FAQs — BK17

Question 1

How long does ISO 27001 certification take?

Accepted Answer

For most organisations, the implementation journey takes 3–6 months from gap assessment to Stage 2 audit. Timeline depends on the size and complexity of your scope, the maturity of existing controls, and how quickly your team can engage with the process. BK17 typically completes implementations in 12–16 weeks for SMEs.

Question 2

Do we need ISO 27001 if we already have Cyber Essentials?

Accepted Answer

Cyber Essentials and ISO 27001 serve different purposes. Cyber Essentials is a baseline technical control check. ISO 27001 is a full management system standard covering governance, risk, people, processes, and continual improvement. Many organisations hold both, and BK17 can run them as a combined programme.

Question 3

What is the difference between ISO 27001 and ISO 27701?

Accepted Answer

ISO 27001 covers information security management. ISO 27701 is a privacy extension that adds requirements for managing personally identifiable information — effectively a Privacy Information Management System. ISO 27701 requires ISO 27001 as a prerequisite. BK17 can implement both as an integrated programme.

Question 4

Can we maintain ISO 27001 certification ourselves after implementation?

Accepted Answer

Yes — but most organisations find that without dedicated resource, their management system drifts within 6–12 months of certification. TheMS is designed to solve this: BK17 acts as your ongoing compliance function, keeping the system live and audit-ready year-round.

Question 5

What does ISO 9001 certification demonstrate?

Accepted Answer

ISO 9001 demonstrates that your organisation has a documented, audited quality management system. It signals to customers, procurement teams, and regulators that your processes are controlled, your outputs are consistent, and your organisation is committed to continual improvement.

Question 6

How long does ISO 9001 take to implement?

Accepted Answer

Most SMEs can achieve ISO 9001 certification within 8–14 weeks with BK17 support. The timeline depends on the complexity of your processes and the maturity of your existing documentation. BK17 builds the management system inside TheMS so it is live and maintainable from day one.

Question 7

Can ISO 9001 be integrated with other ISO standards?

Accepted Answer

Yes. ISO 9001 shares the same High Level Structure (HLS) as ISO 14001, ISO 45001, ISO 27001, and ISO 22301. BK17 routinely implements integrated management systems covering two or more standards simultaneously, reducing duplication and audit overhead.

Question 8

Who needs ISO 14001?

Accepted Answer

Any organisation that wants to demonstrate environmental responsibility, win contracts that require it, or reduce the risk of regulatory non-compliance. It is increasingly required in public sector procurement and supply chain prequalification schemes such as SSIP.

Question 9

Does ISO 14001 require us to measure our carbon footprint?

Accepted Answer

ISO 14001 requires you to identify and manage your significant environmental aspects — which typically includes energy use and emissions. It does not mandate a specific carbon accounting methodology, but BK17 can integrate carbon measurement into your EMS as part of the implementation.

Question 10

How does BK17 approach ISO 14001 implementation?

Accepted Answer

Our environmental management lead has direct experience managing environmental compliance in regulated industries. We build your EMS inside TheMS, conduct your initial environmental review, and prepare you for Stage 1 and Stage 2 audit — then maintain the system on your behalf.

Question 11

What is the difference between ISO 45001 and ISO 45003?

Accepted Answer

ISO 45001 covers occupational health and safety management — physical hazards, risk assessments, incident management. ISO 45003 extends this to psychosocial risks: stress, burnout, harassment, and mental health at work. BK17 can implement both as an integrated OH&S management system.

Question 12

Is ISO 45001 a legal requirement?

Accepted Answer

ISO 45001 is not a legal requirement in the UK, but it demonstrates compliance with the Health and Safety at Work Act 1974 and associated regulations. It is increasingly required in public sector contracts and supply chain prequalification schemes.

Question 13

Who leads BK17's health and safety work?

Accepted Answer

Our H&S practice is led by a qualified occupational health and safety professional with direct experience in regulated industries. They have implemented ISO 45001 and ISO 45003 across manufacturing, construction, and professional services organisations.

Question 14

What does ISO 22301 cover?

