A.5 — Information Security Policies
A.6 — Organisation of InfoSec
A.7 — Human Resource Security
A.8 — Asset Management
A.9 — Access Control
A.10 — Cryptography
A.11 — Physical Security
A.12 — Operations Security
A.13 — Communications Security
A.14 — System Acquisition
A.18 — Compliance
Compliance

SECURITY
AUDITING

Know exactly where your security controls stand — against the frameworks that matter to your customers, regulators, and board. Paragon audits with rigour, and reports with clarity.

View Audit Types
ISO
27001 Lead Auditors
300+
Audits Completed
96%
First-Time Cert Pass Rate
10+
Frameworks Covered
NDA
All Engagements
▸ ISO 27001 AUDITCyber Essentials Plus ▸ NIST CSF ASSESSMENTSOC 2 Readiness ▸ PCI DSS REVIEWInternal Control Audit ▸ SUPPLIER AUDITSGap Analysis ▸ MATURITY ASSESSMENTThird-Party Risk ▸ ISO 27001 AUDITCyber Essentials Plus ▸ NIST CSF ASSESSMENTSOC 2 Readiness ▸ PCI DSS REVIEWInternal Control Audit ▸ SUPPLIER AUDITSGap Analysis ▸ MATURITY ASSESSMENTThird-Party Risk
Audit Services

EVERY FRAMEWORK.
ONE TEAM.

Whether you're pursuing certification, satisfying a customer requirement, or simply want an honest picture of your security posture — we have the audit for it.

ISO 27001 Audit

Gap analysis, internal audit, and certification readiness assessment against ISO/IEC 27001:2022. We support you through the full ISMS audit cycle — from initial scoping to surveillance and recertification.

Gap AnalysisInternal Audit Stage 1 / Stage 2 PrepSurveillance

Cyber Essentials & CE+

Pre-assessment readiness review and technical verification for Cyber Essentials and Cyber Essentials Plus. We identify gaps before the assessor does — maximising your first-time pass rate.

CE ReadinessCE+ Technical Verification IASME Aligned

NIST CSF Assessment

Structured maturity assessment against the NIST Cybersecurity Framework — covering Identify, Protect, Detect, Respond, and Recover functions with a scored current-state vs target-state profile.

NIST CSF 2.0Maturity Scoring Roadmap Output

SOC 2 Readiness

Readiness assessment against SOC 2 Trust Services Criteria — identifying control gaps across Security, Availability, Confidentiality, Processing Integrity, and Privacy before your formal audit.

TSC MappingType I / Type II Prep Control Evidence Review

PCI DSS Compliance Review

Gap analysis and readiness assessment against PCI DSS v4.0 requirements — covering cardholder data environment scoping, control effectiveness, and SAQ/ROC preparation support.

PCI DSS v4.0CDE Scoping SAQ SupportQSA Liaison

Supplier & Third-Party Audit

On-site or remote audit of your suppliers, partners, and third parties — assessing whether their security controls meet your requirements and contractual obligations.

Vendor RiskQuestionnaire + Evidence Review On-Site Available

WHERE DO YOU ACTUALLY STAND?

Every audit begins with an honest maturity assessment. We score your organisation across five levels — giving you a clear, benchmark-comparable picture of your current security posture before we recommend anything.

1
Initial

Ad Hoc

Security practices are informal, undocumented, and inconsistently applied. Reactive to incidents.

2
Developing

Repeatable

Some policies and procedures exist but are inconsistently applied across the organisation.

3
Defined

Documented

Controls are documented, consistently applied, and aligned to a recognised framework.

4
Managed

Measured

Controls are monitored, metrics are tracked, and security decisions are data-driven.

5
Optimising

Continuous Improvement

Security is proactively improved, threat-intelligence driven, and embedded in culture.

GOVERNANCE OPERATIONS TECHNOLOGY COMPLIANCE PEOPLE
Audit Coverage

ISO 27001 CONTROL DOMAINS

Our ISO 27001 audits cover all 93 controls across 4 themes and 11 clauses of ISO/IEC 27001:2022. Here's an overview of what's assessed.

