Kellwick helps organisations assess security and compliance gaps, implement ISO management systems, prepare for DORA and NIS2, and strengthen cybersecurity governance using NIST CSF 2.0. From independent internal audits to ongoing GRC leadership, every engagement is scoped around your requirements.
Not sure where to start? See how we help or try the Service Finder.
What we do
Buy one, or combine them. An audit does not commit you to implementation, and implementation does not commit you to a retainer.
Independent internal, supplier and multi-standard audits, with findings supported by objective evidence and follow-up of the corrective actions they lead to.
Gap assessment, management system design and implementation, and preparation for the certification audit - for ISO 27001, ISO 9001 and ISO 42001.
Managed ISMS, QMS, AIMS and integrated systems on a monthly retainer, so the system keeps operating between certification audits.
Fractional CISO and GRC leadership, and readiness for DORA, NIS2, NIST CSF 2.0, SOC 2 and CMMC where they apply to you.
Core standards and frameworks
Certifiable ISO standards, EU regulation and voluntary frameworks are different things, and each page says which it is.
Also supported: SOC 2 readiness · GDPR & ISO 27701 · CMMC / NIST SP 800-171 · Integrated management systems - compare all standards and frameworks. We are not a certification body, a regulator, a CPA firm or a CMMC assessor.
What you receive
Every engagement names its deliverables before work starts. These are the ones clients ask for most.
Who we work with
The standards apply across sectors, and so does our work. We also serve manufacturing, professional services, healthcare technology, logistics, e-commerce and outsourcing providers. Four sectors get specialist attention because their risks and audit evidence are genuinely different.
All industriesAudit independence
Auditors must remain independent of the activities they audit. Where Kellwick has supported implementation or ongoing management, any subsequent internal audit is subject to an independence and conflict-of-interest review. The assigned auditor must not have participated in the work being audited. Where sufficient objectivity and impartiality cannot be assured, Kellwick will decline the affected scope or recommend independent external assurance.
Our internal audits are internal audits: they test your system against the standard and your own requirements. They are not certification audits, and a Kellwick audit report is not a certificate.
After certification
A certificate is renewed every three years and audited every year in between. Managed support keeps risks, objectives, records and corrective actions current, at a defined monthly capacity.
vCISO and fractional GRC
A vCISO sets security strategy, prioritises risk, runs the governance cadence and reports to management and the board - within an agreed mandate and monthly capacity. It is a different service from keeping an ISMS maintained, and we sell them separately.
Your management keeps its legal accountability and risk-acceptance authority. Not a 24/7 SOC or incident response service.
Qualifications and delivery
Kellwick works with suitably qualified professionals selected for each engagement: Lead Auditor-trained specialists, experienced consultants and independent contractors. Our auditors hold ISO/IEC 27001 Lead Auditor, ISO 9001 Lead Auditor and ISO/IEC 42001 Lead Auditor certification.
A Lead Auditor certificate qualifies someone to plan and lead audits. It is not an approval to audit for a certification body, and we do not present it as one.
How we staff engagementsLead auditor
Plans and leads internal, supplier and multi-standard audits; signs the audit report.
Implementation consultant
Designs and builds the management system with the client's owners: scope, risk method, processes, documented information.
Management system manager
Runs the monthly rhythm of a certified system under a retainer.
Fractional security / GRC lead
Senior governance and security leadership within an agreed mandate and monthly capacity.
Sector specialist
Brings sector-specific competence - financial services, AI - to an engagement led by one of the roles above.
International delivery
European Union
All Member States, including Croatia, Cyprus and Malta, with NIS2 read against each national law.
Malta and Cyprus
Financial services, gaming and their technology suppliers.
Norway and Switzerland
Norway is EEA (EU acts apply once incorporated); Switzerland is outside both. Domestic rules plus EU customers' contract requirements.
Serbia, Montenegro, Bosnia and Herzegovina
EU candidate countries with their own laws - quality, security and integrated systems.
United States and Canada
ISO standards alongside SOC 2, NIST CSF 2.0 and defence supply-chain requirements.
Document-led work - most ISMS and AIMS audits, gap assessments, governance and vCISO - runs remotely. Manufacturing and multi-site quality audits are done on site, and the proposal says which days are where.
