Service 02
Governance, risk & compliance
We help you work out which security frameworks apply to you, where you fall short and what to do about it. Then we build the controls, policies and habits that keep you compliant.
What it covers
01
Compliance readiness
Gap assessments and remediation plans against ISO 27001, PCI-DSS, HIPAA and NIST.
02
Risk management
Identifying, rating and treating information-security risk, and keeping a risk register your leadership can actually use.
03
Policy review
Reviewing and writing the security policies your framework and your people actually need.
04
Security awareness training
Phishing simulations, workshops and ongoing education, so your staff spot an attack and report it.
Frameworks & platforms we work with
Standards and platforms we work to and on. Not certifications or partner statuses.
- ISO 27001
- PCI-DSS
- HIPAA
- NIST
How an engagement runs
01
Scoping
We confirm which framework you need to meet, or which one customers are asking you about, and which parts of the organisation it has to cover.
02
Gap assessment
We check your policies, controls and evidence against each requirement. That means reading the documents and talking to the people who run the controls day to day.
03
Roadmap
You get the gaps ranked by risk and effort, with a plan for what to do, in what order and who owns each step.
04
Remediation & audit readiness
We help write the policies, put the controls in place and gather the evidence an auditor will ask for. If you're going for certification, we can run an internal audit before the external one.
What you receive
- A gap assessment against the framework you answer to
- A prioritised remediation roadmap
- Policies, controls and evidence ready for audit
Start a conversation
Talk to us about compliance & risk.
A penetration test, a compliance deadline, a system to build. Tell us where you are and we'll come back to you with how we'd approach it.