Compliance
Security standards, made achievable for smaller teams
Customers, insurers and tenders increasingly ask for evidence that your IT is secure. We do the technical work behind Cyber Essentials, ISO 27001 and UK GDPR, and help you answer the questions with confidence.
Where to start
Four frameworks SMEs are most often asked about
Each page explains what the framework is, what it asks of a business your size and how we help you get there.
Cyber Essentials and CE Plus
The UK government-backed baseline: five technical controls that stop the most common attacks. Often the first thing a customer or tender asks for.
Cyber EssentialsISO 27001 readiness
The international standard for an information security management system. We help with the gap analysis, policies, controls and evidence before your certification audit.
ISO 27001 readinessUK GDPR
The law expects security appropriate to the risk. We put the technical measures in place, support your DPIAs and help you get ready to handle a breach.
UK GDPRNIS2 and supply-chain security
Larger customers, including EU organisations covered by NIS2, now check the security of their suppliers. We help you meet their requirements and questionnaires.
NIS2 & supply chain
Why it matters now
Security is now part of how you win work
A few years ago, security questions came from banks and government. Today they arrive from all kinds of customers, from insurers at renewal and in most larger tenders.
The questions are usually the same: do you use multi-factor authentication, are devices patched, are backups tested, who has admin rights and what happens if something goes wrong. Getting the technical basics right answers most of them, whichever framework is asked for.
- Supplier security questionnaires from larger customers
- Cyber insurance proposal forms and renewals
- Public-sector and corporate tenders that ask for Cyber Essentials
- Investor and acquirer due diligence
How we work
From first questions to evidence you can share
The same approach works for every framework: understand what is asked, fix the gaps, then keep it that way.
Step 1: Review
We look at your devices, accounts, network and backups against the framework you need and tell you, in plain English, where you stand.
Step 2: Gap list
A prioritised list of what needs to change, who does it and roughly how long it takes. No obligation to go ahead.
Step 3: Fix
Our engineers make the technical changes, from multi-factor authentication to firewall rules and patching, and help you write the policies.
Step 4: Assessment and upkeep
We support you through the assessment or audit with an independent body, then keep controls in place so renewal is straightforward.
Who does what
Clear about our role, and what it is not
Compliance involves several parties. Knowing who does what avoids surprises at assessment time.
We do the technical work
Configuration, security controls, documentation of your systems and help with the policies and evidence an assessor will ask to see.
Independent bodies certify
Cyber Essentials certificates are issued by IASME-licensed certification bodies, and ISO 27001 certificates by certification bodies you choose. We prepare you; we do not issue certificates.
Your advisers interpret the law
For legal questions under UK GDPR or contracts, we work alongside your solicitor or data protection lead and give them the technical facts they need.
FAQ
Compliance questions
This page is general information, not legal advice. Requirements change, so we always work from the current published version of a scheme or regulation, and alongside your legal adviser or data protection lead where the law is involved.
Free IT & security review
Find out where your IT is exposed — in 30 minutes
A senior engineer reviews your setup, security and backups, then gives you a plain-English action list. No obligation, no hard sell.