For Consultancies

The English-language half of your ISMS and PrivacyMark engagements, delivered under your brand.

Where these engagements get difficult

Certification work runs smoothly in Japanese. It stops the moment someone on the client side only reads English.

1

Approval sits with an overseas head office

The Japan team works with you in Japanese, but the decision maker is abroad and will not sign off on policies or audit results they cannot read.

2

The internal audit has to be in English

The process owners being audited do not speak Japanese, and the report has to be delivered in English. Independence requirements mean the client cannot do it themselves.

3

Policies are needed in both languages

The Japanese document set is fine. Without an English version staff can actually read, the system never takes hold and the training records do not hold up.

4

English security questionnaires keep arriving

A few hundred questions land from the client's enterprise customer, and the time it takes to answer them is now the thing holding up the deal.

5

There is no English training material

ISO 27001 and PrivacyMark both require training and records of it, and nothing in the client's library works for English-speaking staff.

Scope

What you can hand over

One piece of an engagement at a time, not the engagement itself.

This is not a replacement for your consulting work. It is the English-language portion, carved out and handled by someone who does this work in a live management system every week, not by a translator who has never sat in front of an auditor.

Scope is agreed per engagement, and you keep the client relationship throughout.

Discuss an engagement

Internal Audit

The independent internal audit ISO 27001 and PrivacyMark both require, conducted in English. Audit plan, interviews, and a findings report in either language or both.

Fixed fee per site, per standard

Bilingual Policy Sets

Policies, procedures, and forms built in English and Japanese. Not translation. Both versions have to survive an auditor asking about them, so they are written and checked against each other.

Quoted by document count

Overseas HQ Communication

Briefings, meetings, and Q&A with the client's head office or group companies, in English. Runs alongside your Japanese-language work rather than replacing it.

Day rate or monthly

Security Questionnaires

English security questionnaires and due diligence reviews answered. For ongoing work, a reusable answer library so the same questions stop costing a week every time.

Per questionnaire, or monthly

Training Content

Information security and personal information protection training in English and Japanese, delivered as SCORM packages that load into your LMS or the client's. Completion records come out in a form you can put in front of an auditor.

Per module, or annual set

Spot Consultation

Short engagements: a question about English-language regulatory expectations, an English review of a document set, a check before an audit date.

Hourly

Terms

How this works

Your client relationship stays yours.

Ground rules:

  • Work is delivered under your brand, and my name does not need to appear anywhere
  • I do not approach your clients directly, during the engagement or after
  • NDA, non-compete, and non-solicitation terms are fine by me
  • No onward subcontracting. I do the work myself
  • Registered as a qualified invoice issuer (適格請求書発行事業者)
  • Remote by default, with on-site attendance for internal audits across greater Tokyo

Intellectual property:

  • Work product created for an engagement belongs to you or your client
  • Materials I bring with me (training modules, document templates, questionnaire answer libraries) stay mine, licensed to the client for their own use
  • Both points are written into the individual engagement agreement
Track record

Where this experience comes from

Not from consulting engagements. From running a certified management system.

I built and run the integrated ISO 27001 and PrivacyMark management system at a 100+ person product technology company in Tokyo, single-handed. Everything below comes from that system.

Results:

  • External audit nonconformities reduced from six to zero in one cycle, after transitioning to ISO 27001:2022 and merging PrivacyMark into the same management system
  • ISO 27001:2013 to 2022 transition in roughly four months; the full integrated system, PrivacyMark included, in about six
  • Vulnerabilities past SLA reduced from 6,008 to 703 (284 to 64 once grouped)
  • English security questionnaires of several hundred questions answered in two to three business days
  • Thirteen security incidents run end to end across 2025 and 2026, from detection through to corrective action
  • Multiple PrivacyMark renewals completed since 2023, and ISO 27001 audits every year since 2022, at more than one company
  • Ran IT and security for a BPO site serving eight client programmes, each with its own contractual security requirements, and held those obligations and the continuity commitments intact while construction rebuilt half the floor

The company is not named, for confidentiality reasons. I am happy to walk through the structure and document set in detail once an NDA is in place.

Start with a live engagement

Whether it is work already in progress or something you are deciding whether to take on, send the scope and you will get a straight answer on fit and a rough number.

Get in touch