Ready for the audit.
Working all year.

Getting certified is a project with a lot of evidence attached. We run it end to end: ISO 27001, SOC 2 (Type I and Type II), ISO 9001, ISO 22301, ISO 42001 for AI management, and PCI DSS — starting with an honest gap assessment, then the policies, procedures and controls written for your business, the evidence collected the way auditors want to see it, internal audit and a mock assessment before the real one, and support through the audit itself.

You come out ready for independent assessment — and, more usefully, with a management system your team understands and can keep running. Certification or attestation is decided by the independent assessor.

Regulation follows your customers and your data across borders. We help you meet it: HIPAA for healthcare data, GDPR and UK GDPR for European and British customers, CCPA and US state privacy laws, India's DPDP Act, the NIST Cybersecurity Framework, SOX controls support, and EU AI Act readiness for AI systems that touch European users.

We translate each regulation into what it means for your operation — the notices, the records, the controls, the roles — and build it into how you already work. Where a law is new or changing, we tell you what is in force now and what is coming, so you spend on what matters first.

You should know whether your controls work before anyone else tests them. We provide readiness assessments and gap analysis, internal audit, audit support and evidence management, vulnerability assessment and scanning, and penetration testing delivered through our specialist partners — with findings written for the people who have to fix them, ranked by real risk, and tracked to closure.

For audit season, we manage the evidence: what each control needs, who owns it, where it lives, and whether it is current — so the audit becomes a review, not a scramble.

Risk registers are easy to write and hard to use. We build ones that work: risk assessments tied to your real assets and processes, third-party and vendor risk management so the partners you rely on are assessed and monitored, business continuity and disaster recovery plans that are tested rather than filed, and incident response planning that tells everyone what to do in the first hour.

The output is not a document. It is a business that knows what it would do — and has practiced.

This is the service most compliance programs are missing. After the certificate, someone has to implement the remaining controls, remediate findings, keep policies and standards current, and monitor compliance continuously — collecting evidence as it is created, tracking changes, onboarding new vendors and systems into the framework, and catching drift before the next audit does.

We run it as an operation, with a calendar, an owner, dashboards you can see, and the same discipline we bring to any other process. It is what makes the certificate true in month eleven.

Many businesses need senior security and compliance leadership long before they can justify a full-time hire. We provide it: a virtual CISO who owns your security strategy and answers to your board, a compliance officer as a service who runs your program and speaks to your regulators and customers, a data protection officer as a service where the law or your customers require one, and AI governance for the systems you are starting to depend on.

Experienced people, a defined number of days a month, a named deputy, and the rest of our team behind them.