About William

I’m William Hollis, an information security manager based in Tokyo.

My work is ISO 27001 and PrivacyMark governance, risk management, customer security reviews, incident response, vendor assessments, and the executive reporting that goes with all of it, run as an ongoing program rather than a series of projects.

I started EverydayGRC because I kept running into the same problem from the other side of the table. Growing companies were being asked to meet enterprise security expectations by their customers, but couldn’t justify a full-time security manager and couldn’t afford a large consulting firm. So the work fell to whoever had capacity that week, which usually meant it didn’t get done properly.

That’s the gap this exists to fill.

What I do day to day

The point isn’t the job title. It’s that the problems you’re bringing me are problems I’m also working on this month:

• ISO 27001 and PrivacyMark governance, including running the two as a single integrated management system
• Risk assessment, risk acceptance, and getting executives to actually make the decision
• Internal audits, management reviews, and certification audits
• Enterprise customer security questionnaires and vendor reviews
• Incident response process and vulnerability management
• Policy architecture, document control, and security awareness training

None of that is theoretical for me, which is the main thing I’d want you to take from this page.

Track record

All of the below comes from one integrated ISO 27001 and PrivacyMark management system, at a 100+ person product technology company in Tokyo, built and run single-handed:

• Six nonconformities to zero. External audit findings went from six the previous year to none, after transitioning to ISO 27001:2022 and merging PrivacyMark into the same management system.
• Four months to transition, six to integrate. ISO 27001:2013 to 2022 in roughly four months, and the full integrated system including PrivacyMark in about six.
• 6,008 overdue vulnerabilities down to 703. 284 to 64 once duplicates were grouped, across all severities.
• Questionnaires in two to three days. Several hundred questions, answered consistently, with a reusable answer library behind it.
• Two PCI DSS Level 1 assessments, run in parallel. Both onsite, at the same site, each for a different client on its own dedicated network and audit schedule, and both carried through to an Attestation of Compliance.
• Thirteen incidents, start to finish. Across 2025 and 2026, from detection through to corrective action.
• Multiple PrivacyMark renewals since 2023. And ISO 27001 audits every year since 2022, at more than one company.
• Eight client programmes under one roof. Ran IT and security for a BPO site where every client carried its own contractual security requirements, and held those obligations and the continuity commitments intact while construction rebuilt half the floor.

The company is not named, for confidentiality reasons. I’m happy to walk through the structure and document set in detail under an NDA.

How I think about this work

I don’t think security exists to produce paperwork. It exists to help a company earn trust, reduce the risks that would actually hurt it, and keep growing without tripping over itself. Compliance is one useful outcome of a well-run security program. It isn’t the goal.

In practice that means preferring things that work in your environment over things that look correct in a framework, and preferring a control your team will follow over a stricter one they’ll quietly ignore. An auditor can’t tell the difference on paper. Everyone else can.

Why work with me

• I own outcomes. I don’t hand over a report and disappear. I help move things from “identified” to “implemented,” which is the part that usually stalls.
• Advice grounded in current practice. I operate a certified management system continuously, so what I recommend is shaped by what auditors and enterprise customers are asking for this year, not by what worked three standards ago.
• Japan and international, both. I work with Japanese and international stakeholders regularly and can run an engagement in either English or Japanese: documentation, audits, and the conversations in between.
• Small enough to care. You get me. Not a partner who sold the work and an analyst who delivers it.