OUR SERVICES
From first steps to ongoing support
Whether you’re starting from scratch, working towards certification or need someone to keep things on track, we shape our support around your business, your risks and your goals. The services below are where most clients start, but if you need something different, get in touch and we’ll design the right support. Every piece of work is quoted at a fixed price, agreed in writing before it begins.
UNDERSTAND YOUR RISKS
Risk & Security Health Check
From £750
A structured review of how you manage risk and protect your information across your people, processes and technology, benchmarked against our maturity model, informed by ISO 27001 and NCSC guidance.
What you get
Conversations with key people across your business
A review of your existing policies and documents
A prioritised risk register
A clear roadmap for your leadership team
Best for: businesses that want an independent view of where they stand and what to tackle first.
MEET THE STANDARDS
Cyber Essentials Readiness
Priced to your business
Cyber Essentials is the UK government-backed certification that shows your business has the essential protections against common cyber attacks. It’s often required for public sector and larger client contracts. We help you understand what’s in scope, close the gaps, and go into your assessment prepared.
What you get
Clear scoping, so you know exactly what's being assessed
A review of where you stand against each requirement, working with your IT team or provider
A plain-English action plan to close the gaps
Support completing the self-assessment, with the evidence to back it up
Best for: public sector suppliers, businesses in supply chains that require it, and anyone who wants to meet the UK security baseline.
Standards & Compliance Frameworks
Priced to your scope
Whether it’s ISO 27001, NIST CSF, the NCSC Cyber Assessment Framework, your regulatory obligations, or the security requirements your clients and contracts set, we help you understand where you stand and build what’s needed, in a way that fits how your business works.
What we offer
Gap analysis: a structured review against your chosen standard, showing how far you are and what it will take
Implementation: risk assessment, policies and controls built with your team, sized to your business
Internal audit: an objective review with clear findings and corrective actions, ready for your external auditor
Remediation: fixing gaps after an audit, incident or regulator finding, with a clear plan and hands-on support to close them
Other frameworks on request
Best for: businesses that need to meet a recognised standard or regulatory requirement for clients, investors, regulators or new markets, at any stage of the journey.
AI Governance
Priced to your needs
Practical governance that lets your business use AI confidently and safely, aligned to ISO/IEC 42001 and emerging UK and EU AI regulation.
What you get
AI use policies and staff guidance
I risk assessment: what’s in use, what data goes in, what could go wrong
Governance frameworks and readiness for ISO/IEC 42001
Training on using AI safely and effectively
Best for: businesses adopting AI tools that want the benefits without the data, legal or reputational risk.
POLICIES AND PEOPLE
Policy Pack
Priced to your needs
A core set of security policies written for your business, in language your team will understand and follow.
What you get
A review of any existing policies, so we build on what works
A suite of policies tailored to your size, sector and risks, including information security, acceptable use, access and passwords, and incident response
A structure that grows with your business
Best for: businesses with few or no written policies, or those that want a clear view of whether their existing policies are fit for purpose and followed in practice
Optional add-on: Policy Rollout Support. Policies only work if people read them. We’ll turn your new policies into short guides, launch messages and a staff briefing, so they land properly from day one.
Incident & Crisis Exercise
Priced to your needs
A facilitated, discussion-based walk-through of a realistic incident, such as ransomware, a lost laptop or a supplier breach, testing how your team makes decisions and communicates under pressure, before it matters.
What you get
A scenario tailored to your business and its risks
A facilitated session with your key people, testing roles, escalation and communications
A report of lessons learned and recommended improvements
Best for: businesses that have an incident plan but have never tested it, or want to find out whether they need one.
Security Awareness and Culture
Priced to your needs
Training and campaigns that change how your people behave, not just what they know. Every programme is built around your business, using real examples to embed a security culture that lasts.
What you get
Staff sessions, live, online or in person, covering phishing, passwords, handling client data and what to do when something goes wrong
Leadership briefings on their responsibilities and the real risks to the business
Ongoing campaigns and security champions to keep good habits going
Measurement and reporting to show what’s changing
Best for: businesses that need evidence of staff training for insurers, clients or certifications, and those that want security to become part of how everyone works.
ONGOING SUPPORT
Fractional GRC Support
Priced to your needs
From two days a month
Experienced governance, risk and compliance support without hiring a full-time role. We act as your GRC lead, keeping things on track as your business grows.
What you get
Keeping your risk register and policies up to date
Answering client security questionnaires
Supplier risk checks
Preparing for audits and certification renewals
Ongoing awareness campaigns to keep security front of mind
Regular reporting to your leadership team
Best for: businesses that need ongoing expertise but not a full-time hire.
Not sure what you need?
Get in touch for a free 20-minute intro call and we’ll help you find the right starting point.