Turn security requirements into clear ownership and workable practice.
Security governance should make decisions easier. It should clarify who owns the risk, what must happen and how the organisation can demonstrate that it works.
FLODISQ helps organisations build or improve their Information Security Management System, translate ISO 27001 and regulatory requirements into usable policy, and establish a governance structure that fits the way the organisation actually operates.
Not more policy. Better decisions, clearer ownership and evidence that security is working.
When governance exists mainly on paper
Many organisations have security policies, risk registers and committees.
Yet decisions remain slow, ownership is unclear and the security team becomes responsible for problems that belong in the business.
Framework without ownership
The ISMS describes controls, but nobody is clearly accountable for the underlying risk.
Policy without practice
Documents meet the template but do not reflect real processes, roles or constraints.
Controls without evidence
The organisation believes controls exist but cannot show that they operate consistently.
Compliance without priority
Every requirement appears equally urgent, so resources are spread too thinly.
Security as a specialist problem
The CISO or ISO team advises, executes and chases, while business ownership disappears.
What FLODISQ builds
The service is centred on a complete, coherent ISMS documentation set. Each component has a purpose, an owner and a relationship to actual decision-making.
Governance model
Roles, mandates, decision rights, oversight and escalation.
Risk management method
A repeatable method for identifying, assessing, treating and accepting information security risk.
ISMS scope and context
Clear boundaries, interested parties, dependencies and applicability.
Policy framework
Short, principled policies that state what and why.
Procedures and work instructions
Practical descriptions of how responsibilities and controls are carried out.
Statement of Applicability
A defensible link between risk, selected controls and implementation status.
Registers and evidence
Risk, actions, exceptions, incidents, suppliers, audits and management review evidence.
Operating rhythm
Management review, internal audit, monitoring, reporting and continual improvement.
From direction to evidence
Good governance connects four levels. Each level has a different purpose and audience.
- PolicyWhat and why
Direction and principles approved by leadership.
- ProceduresHow it is organised
Who does what, when and through which process.
- Work instructionsHow work is performed
Concrete, role-specific steps for the people doing the work.
- Records & evidenceHow it is demonstrated
Logs, registers, decisions and outputs that show the system operates.
How FLODISQ works
- 01
Discover
Review existing governance, documentation, risks, processes and certification ambitions.
- 02
Define
Agree the ISMS scope, governance model, risk method, policy hierarchy and decision rights.
- 03
Draft
Create or improve the documentation set using clear language and the organisation’s real processes.
- 04
Validate
Work with owners and users to test whether roles, procedures and requirements are workable.
- 05
Operate
Run the first risk, review, audit and management cycles so the ISMS becomes a way of working.
- 06
Prepare
Close material gaps and assemble the evidence needed for internal or certification audit.
Our goal is not to leave behind a library of documents. It is to establish a management system that the organisation can operate and improve without permanent consultancy dependency.
Three ways to build workable governance
Start with clarity, build the documentation set, or take the ISMS all the way to audit readiness.
Governance & ISMS Blueprint
For organisations that need clarity before building.
- Current-state and gap review
- ISMS scope and context
- Governance and RACI model
- Policy and documentation architecture
- Risk management design
- Prioritised implementation roadmap
ISMS Documentation Build
For organisations that need a coherent ISO 27001 documentation set.
- Everything in Blueprint
- Core policies and procedures
- Risk methodology and templates
- Statement of Applicability structure
- Registers and evidence requirements
- Management review and internal audit framework
- Owner validation workshops
Audit-Ready ISMS
For organisations preparing for internal or certification audit.
- Everything in Documentation Build
- Support for first operational cycles
- Risk assessment and treatment support
- Internal audit preparation
- Management review preparation
- Evidence and readiness review
- Prioritised remediation plan
A proportionate route to certification without building a corporate bureaucracy.
Smaller organisations often need ISO 27001 certification quickly to meet customer, procurement or market requirements. They do not need a large-company ISMS copied into a smaller business.
FLODISQ uses a focused approach for SMEs: narrow the scope, reuse what already works, document only what is needed, assign clear owners and build evidence while the ISMS is being implemented.
- 01
Scope
Define a controlled and certifiable scope around the services, locations and systems that matter.
- 02
Baseline
Complete a rapid gap assessment and identify the shortest defensible path to readiness.
- 03
Build
Create the core ISMS documentation, risk method, Statement of Applicability and evidence structure.
- 04
Operate
Run the required risk, review, audit and management activities.
- 05
Prepare
Conduct a readiness review and support preparation for Stage 1 and Stage 2 certification audits.
SME ISO 27001 Fast Track
For a clearly bounded SME scope with engaged management and a reasonable existing baseline. Certification body fees, technical remediation and external certification audits are not included.
Explore ISO 27001 readiness- Typical lead time: 12–20 weeks
- Depends on scope and existing maturity
- Depends on management availability
- Depends on the speed of closing technical or operational gaps
Pricing model
The packages provide a clear starting point. Final scope and price depend on organisational complexity, number of entities and locations, existing documentation, certification scope, required workshops and the amount of implementation support.
| Service | Starting price | Indicative duration |
|---|---|---|
| Governance & ISMS Blueprint | From €7,500 | 2–4 weeks |
| ISMS Documentation Build | From €22,500 | 6–12 weeks |
| Audit-Ready ISMS | From €45,000 | 3–8 months |
| SME ISO 27001 Fast Track | From €17,500 | 12–20 weeks |
| Governance advisory support | From €1,200 per day | As required |
All prices exclude VAT and travel. External certification fees, technical implementation, tooling and remediation work are excluded unless explicitly included. Starting prices assume timely access to relevant documentation and decision-makers.
What you get
A governance structure with explicit ownership and decision rights
A risk method that supports prioritisation and acceptance
An ISO 27001-aligned documentation set written for actual users
A clear relationship between policies, procedures, evidence and controls
An operating rhythm for review, audit and continual improvement
A realistic route to audit readiness or certification
Governance should make security workable.
Whether you need to repair an existing ISMS, build the documentation framework or prepare an SME for ISO 27001 certification, FLODISQ starts with the same question: what must this organisation be able to decide, do and demonstrate?