Accepted Answer

ISO 22301 is the international standard for Business Continuity Management. It requires organisations to identify threats to their operations, assess their impact, and build documented, tested plans to maintain critical functions during and after a disruption.

Question 15

How does ISO 22301 relate to ISO 27001?

Accepted Answer

ISO 27001 includes business continuity as a control domain (A.17 in the 2013 version, A.5.30 in 2022). ISO 22301 goes much further — it is a standalone management system standard for continuity. BK17 can implement both as an integrated programme, avoiding duplication.

Question 16

Do we need to test our business continuity plans?

Accepted Answer

Yes — ISO 22301 requires documented exercises and tests of your continuity plans at planned intervals. BK17 designs and facilitates tabletop exercises, walkthroughs, and live tests as part of the implementation and ongoing maintenance programme.

Question 17

What is ISO 42001?

Accepted Answer

ISO/IEC 42001:2023 is the first international standard for Artificial Intelligence Management Systems. It provides a framework for organisations to govern the responsible development, deployment, and use of AI — covering risk, transparency, accountability, and continual improvement.

Question 18

Who needs ISO 42001?

Accepted Answer

Any organisation that develops, deploys, or uses AI systems — particularly those in regulated sectors, those supplying AI to enterprise or government clients, or those seeking to demonstrate responsible AI governance ahead of incoming regulation such as the EU AI Act.

Question 19

How quickly can we achieve ISO 42001 certification?

Accepted Answer

BK17 has developed a structured ISO 42001 implementation programme that typically takes 10–16 weeks for organisations with existing AI governance awareness. We build your AIMS inside TheMS and prepare you for certification audit with a qualified lead auditor.

Question 20

What is the difference between Cyber Essentials and Cyber Essentials Plus?

Accepted Answer

Cyber Essentials is a self-assessment certification verified by a certifying body. Cyber Essentials Plus includes an independent technical audit — a vulnerability scan and hands-on testing of your controls. CE+ provides stronger assurance and is required for some government contracts.

Question 21

Is Cyber Essentials mandatory for government contracts?

Accepted Answer

Cyber Essentials is mandatory for all UK government contracts that involve handling personal data or providing certain ICT products and services. It is also increasingly required in supply chain prequalification and by prime contractors in the defence sector.

Question 22

How does BK17 support Cyber Essentials certification?

Accepted Answer

BK17 conducts a pre-assessment gap analysis, remediates identified weaknesses, and supports you through the certification process. For CE+, our technical team conducts the required vulnerability assessment and prepares your evidence pack for the certifying body.

Question 23

What types of penetration testing does BK17 offer?

Accepted Answer

BK17 offers network penetration testing (internal and external), web application testing, social engineering assessments, and red team exercises. All testing is conducted by qualified professionals and scoped to your specific risk profile and compliance requirements.

Question 24

How often should we conduct penetration testing?

Accepted Answer

Most compliance frameworks — including ISO 27001, Cyber Essentials Plus, and SOC 2 — recommend annual penetration testing as a minimum. BK17 recommends testing after significant infrastructure changes, new application deployments, or following a security incident.

Question 25

What do we receive at the end of a penetration test?

Accepted Answer

BK17 delivers a detailed technical report covering all findings, risk ratings, and remediation recommendations — plus an executive summary suitable for board and client presentation. We also offer a remediation review to confirm that identified vulnerabilities have been addressed.

Question 26

What is SOC 2 and who needs it?

Accepted Answer

SOC 2 is an American Institute of CPAs (AICPA) framework for service organisations that store, process, or transmit customer data. It is increasingly required by US enterprise clients and investors as evidence of security, availability, and confidentiality controls. BK17 supports UK organisations seeking SOC 2 Type I and Type II reports.

Question 27

Does NIS2 apply to UK organisations?

Accepted Answer

NIS2 is an EU directive that applies directly to organisations operating within the EU. UK organisations are not directly subject to NIS2 post-Brexit, but those with EU operations, EU customers, or EU supply chain relationships may face indirect requirements. BK17 can assess your NIS2 exposure and implement appropriate controls.

Question 28

What is CMMC and who does it apply to?