Engagements are contracted with Sodasoft LLC, which operates the Kellwick brand. Regulations differ by country, and we work from each jurisdiction's own rules. We do not give legal opinions; where local legal interpretation is needed, it comes from qualified counsel.
Markets we serveHow an engagement runs
Not every client needs every stage. Many start and finish with one independent audit.
Agree the standards, sites, entities and objectives in writing before any work starts, so the price and the result are tied to the same scope.
Gap assessment or independent audit: what the system does today, measured against the applicable requirements, with objective evidence for every finding.
Implementation, corrective action or certification readiness - built with your owners so the system runs on your people, not ours.
Managed system support, recurring audit programmes or fractional leadership, at a defined monthly capacity. Optional, never a condition of the earlier stages.
FAQ
From procurement, quality, security and compliance teams alike.
No. Kellwick is an independent consulting and internal audit practice, not a certification body. Certificates are issued only by accredited certification bodies after their own Stage 1 and Stage 2 audits. We prepare you for that process, and we can audit your system internally; we do not certify it and cannot guarantee the outcome.
Sometimes, subject to an independence and conflict-of-interest review. Auditors must remain independent of the activities they audit: where we supported implementation or ongoing management, the internal audit is assigned to an auditor who did not participate in the work being audited, and that is written into the audit plan. Where sufficient objectivity and impartiality cannot be assured, we decline the affected scope or recommend independent external assurance.
Independent internal audits and audit programmes, preparation for surveillance and recertification audits, verification of corrective actions, and managed support for the system between audits - ISO 27001, ISO 9001, ISO 42001 or an integrated system. You can buy any one of these on its own.
Both, depending on the evidence. Document-led work such as an ISMS or AIMS audit usually runs remotely. Manufacturing and multi-site quality audits need someone on site, because the evidence is on the floor. The proposal states which parts are remote and which are onsite, and any travel cost.
Our core is ISO management systems: ISO/IEC 27001, ISO 9001, ISO/IEC 42001 and integrated systems combining them. Around that we support ISO/IEC 27701 and GDPR, DORA, NIS2, NIST CSF 2.0, SOC 2 readiness and CMMC / NIST SP 800-171 readiness. Each engagement is staffed by people qualified for the standard in scope.
We do not publish prices. Every engagement, including the Mini Gap Review, gets a fixed price in a written proposal after a short scoping conversation, because the cost depends on the standards, sites, entities, maturity, remote or onsite delivery and travel - not on headcount alone. Certification body fees, CPA firm fees for SOC 2, travel and taxes are separate from our fees and are shown separately.
A managed ISMS keeps an ISO 27001 system operating: risk register, Statement of Applicability, evidence schedule, corrective actions, management review. A vCISO provides senior security leadership: strategy, risk prioritisation, governance, executive and board reporting. Many clients need only the first. Your management keeps its legal accountability and risk-acceptance authority either way.
It depends on your sector, size, country and role. DORA applies directly to the financial entities it lists and reaches most ICT providers through their contracts with those entities. NIS2 applies through each Member State's own law, and not every country had completed transposition by October 2026. We start with an applicability assessment; we do not give legal opinions, and local legal interpretation needs qualified counsel.
Very little: which standards, how many sites or entities, any audit or certification dates, and what prompted the enquiry. Please do not send policies, risk registers or other confidential documents through the contact form. We work under NDA and your document-sharing process once an engagement is agreed.
Insights
SaaS is a recognised cloud service model - Recital 33 says so outright. But whether your specific product meets the operative Article 6(30) test is genuinely unsettled, and national regulators openly disagree on identical facts. Here is how to reason about it.
Read →vCISO & Security GovernanceA practical test for choosing between a vCISO and a Managed ISMS: what each produces, the decisions each one supports, and the signs you have outgrown one.
Read →Internal Audits & AssuranceHow to decide whether to run ISO internal audits with your own people, an external auditor or a mix - compared on cost drivers, independence and competence.
Read →Standards, sites, deadlines - a specialist replies within one business day with a proposed scope, or tells you plainly if we are not the right fit.
Kellwick is an independent consulting and internal audit practice. We are not a certification body and do not issue ISO certificates. Certification decisions are made only by accredited certification bodies.