Compliance built like infrastructure — not paperwork that ages.
We deliver complete certification programs for the frameworks your enterprise customers and regulators ask about — designed so the evidence holds up between audits, not just on audit week.
Frameworks engineered as systems, evidence produced once and reused.
The compliance market has trained organisations to expect a six-figure invoice for a binder. We do the opposite: build a single control framework, then map it once across ISO 27001, SOC 2, PCI, GDPR and NIS2. You write controls once and answer twelve customer questionnaires without rework.
Onidef leads each program with a CISA-certified senior auditor and an ISO 27001 Lead Auditor working in tandem with your engineering and security teams. We do not parachute in junior consultants on rotation.
The work is sequenced: a candid gap assessment first, then a control framework that fits your real operating model, then evidence collection automated where credible. Internal audit dry-runs precede every certifying-body visit so there are no surprises in the audit room.
After certification, we stay through surveillance audits and any incident reviews — the work does not end at the certificate. Your auditor relationship becomes a quiet, ongoing one rather than a six-week panic.
Six phases, fixed scope, predictable milestones.
Your team always knows what is happening this week, next week, and on audit day. No surprises, no scope creep, no last-minute evidence requests.
-
01 · DISCOVERGap assessmentThree- to four-week structured review against the chosen framework. We deliver a redacted readiness report, a remediation backlog, and a credible date for certification.
-
02 · DESIGNControl framework designA single ISMS or trust-services framework engineered for your stack and team size — mapped once, presented across each framework you need. Light on policy, heavy on operational reality.
-
03 · IMPLEMENTControl implementation & toolingWe pair with your engineers to ship the controls — access reviews, change management, vendor management, encryption posture, logging — automated where possible, with evidence pipelines that produce themselves.
-
04 · OPERATEOperating-period evidenceFor Type II / surveillance audits we run alongside your team through the operating period, sampling evidence weekly and intervening before drift becomes a finding.
-
05 · AUDITInternal audit & certifying-body liaisonWe perform the internal audit, coordinate with the external auditor or certifying body, and project-manage the audit window so your team is not derailed for a quarter.
-
06 · MAINTAINSurveillance & continuous improvementAfter certification, we hold the program. Quarterly reviews, surveillance audit support, control updates as your environment shifts. The certificate stays valid without becoming a tax on the rest of the year.
Artefacts that survive an auditor and serve sales the next day.
Every output is designed to be reused. The same evidence pack answers a SOC 2 auditor, a customer security questionnaire, and a procurement review.
Gap assessment report
Plain-English baseline. Control-by-control state, sized remediation backlog and a credible certification date.
Control framework
A single ISMS — policy, procedures, register of evidence — mapped across every framework you need. Maintained, not handed off.
Evidence library
A structured, versioned library of audit artefacts. Reusable across audits, customer reviews and internal investigations.
Internal audit pack
Pre-audit dry run with documented findings. The certifying-body visit is the second time you walk through the controls, not the first.
External audit liaison
We coordinate with the auditor, hold the timeline, and answer questions on your behalf so your engineers can ship.
Customer trust pack
A short, public document and a private long-form pack — the answers to 80% of inbound security questionnaires, written once.
The questions every team asks before starting a program.
If yours is not here, write to us. We will answer it in writing within one business day.