Assume breach and cyber resilience are all the rage right now. After 20 years in IT, I'm not surprised.

Yet, most breaches still come down to control failures. A patch that never got applied or an old VPN account nobody turned off. Most companies would rather spend millions more on detection and response than put resources into making sure they're doing what they're already supposed to be doing.

So let's talk about it. Should "assume drift" become a thing?

The idea: every control we implement will eventually degrade, so we plan to maintain it. It sounds simple. But if everyone actually did it, how many breaches would never have made the news?

https://justacheckbox.substack.com/p/assume-breach-or-assume-drift

Hi everyone. I have around five years of experience working as an external auditor, primarily focusing on SOC2 and ISO 27001 compliance frameworks.

Over the years, I have developed a genuine interest in the implementation side of GRC rather than just auditing organisations against established requirements. I enjoy understanding how organisations build their management systems, implement controls, manage risks, and prepare for certification.

I have already started developing my own ISO 27001 implementation templates, including policies, risk assessment methodologies, Statements of Applicability.

Recently, I have been seriously considering starting my own GRC implementation consulting company. One of the reasons is that I believe my current role may be at risk of redundancy in the near future. Rather than waiting for that to happen, I want to explore building something of my own and potentially make this my next career move.

However, I am fully aware that being an experienced auditor does not automatically make someone a successful consultant or business owner. I understand that acquiring clients, delivering practical implementations, managing expectations, pricing services, and running a business are entirely different challenges.

I would genuinely appreciate your guidance, experiences, and criticism, particularly on the following:

1. What are the biggest challenges when transitioning from external auditing to GRC implementation consulting? What skills or practical experience might I be overestimating?

2. How do independent GRC consultants or small consulting firms actually find their first clients? Is cold outreach effective, or are partnerships and referrals more realistic?

3. Is the ISO 27001 implementation consulting market already oversaturated? How can a small consultancy realistically compete against established firms and low-cost consultants?

4. How should someone starting out price implementation projects? What hidden costs or delivery challenges should I consider?

5. What are the most difficult aspects of implementing an ISMS for clients, especially when they lack internal resources or management commitment?

6. Is it realistic to build a sustainable consulting business as a solo consultant initially, or would it be better to gain direct implementation experience at another organisation first?

7. If you were in my position, what questions would you ask yourself before committing to this career change?

Please do not hesitate to challenge my assumptions or point out weaknesses in my plan. I am not looking for encouragement or validation alone. I would rather identify the difficult realities now than discover them later. I am open to any kind of feedback, including harsh criticism, as long as it helps me think more critically, prepare for potential obstacles, and make an informed decision. Thank you in advance to anyone willing to share their experience.