Accepted Answer

The Cybersecurity Maturity Model Certification (CMMC) is a US Department of Defense framework that applies to all organisations in the Defence Industrial Base (DIB) — any company that handles Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) under a DoD contract.

Question 29

What level of CMMC do we need?

Accepted Answer

CMMC Level 1 applies to organisations handling FCI only — 17 basic practices. Level 2 applies to organisations handling CUI — 110 practices aligned to NIST SP 800-171. Level 3 is for the most sensitive programmes. BK17 will assess your contract requirements and CUI handling to determine the correct level.

Question 30

Is BK17 authorised to support CMMC assessments?

Accepted Answer

Yes. BK17 is a Registered Practitioner Organisation (RPO) under the CMMC Accreditation Body — one of a small number of UK firms with this status. Our RPO status authorises us to provide CMMC consulting and readiness support to organisations in the US defence supply chain.

Question 31

How long does CMMC readiness take?

Accepted Answer

For organisations starting from a low baseline, CMMC Level 2 readiness typically takes 6–12 months. BK17 conducts a gap assessment against NIST SP 800-171, builds a System Security Plan (SSP) and Plan of Action and Milestones (POA&M), and implements controls progressively to reach assessment readiness.

Question 32

What is Defence Cyber Certification?

Accepted Answer

Defence Cyber Certification (DCC) is the UK Ministry of Defence's cyber security assurance framework for the defence supply chain. It replaces the previous Cyber Risk Profile approach and aligns with JSP 440 and JSP 604. BK17 is a registered DCC consultancy.

Question 33

What is Def Stan 05-138?

Accepted Answer

Defence Standard 05-138 is the MoD's cyber security standard for defence suppliers. It defines the security requirements that organisations must meet to handle defence information and operate within the defence supply chain. BK17 supports organisations through Def Stan 05-138 compliance.

Question 34

Do we need DCC if we already have ISO 27001?

Accepted Answer

ISO 27001 provides a strong foundation, but DCC has specific requirements relating to defence information handling, classification, and supply chain security that go beyond ISO 27001. BK17 can map your existing ISO 27001 controls to DCC requirements and identify the gaps.

Question 35

What is ISO 28000?

Accepted Answer

ISO 28000:2022 is the international standard for Supply Chain Security Management. It provides a framework for identifying and managing security threats across the supply chain — from procurement and logistics to storage and distribution. It is particularly relevant for organisations in defence, critical infrastructure, and international trade.

Question 36

What is SSIP and why does it matter?

Accepted Answer

SSIP (Safety Schemes in Procurement) is a forum of health, safety, and supply chain prequalification schemes. Holding an SSIP-recognised accreditation — such as CHAS, Constructionline, or SafeContractor — demonstrates that your organisation meets baseline health, safety, and supply chain standards required by many principal contractors and public sector clients.

Question 37

What is PAS 91?

Accepted Answer

PAS 91 is the British Standard for construction prequalification questionnaires. It standardises the information that contractors must provide to demonstrate their competence, financial standing, and compliance with health, safety, and environmental requirements. BK17 supports organisations through PAS 91 prequalification.

Question 38

How does BK17 approach supply chain due diligence?

Accepted Answer

Our supply chain practice is led by professionals who have managed complex multi-tier supply chains in regulated industries. We assess your supply chain risk exposure, implement appropriate controls, and build the documentation and processes needed to satisfy customer and regulatory requirements.

Question 39

What HR and people services does BK17 offer?

Accepted Answer

BK17's people practice covers workforce planning, HR policy development, ISO 45001 and ISO 45003 implementation, psychosocial risk assessment, and people-related compliance. Our HR lead has direct experience building people functions in growing SMEs and regulated organisations.

Question 40

What is psychosocial risk and why does it matter?

Accepted Answer

Psychosocial risks are aspects of work design, organisation, and management that can cause psychological harm — stress, burnout, anxiety, and depression. ISO 45003 provides a framework for identifying and managing these risks. Regulators and insurers are increasingly focused on psychosocial risk as part of occupational health obligations.

