Projects & Policies
A concise summary of my hands-on projects & policies in GRC, including ISO/IEC 27001 implementations, GDPR compliance, and risk assessments.
ISO/IEC 27001:2022
ISO/IEC 27001:2022 Risk Assessment Report(PDF)
ISO 27001 risk assessment for a fictional AI recruitment platform, with a risk register, treatment plans and applicable Annex A controls.
ISO/IEC 27001:2022 Information Security Policy (PDF)
ISO 27001 information security policy for a fictional organisation, covering objectives, roles, access control, data classification, incident management and AI governance.
ISO/IEC 27001:2022 THIRD-PARTY RISK MANAGEMENT (TPRM) POLICY (PDF)
ISO 27001 third-party risk management policy, with supplier risk tiers, due diligence and offboarding.
ISO/IEC 27001:2022 Statement of Applicability (SoA) (PDF)
ISO 27001 Statement of Applicability for a fictional healthcare company, covering all 93 Annex A controls.
ISO/IEC 27001:2022 ISMS Gap Assessment & Certification Readiness Review (PDF)
Practice gap assessment of a fictional recruitment company against ISO 27001:2022, with a 90-day plan to fix what’s missing before certification.
ISO/IEC 27001:2022 Information Security Risk Assessment & Risk Register (PDF)
ISO 27001 risk assessment for a fictional healthcare company, with 20 scored risks, treatment decisions, residual ratings and a risk appetite statement.
ISO/IEC 27001:2022 Privacy Policy (PDF)
Privacy policy for a fictional organisation, aligned with ISO 27001:2022 and privacy best practice, covering lawful basis, security measures, retention, data subject rights and breach management.
ISO/IEC 27001:2022 ISMS Implementation Plan Meridian Cloud Analytics (PDF)
ISO 27001:2022 ISMS implementation plan for a fictional SaaS company, covering clauses 4 to 10 and Annex A, a risk methodology with a worked register, and a 14-month roadmap to certification.
GDPR Work
GDPR Personal Data Breach Response Plan (PDF)
GDPR Personal Data Breach Response Plan: six-phase incident response and notification framework with roles, KPIs and a worked 75,000-record breach scenario.
GDPR Data Subject Rights Procedure (PDF)
GDPR Data Subject Rights Procedure: end-to-end process for handling access, erasure and other data subject requests, with timeframes, roles, KPIs and an audit checklist.
GDPR Data Subject Access Request (PDF)
Data Subject Access Request (DSAR) Policy: 12-step UK GDPR process for handling access requests, with timescales, exemptions, fees and refusals.
GDPR Compliance Review (PDF)
GDPR Compliance Review: readiness assessment of a fictional online retailer, with findings, a privacy risk register and a prioritised remediation plan.
GDPR DPIA Template (GitHub)
GDPR DPIA Template: seven-step Article 35 impact assessment template with worked examples, linked to the rest of my GDPR portfolio on GitHub.
PCI-DSS
PCI-DSS Data Retention and Cardholder Data Protection Policy (PDF)
Sample policy for a fictional organisation
PCI-DSS Vendor Risk Assessment Template (PDF)
Reusable template for assessing a payment vendor’s security, with a questionnaire, evidence checklist, risk matrix and sign-off.
PCI-DSS risk register for a fictional retailer, with 10 scored risks and a treatment plan for each.
PCI-DSS Incident Response Plan (PDF)
Incident response plan for a fictional organisation handling payment card data. It covers severity levels, the response team, a seven-phase lifecycle, notification timeframes and incident forms.
PCI-DSS 4.0 Readiness Assessment Report (PDF)
PCI-DSS 4.0 readiness assessment for a fictional e-commerce company, with findings and a remediation roadmap.
PCI-DSS Access Control Policy (PDF)
PCI-DSS access control policy for a fictional organisation, with MFA, privileged access and access review rules.
ISO/IEC 42001: AI Management System (AIMS) Documentation Set
AI MANAGEMENT SYSTEM SCOPE STATEMENT.(PDF)
ISO/IEC 42001 AI management system scope statement for a fictional fintech lender’s credit scoring model, covering in-scope systems, business units, regulatory context and exclusions.
ISO/IEC 42001 AI policy for a fictional fintech lender’s credit scoring model, setting out principles on fairness, transparency, accountability, human oversight, privacy and security
STATEMENT OF APPLICABILITY (SOA) (PDF)
ISO/IEC 42001 Statement of Applicability for a fictional fintech lender’s credit scoring AI, with a justification for each control area and detailed implementation notes on the highest-risk areas.
A risk register for a fictional fintech’s credit scoring model, covering seven AI risks, each scored before and after controls and given an owner.
ROLES & RESPONSIBILITIES MATRIX (PDF)
A RACI matrix for FinTechCo’s credit-scoring AI. It shows who does, owns, advises on and is told about 11 activities, with role definitions and an escalation path.
EU AI Act Risk-Tier Classification Exercise (PDF)
EU AI Act Risk-Tier Classification Exercise: one-page memo classifying three AI use cases by risk tier, with the reasoning and required controls for each.
NIST AI RMF Applied Assessment (PDF)
NIST AI RMF Applied Assessment: risk evaluation of an AI recruitment screening tool across all four framework functions, with ratings, mitigations and a deployment recommendation.
ISO/IEC 27701:2025 PII Controller/Processor Determination
ISO/IEC 27701:2025 PIMS Extension to the ISO/IEC 27001:2022 ISMS (PDF)
ISO 27701:2025 PIMS for a fictional recruitment company, showing which privacy controls are implemented and which are designed.
PII Controller/Processor Determination Exercise (PDF)
Determining controller and processor roles across five data flows on a fictional healthcare scheduling platform, with a role matrix, privacy risks and governance findings.
ISO/IEC 27701:2025 Records of Processing Activities (RoPA) (PDF)
GDPR Article 30 record of processing activities for a fictional recruitment company, supporting the ISO 27701 PIMS.
ISO/IEC 27701:2025 Third-Party Processor Due Diligence & Article 28 Assessment (PDF)
GDPR Article 28 vendor assessment for a fictional AI screening provider, with weighted scoring and a conditional approval.
Experience Overview
Skills
Core Competencies
Governance, Risk and Compliance (GRC)
Risk assessments and risk registers
Compliance documentation and control design
Regulatory analysis (GDPR, ISO 27001, PCI DSS)
Policy and procedure development
Third-party and vendor risk assessment
Data protection and privacy governance
Technical & Compliance Skills
Microsoft Word and PDF documentation
Risk registers and tracking using Excel
Structured compliance templates
Framework mapping (NIST and ISO standards)
Tools & Working Methods
Compliance documentation (Word / PDF)
Risk registers and tracking (Excel / Sheets)
Structured compliance templates
Framework-aligned documentation (NIST, ISO)
Core Services
Focused on governance, risk, and compliance frameworks including ISO 27001 and GDPR.
Risk Assessments
Conducting thorough risk evaluations aligned with NIST standards to identify vulnerabilities.
Cloud Infrastructure Risk Assessment
Compliance Docs
Developing and maintaining clear documentation for ISO/IEC 27001 and GDPR compliance.
Data Retention & Disposal Framework
Gallery
Snapshots of my compliance and risk management projects.
© 2026 Martin Searle.All Rights Reserved. Certain graphics on this website were created using AI tools. References to the NIST Cybersecurity Framework (CSF) are provided for informational purposes only and do not imply endorsement by NIST or the U.S. Government.
© 2026. All rights reserved.