UK buyers increasingly treat information security as a pre-contract condition. Frameworks, tenders and enterprise procurement teams ask for evidence: a certified management system, a recent penetration test, or both.
We build the management system that produces that evidence and coordinate the technical testing that proves it. One team for governance and controls, so your ISO 27001 scope, risk register and technical findings tell the same story.
Scope of the engagement
- ISO 27001 certification
- Full implementation of an information security management system: scoping, risk assessment, risk treatment, Annex A controls, documentation, internal audit and certification support.
- Cyber Essentials and Cyber Essentials Plus
- Readiness assessment and remediation support for the UK government-backed scheme that many public sector contracts require.
- Penetration testing coordination
- Independent VAPT of external and internal infrastructure, web applications and APIs, delivered through accredited testing partners with findings translated into an agreed remediation plan.
- ISO 27701 and privacy alignment
- Privacy information management extension for organisations handling personal data at scale, aligned with UK GDPR obligations.
- SOC 2 readiness
- Trust services criteria readiness for UK companies serving US customers, with control design and evidence preparation before the audit period begins.
- Supplier and third-party assurance
- Security questionnaires, due diligence responses and supplier assurance packs so procurement reviews stop stalling your sales cycle.
Standards and frameworks covered
ISO 27001
Information security management
The international standard for an auditable information security management system.
ISO 27701
Privacy information management
Extension for personally identifiable information, supporting UK GDPR accountability.
Cyber Essentials
UK baseline certification
Five technical controls, self-assessed or verified, required by many UK public contracts.
ISO 22301
Business continuity
Recovery planning and tested continuity for critical services and systems.
SOC 2
Trust services criteria
Readiness and evidence preparation for AICPA-aligned reporting.
VAPT
Vulnerability assessment and penetration testing
Independent technical testing with prioritised remediation guidance.
How the engagement runs
- 01
Scoping workshop
Define the ISMS boundary, the information assets that matter and the contractual obligations driving certification.
- 02
Risk assessment
Structured asset-based risk assessment, treatment plan and statement of applicability built with your IT and business owners.
- 03
Control implementation
Policies, access control, supplier management, incident response and awareness, adapted to your technology stack and size.
- 04
Technical testing
Independent penetration testing and vulnerability assessment coordinated with your IT team, with findings mapped to controls.
- 05
Internal audit and certification
Internal audit, management review and support through stage one and stage two certification audits.
What UK auditors and buyers expect
Procurement-driven timelines
Where a contract deadline drives certification, we plan the sequence backwards from the audit date and flag anything that cannot realistically be met.
UK regulatory context
Controls designed with UK GDPR, the Data Protection Act and sector regulators in mind, not imported wholesale from another jurisdiction.
Technical credibility
Findings from penetration testing are translated into prioritised, costed actions your board can approve and your engineers can implement.
Related services
Talk about it security
Ask the question you would ask an auditor.
Call or email and we will tell you what the standard requires of your business, what evidence you will need, and how long certification realistically takes.