Overview
Cyber Essentials is required for many UK central government contracts that involve personal data or certain ICT services, and it is increasingly expected by larger customers. ISO 27001 then builds on it as you grow. We help you get from first gap assessment to certification and stay compliant afterwards.
Customers, partners and regulators increasingly require proof that you take security seriously. Frameworks like SOC 2 and ISO 27001 unlock enterprise deals; PCI DSS is mandatory for card data; Cyber Essentials is required for many UK government contracts; and regulators such as the FCA, PRA, ICO and Ofcom set clear expectations for security and resilience.
We start with a gap assessment against your target framework, then help you close gaps with right-sized policies, technical controls and evidence — without bureaucracy that slows your team down. Our penetration testing, SOC, vulnerability and patch management services provide much of the technical evidence auditors expect.
We work alongside your chosen certification body or audit firm, so the audit itself stays independent.
Compliance support for UK organisations
- A practical roadmap from Cyber Essentials to Cyber Essentials Plus and on to ISO 27001
- Data Security and Protection Toolkit (DSPT) support for NHS suppliers
- UK GDPR security controls, breach procedures and supplier assurance questionnaires
- Readiness for the Cyber Security and Resilience Bill if you are an MSP or supply essential services
What's included
Our approach
- ScopingDefine the systems, data and teams in scope for your framework.
- Gap assessmentControl-by-control review with a prioritised remediation roadmap.
- Remediation supportPolicies, procedures and technical controls implemented with your team.
- Testing & evidenceAudit-ready penetration tests, scans and monitoring evidence.
- Audit supportPre-audit review and support during auditor questions.
What you receive
- Gap assessment report and roadmap
- Policy and procedure set
- Risk register and treatment plan
- Audit-ready penetration test reports
- Evidence checklist mapped to controls
Standards & frameworks
- SOC 2
- ISO/IEC 27001:2022
- PCI DSS v4.0
- FCA SYSC
- GDPR
- UK GDPR & DPA 2018
- Cyber Essentials & Cyber Essentials Plus
- NHS DSPT
- NCSC CAF
- UK GDPR Art. 32
Frequently asked questions
Do you issue SOC 2 reports or ISO 27001 certificates?
No. SOC 2 reports are issued by licensed CPA firms and ISO 27001 certificates by accredited certification bodies. We prepare you and provide testing evidence, which keeps the audit independent.
How long does it take to become audit-ready?
It depends on your starting point. Many growing companies reach SOC 2 Type I or ISO 27001 readiness in a few months with focused effort.
Is a penetration test required for compliance?
PCI DSS explicitly requires it; SOC 2 and ISO 27001 auditors widely expect it as evidence for vulnerability management and control evaluation.
Can you help us get Cyber Essentials?
Yes. We run a readiness review against the current Cyber Essentials requirements, help you fix gaps and prepare evidence. The certification itself is issued by an IASME-licensed Certification Body, which you choose. We don't issue certificates ourselves.
Do you quote in pounds sterling?
Yes. UK proposals are fixed-price and quoted in GBP. Prices exclude VAT where VAT applies to cross-border services. We confirm the treatment for your organisation in the proposal.