engagements. It is constructed for this version of the roadmap, built out from the brief rather than the source research, and should be corrected as real pipeline data comes in.

• Named prospect list. The 10-name list from the Critical Questions section, extended to a working list of UK 27001 certificate-holders, refreshed monthly. This is the base the QUICK WIN and MIDWAY openings both sell against.
• Outreach cadence and channels. 15 to 20 personalised messages a week during the launch weeks, dropping to a steady weekly cadence once engagement #1 is delivered. LinkedIn and direct outreach to certificate-holders and their supply chains are the primary channels; adverts already show 35% of the niche is bought through blog and workshop visibility, so publishing counts as outreach.
• Proposal and pricing templates. One template each for the internal audit and the gap analysis, both built once in Week 3 and reused, so every proposal is fast to turn around and consistent on scope, impartiality wording, day rate and deposit terms.
• Pipeline tracker. A single live tracker (prospect, stage, value, next action, owner) that both partners can see, so Prasanna knows what is coming and David knows what needs chasing.
• Referral loop. A fixed step at the end of every engagement: capture the testimonial, ask who else needs this, and log the referral into the tracker before the final invoice goes out.
• Sales collateral. The one-page gap-analysis offer, the published pilot write-up and case studies, and a one-page site last, once there is proof to put on it, in that order.

3.1 Commercial Foundations Checklist

MUST DO items should be complete before your first paid engagement. SHOULD DO items strengthen your position. COULD DO items are the TOP-opening groundwork for later.

3.2 Guard Rails (Non-Negotiable Rules)

3.3 Critical Questions to Answer This Week

• DAVID Who specifically is the client? Name 10 real UK organisations that already hold ISO 27001 and could buy an internal audit or a 42001 gap analysis. If you cannot name 10, the target is too vague.
• PRASANNA Can you clear the clearance gate? Does Prasanna hold, can he sponsor, or can the practice partner for the security clearance the TOP opening needs? Start this now, not in month six.
• DAVID PRASANNA Where will the first public-sector reference come from? Which QUICK WIN or pro-bono engagement could become it?
• DAVID PRASANNA What is each partner's minimum viable income? This sets how hard the QUICK WIN pipeline is pushed while the ramp builds, and how the revenue is split.
• DAVID PRASANNA Full-time or alongside employment, for each of you? This changes capacity and urgency across a 12 to 18 month ramp.

4.1 The AI Angle (Comment)

This is the observation that should shape how you spend your hours. AI leverage on your work is real but asymmetric between the two halves of the business.

Leverage, on the delivery side. Drafting AIMS and ISMS documentation, mapping 27001 Annex A controls to 42001, generating audit checklists and writing findings reports are all tasks where AI meaningfully compresses the day count. If an engagement is priced at 8 days and delivered in 5, that gap is your margin.

Risk, on the same side. That is exactly the work the platforms automate and sell as a subscription. Compliance-automation vendors claim 90% or more of ISO 27001 controls can be evidence-tested automatically, and AIMS modules are already live on UK platforms at around £6,995 a year. Document production is the commoditising half of the job.

Net. For implementation, AI leverage does not clearly beat the commoditisation it invites; you would be using AI to compete on a task that software is eating. For audit, it does: an audit requires a named human to test evidence and sign an opinion, and no platform can supply that. Weight your time towards the audit side, which is also where your actual qualification sits.

4.2 Financial Snapshot

Monthly costs (from launch)

Revenue targets across the ramp

5.1 What Your Position Now Unlocks

5.2 The Bottom Line

The destination is the TOP opening, ISO 42001 readiness and internal audit for the public sector through G-Cloud, but it is gated on a reference and clearance the practice does not yet hold, so chasing it first is the version that fails. The route that pays this month and builds towards it is the QUICK WIN: internal audit and second-party assurance for the thousands of UK organisations already holding 27001. Prasanna builds the mapping and the audit template while David builds the pipeline; together, productise the gap analysis, run one free pilot, publish, then pitch. Earn from audit now, weight delivery time away from the half that software is automating, and let each engagement manufacture the reference the top opening needs.