Certification body referral
The body or the scheme operator passes a name across when it has one. Good work, on somebody else’s schedule, and no lever you can pull to get more of it.
For ISO, NIS2, DORA and CMMC practices
Your free gap analysis is an unpaid audit
The enquiry arrives because a tender asked for ISO 27001, or because NIS2 now names their sector. They cannot tell you how far off they are. So a consultant spends an hour working it out, for free, for everyone who asks.
Not open yet. Ours scores your own acquisition rather than a framework, and it is the quickest way to see one of these from the buyer’s side.
Where it comes from now
Two of your three sources belong to somebody else
Referral volume is decided by a certification body’s year, not yours. The two you own send traffic that reads and leaves.
Search
Someone types the standard and a deadline into Google at 22:00, reads your gap analysis page, and leaves without a name.
Content and webinars
Forty people register for the session on the revised scheme. You end up with forty addresses and no idea which three have a board date in the diary.
What it costs
The hour you spend finding out is the hour you meant to bill
Every enquiry gets the same hour, whether there is a board date behind it or not. The unqualified ones cost exactly what the real ones cost.
121 days
94%
By the time the call happens, the managing director has read three consultancies’ pages and asked a peer who certified last year. The call is not where the decision gets made. It is where it gets confirmed, or quietly unmade.
Four months is a long time to carry a pipeline you cannot rank.
What we would build
A control-level score, before anyone spends a consultant hour
The ISO 27001 Certification Readiness Score. Gap scoring at Annex A control level, an effort estimate in consultant days, a realistic date for stage 2, and a remediation plan in priority order.
The questions are the ones your consultants already ask in the first twenty minutes. Is there a Statement of Applicability, and when was it last touched. Has anyone run an internal audit. Who owns the risk register. Is there a management review anybody attends. When is the board date, and is there a tender behind it.
Answers to those rank your leads better than any field in your CRM. They are also the answers a prospect can give honestly, because nobody is watching.
What they receive
A document the board can read without you in the room
Three things, and all three survive being forwarded: where the gaps are, what closing them costs in consultant days, and the earliest honest date for stage 2.
Before
An hour of unpaid diagnosis, delivered on a call.
Heard by one person, and only if they showed up.
After
A scored gap map, an effort estimate and a date.
Forwarded to the person who signs the engagement.
The honest part
A low score has to say so. A readiness report that flatters everyone is a report no certification body would recognise, and your buyer has met a certification body.
Who reaches a consultant
Three bands, and only one of them gets an hour
The routing is the commercial decision. It is written before anything gets designed, and whoever decides which leads get called signs it.
Books a call
Dated, scoped, sponsored
A named deadline, a budget holder who answered the budget question, and enough of the management system already written down that stage 1 is a real conversation. This band goes straight to a consultant’s diary.
Sequenced
Real, but not this quarter
The deadline exists and nothing else does. No internal owner, no scope, no risk register. They get a sequence written against the gaps they actually reported, and they come back when the board date lands.
Given the answer
Not a project yet
Curious, unsponsored, or asking about a framework you do not prepare people for. They get a straight read on where they stand and no call, which costs you nothing and earns the referral later.
Nothing in that routing is new to you. What is new is that it runs before anybody books an hour, on answers the prospect gave in four minutes.
How the model gets writtenYour traffic
The same score, aimed at two different kinds of reader
Search brings someone with a deadline. A webinar brings someone with an interest. Both are leads worth having, and neither should meet the same opening.
SEO
The standard plus a date is a high-intent search and a terrible moment to ask for a name. Score first, ask second.
Content and webinars
The session on the revised scheme fills a list. The score turns that list into a ranked one before your team works it.
Packages
Three packages, fixed scope, nothing open ended
One instrument built and live, the funnel around it, or the programme that keeps a framework library current.
If we had to guess where a practice like yours starts, it is the middle one, because the routing is where the waste comes out of your pipeline. That is a judgement about the shape of your work, not a pattern we have measured.
Prices are not published yet because they are not final. When they are, they go on the pricing page as numbers.
What is in each packageQuestions
What compliance practices ask first
No, and the wording has to keep it that way. It reports what the respondent told us about their own operation and ranks the gaps by what usually delays a certificate. The judgement about their scope, their controls and their evidence is yours, it is billable, and it happens on the call.
Your turn
Find out what your own enquiries are costing you
Ours scores the four things that decide whether traffic becomes a booked hour, and returns a number, a band and a report. The same instrument, aimed at you instead of at a framework.
Not running yet. The report is yours whatever the score says.