Information Security Management System (ISMS) in 90 Days

Many organisations running this engagement have already invested in Microsoft Entra ID, Microsoft Defender, and Microsoft Purview but are not yet using them in a way that supports coherent ISMS governance. ISMS in 90 treats these tools as a primary evidence and control source: Microsoft Entra ID provides identity governance and access control evidence; Microsoft Defender for Endpoint, Identity, and Cloud delivers threat detection, posture management, and audit signals; Purview supports data classification, compliance policies, and information protection controls.

The engagement maps the organisation's current use of this stack to the agreed ISMS scope and compliance driver, identifies where existing telemetry and policy configurations already satisfy control requirements, and highlights the governance and operational practice gaps that tooling alone does not close. The result is a clearer picture of what the Microsoft stack already contributes to the ISMS and what process or ownership changes are needed to make that contribution auditable and sustainable.

What’s included?

• ISMS governance model with ownership, decision rights, and operating cadence
• Policy and control baseline for the agreed scope
• Control and evidence readiness review with prioritised gaps
• Clear view of the issues most likely to slow assurance, audit, or certification progress
• Practical 90-day mobilisation plan for governance, evidence, and control uplift
• Executive readout and next-step recommendation

ISMS in 90 Days is delivered over 12 weeks starting at £22,500. Advania UK has access to Microsoft-funded opportunities. Contact us to check your eligibility.

Why choose Advania?

• Turn ambiguity into an operating model: Many organisations have policy fragments, partial controls, and assurance pressure, but no clear way to run the ISMS day to day. This engagement gives leadership a model with ownership, cadence, and decision points they can use.
• Connect governance to evidence, not just paperwork: The approach looks at governance structure, policy baseline, control readiness, and evidence discipline together, so the client gets a foundation that supports assurance conversations rather than a static document set.
• Prioritises the gaps that matter most: Instead of treating every weakness as equally urgent, the engagement identifies the governance, control, and evidence issues most likely to block progress and turns them into a practical first-quarter plan.
• A portfolio of IT services to secure your cyber foundation including Managed Device, Managed Identity and Managed Detection & Response.