Security leadership for growing companies in Japan
Audits, enterprise security questionnaires, and a security program that holds up, without hiring a full-time security manager.
Hi, I’m William Hollis.
I’m an information security manager based in Tokyo. ISO 27001, PrivacyMark, risk management, customer security reviews, incident response. That is the work I do every week, not a subject I studied once.
I started EverydayGRC because most growing companies don’t need a large consulting firm. They need one experienced person who will take responsibility for security and see it through.
Most companies don’t call because they “need GRC”
They call because something changed.
A customer asked whether you’re ISO 27001 certified
The deal is moving, the answer is no, and nobody is sure how long certification actually takes.
Procurement sent a 200-question security review
It landed with an engineer who has other work to do, and the answers need to be consistent with what you said last time.
Leadership realised nobody actually owns security
There are policies and tools. There is no one whose job it is to decide what happens next.
An audit is coming and the evidence isn’t ready
The internal audit hasn’t been done, the risk register is out of date, and the certification body has a date booked.
Growth has outpaced the controls you set up
What worked at fifteen people doesn’t work at eighty, and the gap is starting to show up in customer questions.
How I Help
You need an internal audit before certification
ISO 27001 and PrivacyMark both require one, and it has to be independent. Fixed scope, fixed fee, and a findings report you can act on before the certification body arrives.
Fixed fee from ¥250,000. A straightforward way to work together once before committing to anything ongoing.
Learn moreNobody owns security at your company
I become your security lead on a fractional basis: running risk reviews, handling audits and customer questionnaires, working with your engineers, and reporting to your leadership. Ongoing responsibility, not scheduled advice.
Fractional Information Security Manager, the main way I work with companies. From ¥300,000 a month, with lighter advisory-only arrangements priced accordingly.
Learn moreYou need to pass an ISO 27001 or PrivacyMark audit
Certification without months of documentation nobody reads. I own the evidence, the auditor communication, and the corrective actions, then build a system your team can actually keep running afterwards.
ISO 27001 and JIS Q 15001 (P-Mark) can be aligned into one management system to cut duplication.
Learn moreEnterprise customers keep sending security questionnaires
I answer them, build a reusable answer library so the same questions stop costing you a week, and pull in engineering only where a real answer requires it.
Learn more
Why EverydayGRC?
Most consultants spend their week advising. I spend mine operating a security program.
So what you get isn’t drawn from a case study or a framework I read once. It comes from problems I am working through right now, with auditors who ask hard questions and engineers who push back when something is impractical. When I tell you an approach works, it’s because I’ve had to make it work.
It’s also where the name comes from. Governance, risk, and compliance get treated as projects, something you do before an audit and revisit once a year. Risk doesn’t work that way, and neither do customer expectations. Good governance is something a company does every day, or it isn’t governance.
What that looks like in numbers
All of the below comes from one integrated ISO 27001 and PrivacyMark management system, at a 100+ person product technology company in Tokyo, built and run single-handed.
Results:
- External audit nonconformities reduced from six to zero in a single cycle, after transitioning to ISO 27001:2022 and merging PrivacyMark into the same system
- ISO 27001:2013 to 2022 transition in roughly four months; the full integrated system, PrivacyMark included, in about six
- Vulnerabilities past SLA reduced from 6,008 to 703 (284 to 64 once grouped)
- Enterprise security questionnaires of several hundred questions answered in two to three business days
- Thirteen security incidents run end to end across 2025 and 2026, from detection through to corrective action
- Multiple PrivacyMark renewals completed since 2023, and ISO 27001 audits every year since 2022, at more than one company
- Ran IT and security for a BPO site serving eight client programmes, each with its own contractual security requirements, and held those obligations and the continuity commitments intact while construction rebuilt half the floor
- Two onsite PCI DSS Service Provider Level 1 assessments at that site, each for a different client on its own dedicated network and audit schedule, both closing with an Attestation of Compliance
The company is not named, for confidentiality reasons. I am happy to walk through the structure and document set in detail under an NDA.