Domain Clause / Annex Key Controls Assessed Coverage
Organisational Controls Annex A.5 Policies, roles, responsibilities, supplier relationships, incident management Full
People Controls Annex A.6 Screening, terms of employment, awareness, disciplinary process, remote working Full
Physical Controls Annex A.7 Physical perimeters, entry controls, desk/screen, equipment security, clear desk Full
Technological Controls Annex A.8 Access control, malware, logging, vulnerability mgmt, network security, data masking Full
Leadership & Context Clauses 4–6 Context of the organisation, interested parties, scope, leadership commitment, policy Full
Risk Management Clause 6 & 8 Risk assessment methodology, risk register, treatment plan, Statement of Applicability Full
Performance & Improvement Clauses 9–10 Internal audit programme, management review, nonconformities, continual improvement Full

STRUCTURED FOR REAL OUTCOMES

We don't just hand you a list of failures. Every audit concludes with a prioritised, actionable improvement plan and hands-on support to help you address findings — not leave you alone with a report.

01

Scoping & Planning

We agree the audit scope, objectives, and methodology. For ISO 27001 this includes defining the ISMS boundary and identifying applicable controls.

1–2 Days
02

Document Review

Assessment of your policies, procedures, risk registers, and evidence documentation against the target framework's requirements.

2–5 Days
03

On-Site / Remote Interviews

Structured interviews with key personnel to verify that documented controls are understood and applied in practice — not just on paper.

1–3 Days
04

Technical Verification

Where applicable, technical controls are verified — configuration reviews, log sampling, access control testing, and patch status checks.

1–2 Days
05

Report & Improvement Plan

Full audit report with findings rated by severity, a prioritised remediation roadmap, and an executive summary suitable for board-level presentation.

Delivered within 5 days
What You Receive

AUDIT OUTPUTS THAT DRIVE CHANGE

Every engagement delivers a suite of documents designed to satisfy auditors, inform your leadership, and guide your remediation team.

Audit Report

Full findings document — conformities, non-conformities, and observations — mapped to the framework and rated by severity.

Executive Summary

Board-ready one-pager covering overall maturity score, key risks, compliance status, and recommended investment priorities.

Maturity Scorecard

Domain-by-domain maturity scoring with current state vs target state, benchmarked against industry peers where available.

Remediation Roadmap

Prioritised improvement plan with effort estimates, ownership guidance, and quick wins identified for immediate action.

Debrief Session

Live walkthrough of findings with your team — answering questions, clarifying priorities, and confirming next steps.

Post-Audit Support

30-day access to your auditor for follow-up questions, evidence queries, and guidance as you begin addressing findings.

Engagement Options

CLEAR, FIXED-FEE AUDIT PRICING

Scope is agreed upfront and the price is fixed. No day-rate uncertainty, no surprise extras.

Focused

GAP ANALYSIS

Snapshot assessment against a single framework

  • Single framework (ISO 27001, CE, NIST etc.)
  • Document review & policy assessment
  • Gap analysis report with findings
  • Prioritised remediation roadmap
  • Maturity scorecard
  • 1× debrief call
  • On-site / remote interviews
  • Technical control verification
Ongoing

AUDIT PROGRAMME

Annual internal audit cycle — retainer model

  • Everything in Internal Audit
  • Annual audit cycle management
  • Surveillance audit support
  • Continuous control monitoring
  • Policy review & update service
  • Management review facilitation
  • Certification body liaison
  • Discounted additional audits

COMMON QUESTIONS

An internal audit (like the one Paragon conducts) assesses your own ISMS or security controls against the standard — it's a requirement of ISO 27001 and serves as your readiness check before engaging a certification body. The certification audit is conducted by an accredited third-party certification body (such as BSI, Alcumus, or LRQA) who issues the certificate. Paragon prepares you for the certification audit and can support you through it, but we are not the certification body.

For a typical SME with a defined ISMS scope, a full internal audit takes 5–8 days of auditor time — spread across document review, interviews, and technical checks. Larger or more complex environments may require more time. We agree the programme plan at scoping stage so there are no surprises.

Yes. We regularly support organisations through their annual surveillance audits and three-year recertification cycles. This includes reviewing any changes to your ISMS since the last audit, updating your risk register and SoA, conducting a pre-surveillance internal audit, and liaising with your certification body on your behalf.

Yes — our audit reports are written to a professional standard and are widely accepted by enterprise customers, procurement teams, and regulators as evidence of security assessment. For formal third-party assurance, ISO 27001 certification from an accredited body remains the gold standard, and our reports explicitly support the path to achieving that.

Yes — and we strongly recommend it where there is meaningful overlap. ISO 27001 and NIST CSF share significant common ground, as do ISO 27001 and SOC 2. A combined audit avoids duplicating interviews and evidence collection, reducing the time and cost burden on your team while delivering coverage against multiple frameworks simultaneously.

KNOW YOUR GAPS
BEFORE YOUR AUDITOR DOES.

Book a free consultation and we'll outline exactly which controls need attention before your next audit or certification assessment.