People no longer ask for recommendations the way they used to: they search for an ISO 27001 consultancy on Google and trust what they find. If you're not there, to many customers it's as if you don't exist.
Nobody searches for a job title: they search for the problem — a letter from the tax office, whether an expense is deductible, how long an appeal takes. Those queries carry little volume and enormous intent, and the page that answers them plainly is the one that gets the call.
On those searches your competitor is not the firm down the road, it is the big national portals. You beat them on the two things they do not have: the local angle, and an answer written by somebody who actually does the work.
Expect the first movement on the long questions within three to four months, and nothing at all on the head term for a year. The honest early signal is impressions on questions nobody else answers, not positions.
Position is the wrong number to watch here. What tells you it is working is enquiries that arrive already knowing the answer to the first question, because they read it on the page before writing.
More and more people ask ChatGPT and AI assistants for a recommendation instead of scrolling Google. We structure your ISO 27001 consultancy's content so those tools understand what you do and put your name forward when someone asks.