Putting this into practice
Winners Consulting helps organizations turn this concept into workable policies, processes and audit readiness.
Step 1 of 3
You looked up “Winner-Loser Gap”. Which situation is closest to yours?
Common situations behind “Winner-Loser Gap” and the first step
- A customer asks how fast you can resume supply after an outage or disaster：Run a business impact analysis, set RTO and RPO, and validate them with exercises
- A regulator or law requires operational resilience (for example NIS2 or DORA)：Map the resilience obligations to an ISO 22301 management system
- You want ISO 22301 certification：Check that the advisor’s exercises actually expose weaknesses
Winners Consulting provides ISO 22301 BCMS consulting. Vice-president and director-level consultants lead the work end to end with no outsourcing, and one set of evidence answers several laws and customer requirements.
Before choosing a consultant or budgeting: decision guides
Use these guides as a checklist when comparing consultants and estimating budget and timeline.
- Budgeting for ISO 27701 next year: how to estimate itISO 27701:2025 can be certified on its own, but it is not GDPR compliance. Estimate roles, scope, regulatory mapping, consulting and certification costs along one of two routes: stand-alone implementation or integration with ISO 27001.
- How long does ISO 27701 implementation take, and which steps cannot be compressed?Inventory and define roles first, then design controls, operate long enough to leave records, and only then certify. The personal-data inventory is the step most often underestimated.
- How to choose an ISO 27701 consultant in Taiwan: eight criteriaISO 27701:2025 can be certified on its own, but it is not GDPR compliance. Choose a consultant who can map it to both the GDPR and Taiwan's Personal Data Protection Act, and who correctly determines whether you are a controller or a processor.
- How to choose an ISO 27001 consultant in Taiwan: eight criteriaWhen choosing an ISO 27001 consultant, first separate consultants from certification bodies (an accredited certification body may not provide consultancy), then check that controls follow your risk assessment, who leads, and whether there are named cases.
- Can ISO 27001 internal audits be outsourced? Six things to confirm firstYes. ISO 19011 defines internal audits as conducted by, or on behalf of, the organization; but a certification body may not provide internal audits to its own certified clients. Confirm role, qualifications, independence, scope, reporting and timing.
- The CHRO's regulatory priorities: 8 requirements by impact and order, and the three decisions we suggest you make firstSeen from your responsibility for people and the organisation, this page sets out employee data, non-competes, trade secrets, integrity and whistleblowing, and AI in HR. what really applies, what we suggest handling first, and the impact of leaving it. Covers 8 areas: GDPR, trade secrets, ISO 37001, the EU AI Act, AI transformation, ISO 27001, ISO 22301 and digital transformation.
- The CISO's laws and standards: 14 requirements, reporting deadlines and priorities, and three decisions we suggest you make firstGiven your mission to protect the company's security, reporting deadlines come first: one incident can trigger GDPR, NIS2, DORA and the EU CRA at once. This page sets out 14 requirements by impact and suggested priority, the governance rules on the CISO role, what to cover in board reports and which requirements have no certificate.
Need help with compliance implementation?
Request Free Assessment