Resources & guides

Plain-English guides to the standards you run.

No gated PDFs, no lead-capture walls. Practical explainers on ISO and EHS management systems, plus the free diagnostic tools that need no sign-up.

Standards

Understand the standard before you buy anything.

Guide · AI governance

ISO 42001 explained, in plain English

The first AI management-system standard: what it is, who needs it, how it's structured, and how to approach it without starting from scratch.

Read the guide → Guide · Responsible AI

Using AI responsibly — with a human in the loop

AI speeds up real work, and it can be confidently wrong. How to keep a person in the loop, and why that maps to ISO 42001.

Read the guide → Guide · Standards

ISO 27001 vs ISO 42001: what's the difference?

One protects information, the other governs AI — but they share a backbone. What each covers, where they overlap, and how to run both as one system.

Read the guide → Guide · Standards

Cyber Essentials vs ISO 27001

Pass/fail technical hygiene versus a full information-security management system. How they compare, where they overlap, and which you actually need.

Read the guide → Guide · Standards

SOC 2 vs ISO 27001

A US attestation report versus an international certificate. Type 1 vs Type 2, where they overlap, and which your customers actually want.

Read the guide → Guide · Information security

ISO 27001 evidence: what auditors actually want

A walk through the evidence that satisfies an ISO 27001 surveillance visit — and how much of it Microsoft 365 can produce on its own.

Read the guide → Reference · Microsoft 365

Which Microsoft 365 signals become ISO audit evidence

A reference mapping Entra, Defender, Purview, Intune and audit logs to the ISO 27001 controls they help evidence — and the step that makes a live setting count.

Read the reference → Guide · Integrated systems

Running ISO 9001, 14001 and 45001 as one system

Why an integrated management system beats three parallel ones — shared documents, shared audits, one management review.

Read the guide →

Choosing an approach

The right kind of tool for the job you actually have.

Guide · Positioning

GRC tools vs an integrated management system

Vanta and Drata own SOC 2 automation. An IMS runs quality, environment, safety and security — plus field EHS — as one live system. Where each genuinely fits.

Read the guide →

Practice

Win the work, and keep it from slipping.

Guide · Certification & tenders

Do you need ISO certification to win tenders?

Often, yes — and increasingly so. Where ISO 9001, 14001, 45001 and 27001 show up in pre-qualification, and what to do if you're not certified yet.

Read the guide → Guide · Operations

How the right tools stop work slipping through the cracks

Why work gets missed as a business grows, what it costs, and what changes when the record lives in a system rather than in someone's head.

Read the guide → Guide · EHS

The real cost of a workplace incident

Beyond the insurance excess: the uninsured costs that never reach a spreadsheet, and why near-miss reporting is the cheapest safety investment you can make.

Read the guide →

Getting certified