Confidence
is built.

Normstone builds the governance, controls, and evidence behind credible assurance. We turn demanding AI and cyber requirements into practices that hold up in the real world.

Explore our standards Talk to Normstone

The work behind trust

Risk is real. Readiness should be, too.

Normstone works where customer assurance, AI governance, and operational security meet. We help teams define the right scope, implement controls, and show evidence of what actually works.

What we do

From obligation to operation.

Focused implementation and advisory for organizations facing consequential trust decisions.

01AI governance & ISO/IEC 42001Give AI decisions a durable management system.02SOC 2 & assurance readinessBuild controls and evidence customers can trust.03Cyber & technology riskSee the risk clearly. Build the controls that matter.04Regulatory cyber resilienceMake regulatory obligations operational.05ESG & sustainability implementationMake sustainability commitments measurable and reviewable.
Explore all advisory services

Where we focus

AI governance first. Assurance close behind.

ISO/IEC 42001 gives AI decisions a management system. SOC 2 answers a service assurance question. ISO/IEC 27001 provides a security foundation. NIS2 brings cyber risk and incident duties for covered EU entities under national law.

Explore all standards
ISO/IEC 42001AI governanceSOC 2Service organization assuranceISO/IEC 27001Information securityNIS2EU cybersecurity

Assurance follows the buyer. Governance follows the risk.

For a European or Asia Pacific technology company, a SOC 2 request may begin with international procurement. AI governance questions arise across product and internal operations. We connect those buyer and risk questions to practical delivery, while keeping local duties distinct.

Explore our market guidanceRead the implementation guides

Market perspectives

Designed for the questions buyers ask.

Each market page connects global assurance frameworks to distinct local context.

EuropeA practical route to SOC 2 customer assurance and ISO/IEC 42001 AI governance for European technology teams, with ISO/IEC 27001 as a security foundation.AustraliaHow Australian SaaS and service organizations can approach SOC 2, ISO/IEC 42001, and ISO/IEC 27001 alongside local security and privacy expectations.SingaporeA practical assurance and AI governance path for Singapore-based technology and service organizations serving regional and international customers.

How we work

Built to hold up in practice.

Our work moves from decisions to sustained operation, with ownership and evidence at every stage.

01

Understand

Define scope, obligations, current state, and material risk.

02

Design

Set priorities, owners, controls, and a practical roadmap.

03

Implement

Embed processes, build evidence, and resolve gaps with teams.

04

Sustain

Review effectiveness and adapt as the organization changes.

Resources

Guidance for the next decision.

Practical answers on AI management, SOC 2, and shared control design.

Implementation guide4 min read

ISO/IEC 42001

ISO/IEC 42001 implementation roadmap: from AI inventory to management review

A usable sequence for building an AI management system that governs both AI products and internal use.

Read resource
Implementation guide5 min read

ISO/IEC 42001

AI impact assessment for ISO/IEC 42001: make the decision traceable

A practical review of purpose, affected people, foreseeable harm, mitigations, and approval for each material AI use.

Read resource
Market guide4 min read

SOC 2

SOC 2 for European SaaS companies: when it helps and how to prepare

A buyer-led guide to SOC 2 in Europe: the right trigger, a defensible scope, and how it sits beside ISO 27001 and GDPR.

Read resource
Explore all resources

Work with Normstone

Let’s build what stands up to scrutiny.

Tell us what you need to achieve. We’ll help define the right first step.

Start a conversation