ISO Consulting & Software Development
We set up information security, personal data protection and software development processes so your organisation is ready for audit — and we build the software that keeps those systems running long after the certificate arrives.
ISMS · Protect your organisation’s data and systems
PIMS · A structured way to comply with Thailand’s PDPA
VSEs · Software process standard for small teams
Web apps, internal systems and compliance tools
ISO Consulting
We don’t hand every client the same document template. We look at how you actually work, then design policies, procedures and evidence that meet the requirements — at a size your team can maintain on its own.
Information Security Management System (ISMS)
For: software companies, cloud and data-centre providers, businesses holding customer data, or anyone whose clients require it.
Privacy Information Management System (PIMS)
For: organisations processing large volumes of personal data that need to show systematic PDPA compliance.
Systems & Software Engineering — Lifecycle Profiles for Very Small Entities (VSEs)
For: software companies or development teams of up to 25 people who need to prove process quality to clients, government tenders or large enterprises.
93 controls in 4 themes
Our Process
Every project follows these five steps. Timing depends on your size and scope — you’ll get a firm timeline once the readiness assessment is done.
Compare your current practice with the requirements and define the certification scope.
~2–4 weeksWrite policies, procedures, forms and a risk register people will actually use.
~1–3 monthsTrain your team and build up complete records and evidence.
~1–3 monthsAudit internally, fix nonconformities and hold the management review.
~2–4 weeksWe stand beside you through the certification body’s or assessor’s audit until you’re certified.
per auditor scheduleConsultants cannot issue certificates — certificates come from an independent Certification Body. We help you choose one and make sure everything is ready.
Software Development
Most ISO systems fall apart after certification because everything lives in spreadsheets nobody updates. We build tools that keep the system running, and take on general software projects using the same process we teach under ISO/IEC 29110.
Risk registers, document control, audit tracking and reminders for tasks coming due.
Consent management, data subject requests and RoPA records.
Back-office systems, dashboards and custom workflows, secure by design.
APIs, alerts via LINE / Telegram / email, and migration from legacy systems.
Software development in detail →
# Example: weekly ISO task reminders ISMS · Week 38 ✓ A.5.15 Access rights review done ✓ A.8.13 Backup restore test done ! A.6.3 Train 3 new employees due 26 Sep ! 9.2 Internal audit, round 2 due 15 Oct # Summary sent to the owners on LINE
Our Product
Touch Consulthink’s software development management platform, for software companies and IT teams that must pass standards audits without stopping development to write documents.
Requirements, risks, tests and acceptance live in one process, and the system shows which evidence each clause of the standard needs.
Generate reports in the structure each standard expects at any time, as a printable document or a spreadsheet.
Every piece of evidence has its own review date, with a warning 60 days before it expires.
Flag untestable requirements and generate test cases, rule-based or AI-assisted — AI can suggest, but never changes your work on its own.
Why Touch Consulthink
Our name comes from “Touch” — getting hands-on with the real work — and “Consult + Think” — thinking it through with you, not for you.
Designed for your size, with no more paperwork than needed, so a small team can keep it going.
When a technical control needs fixing, we can fix it — no second vendor — and we build our own tool, Evidosa.
Quotes broken down by phase, so you know what each payment covers.
Based in Lampang, working onsite and online with clients across Thailand.
FAQ
Can’t find your answer? Call us on +66 86 654 0991 or email touchconsulthink@gmail.com.
Most small and mid-sized organisations take about 4–9 months from kickoff to audit-ready, depending on scope, existing documentation and how much time your team can give. You’ll get a firm timeline after the gap analysis.
No — and no consultant should. Certificates must come from a Certification Body independent of the consultant, to keep it impartial. Our job is to get you ready and through the audit.
ISO 9001 is a general quality system for any industry. ISO/IEC 29110 is built specifically for small software teams of up to 25 people and focuses directly on project management and software implementation — less documentation, faster to adopt.
The latest edition of ISO/IEC 27701 can be implemented on its own, but in practice most organisations pair it with ISO 27001 because they share much of the management structure and controls — saving time and audit fees.
Yes. We build web apps, internal systems and integrations, with security designed in from the start following ISO 27001 practice.
Contact
Call or email us and tell us where your organisation stands. We’ll tell you which standard to start with, roughly how long it will take, and what you need to prepare.