Question 41

Can BK17 act as an outsourced HR function?

Accepted Answer

Yes. Through TheMS, BK17 can provide an outsourced people function — covering HR policy, compliance, workforce planning, and ongoing people management support. This is particularly valuable for SMEs that need senior HR expertise without the cost of a full-time HR director.

Question 42

What capital and finance services does BK17 offer?

Accepted Answer

BK17's capital practice covers investment readiness, business structuring, financial modelling, and fundraising support. Our finance lead has direct experience raising capital, managing exits, and building investor-ready businesses across a range of sectors.

Question 43

How does compliance certification affect investment readiness?

Accepted Answer

Investors and acquirers increasingly require evidence of compliance certification — particularly ISO 27001, ISO 9001, and Cyber Essentials — as part of due diligence. BK17 can build your compliance posture specifically to satisfy investor requirements, reducing friction in fundraising and M&A processes.

Question 44

Can BK17 help us prepare for a funding round?

Accepted Answer

Yes. BK17 can assess your investment readiness, identify gaps in your governance and compliance posture, and build the documentation and systems that investors expect to see. We work alongside your legal and financial advisers to ensure your business is presented in the strongest possible light.

Question 45

What marketing services does BK17 offer?

Accepted Answer

BK17's marketing practice covers brand strategy, digital marketing, content, go-to-market planning, and growth strategy. Our marketing lead has built and scaled businesses across B2B and B2C sectors — not just advised on them.

Question 46

How does compliance certification support marketing?

Accepted Answer

Certification is a powerful marketing asset. ISO 27001, Cyber Essentials, and CMMC RPO status signal credibility to enterprise clients, procurement teams, and investors. BK17 helps clients leverage their compliance posture in their marketing — turning certifications into competitive advantage.

Question 47

Can BK17 act as an outsourced marketing function?

Accepted Answer

Yes. Through TheMS, BK17 can provide an outsourced marketing function — covering strategy, content, digital, and campaign execution. This is particularly valuable for SMEs that need senior marketing expertise without the cost of a full-time marketing director.

Question 48

What is TheMS?

Accepted Answer

TheMS is BK17's AI-powered management system platform. It builds, runs, and maintains your compliance frameworks, connects every business function, and keeps your organisation audit-ready year-round. It is not a tool — it is a function. TheMS replaces the need for multiple disconnected systems across compliance, people, supply chain, finance, and marketing.

Question 49

How is TheMS different from other compliance software?

Accepted Answer

Most compliance software requires you to do the work — it just provides a framework to fill in. TheMS is different: BK17 builds and maintains your management system inside the platform on your behalf. You get the certification and the ongoing compliance function, not just a licence to a tool.

Question 50

What frameworks does TheMS support?

Accepted Answer

TheMS supports all BK17 service areas: ISO 27001, ISO 9001, ISO 14001, ISO 45001, ISO 45003, ISO 22301, ISO 42001, ISO 28000, CMMC, DCC, Def Stan 05-138, Cyber Essentials, SOC 2, NIS2, and more. Multiple frameworks can be managed simultaneously with shared controls and evidence.

Question 51

How much does TheMS cost?

Accepted Answer

TheMS is available from £145/month for the Lite tier through to £3,250/month for the Unlimited tier. Pricing is based on the number of frameworks, users, and entities in scope. Multi-year discounts are available. Visit our TheMS page for full pricing details or book a discovery call.

Question 52

Can we use TheMS without BK17 consultancy support?

Accepted Answer

TheMS is designed to be used with BK17 as your outsourced compliance function. However, organisations with existing in-house compliance capability can use TheMS as a platform with lighter-touch BK17 support. Contact us to discuss the right arrangement for your organisation.

Answers before
the auditor asks.

ISO 27001

ISO 9001

ISO 14001

ISO 45001 & 45003

ISO 22301

ISO 42001 (AI)

Cyber Essentials

Penetration Testing

SOC 2 & NIS2

CMMC

DCC & Def Stan

Supply Chain

People & HR

Capital & Finance

Marketing & Growth

TheMS Platform

Still have questions?

Answers beforethe auditor asks.