Governance, Risk & Compliance

Get certification-ready without the guesswork. We build or align your information security management system to ISO 27001, run the gap analysis, prepare the evidence and stand beside you through the audit.

Win enterprise deals by proving your controls. We prepare you for SOC 2 Type I and Type II across the Trust Services Criteria, defining controls, closing gaps and readying the evidence your auditor will demand.

Meet your obligations under the UK GDPR and Data Protection Act with confidence. We assess how you handle personal data, find the gaps, and give you a practical plan to reach and maintain compliance.

Protect health information and meet HIPAA's Security and Privacy Rules. We assess your safeguards around electronic protected health information and give you a clear, prioritised path to compliance.

Handle card payments without handling the risk badly. We assess your environment against PCI DSS, help you reduce scope, and prepare you for your SAQ or QSA assessment so cardholder data stays protected.

Executive security leadership without a full-time hire. Our virtual CISO sets your security strategy, manages risk, guides compliance and represents security to your board — scaled to what you actually need.

Over-privileged accounts and forgotten access are how small breaches become big ones. We audit who can access what across your systems, find the excess and orphaned accounts, and help you enforce least privilege.

Privileged accounts are the keys to the kingdom — and attackers know it. We audit how you manage, secure and monitor administrative access, and help you lock down the credentials that would do the most damage if abused.

When disaster strikes — ransomware, outage, disaster — the organisations that recover fast are the ones that planned. We help you build and test disaster recovery and business continuity plans that actually work under pressure.

Your people are your largest attack surface and your best defence. We deliver engaging, practical security awareness training that changes behaviour — turning staff from the weakest link into a vigilant human firewall.

Your security is only as strong as your vendors'. We assess and help you manage third-party and supply-chain risk, so a supplier's weakness doesn't become your breach — as headline incidents keep proving.

Turn 'high/medium/low' hand-waving into financial figures your CFO can act on. Using FAIR-aligned methods, we model your top cyber risks as loss-exposure ranges in currency — so security spending can be argued in the same language as every other business investment.

Boards don't need packet captures — they need to know what could hurt the business, what's being done, and whether it's working. We build a board-grade cyber reporting pack and cadence: honest metrics, clear trends, and answers to the questions directors are now legally expected to ask.

You're not just buying a company — you're buying its breaches, its technical debt and every credential its ex-employees still hold. We assess a target's real security posture before you sign, so cyber risk is priced into the deal instead of discovered after closing.