Erin Cram

Who I am

Compliance built on evidence

I work in compliance and information security for regulated digital services. That means meeting the requirements of the UK Digital Verification Services Trust Framework, the scheme that replaced DIATF, and ISO/IEC 27001 compliance across an information security management system where it sits in scope.

It also means audit, policy and assurance across a business, and working alongside product development to translate regulatory requirements into practical product controls, so that compliance is built into the roadmap rather than bolted on afterwards.

Before compliance I spent nearly a decade as a biomedical scientist in a hospital biochemistry laboratory. That is where the discipline comes from: internal quality control and external quality assurance, validating software before it went live, managing change to analysers and systems, and documentation that had to stand up to inspection. In a laboratory, evidence is not paperwork, it is the work.

I bring that same standard to compliance. Controls that are tested rather than assumed, records that hold up when someone independent looks at them, and findings explained clearly enough that the people who have to act on them understand why.

ISO/IEC 27001 Lead Auditor (IRCA Accredited) Digital Identity Compliance DVS Trust Framework ISMS GPG 45 GPG 44 Data protection in ISMS scope

What I do

Getting digital identity services certified, and keeping them there

Most of my work is with companies heading for certification against the UK Digital Verification Services Trust Framework, and with certified providers moving from the old 0.4 scheme onto version 1.0. Delivered through Cram Limited on an independent basis, which means you deal directly with the person doing the work.

DVS Trust Framework Readiness

Where your service sits against the trust framework today, what the certification body will ask to see, and a prioritised route to the evidence you do not yet have.

Identity Checking to GPG 45

Working through how you check identity against GPG 45. Evidence, validation and verification, and the confidence level your service genuinely reaches rather than the one the website claims.

Authentication to GPG 44

Choosing authenticators at the level your service actually needs, and documenting why, so the decision holds up when an assessor asks you to justify it.

Data Protection in Scope

UK GDPR where it bites hardest for identity services. Lawful basis, minimisation, retention, DPIAs, and the records a certification body expects to find already in place.

Certification Audit Support

Internal audit and pre-assessment, so you are ready before the certification body arrives rather than during. Supported by ISO/IEC 27001 auditing where the ISMS falls in scope.

Policies & Procedures

Auditing what exists and writing what does not. Documentation people follow because it is clear, and that stands up when someone independent reads it.