Eight engagements,
performed seriously.
We do not offer twenty services badly. We offer eight, each engagement is staffed by a partner-grade lead from kickoff to issuance — the person you meet is the person who writes the report.
SOC 2 Type II
Trust Services Criteria, observed over time.
We perform Type I readiness, then Type II attestations across the Security, Availability, Confidentiality, Processing Integrity and Privacy criteria. Evidence is collected continuously across the observation window — not assembled in the final week.
- —Type I readiness and control design review
- —Type II attestation across the Security, Availability, Confidentiality, Processing Integrity and Privacy criteria
- —Continuous evidence collection across the observation window
- —Gap remediation guidance between fieldwork rounds
B2B software, SaaS and data-platform companies whose enterprise customers demand an independent attestation before signing — typically Series A and beyond.
- —Readiness assessment
- —Control narrative
- —Type II report
- —Bridge letters
ISO/IEC 27001
Certification, not just compliance.
Stage 1 documentation review, Stage 2 certification audit, and ongoing surveillance. Mapped to the 2022 revision of Annex A. We work alongside your ISMS owner, not around them.
- —Full ISMS build-out and gap analysis against the 2022 revision
- —Stage 1 documentation review and Stage 2 certification audit
- —Annex A control mapping and risk register review
- —Annual surveillance audits and recertification
Organisations selling into Europe, regulated industries, or any enterprise market where ISO 27001 certification is the recognised currency of trust.
- —Gap analysis
- —Stage 1 & 2 audit
- —Annex A mapping
- —Surveillance audits
HIPAA & HITRUST
For systems carrying PHI.
Security Rule, Privacy Rule and Breach Notification assessments for covered entities and business associates. HITRUST i1 and r2 validated assessments where a higher bar is required by counterparties.
- —Security Rule, Privacy Rule and Breach Notification assessments
- —Administrative, physical and technical safeguard testing
- —HITRUST i1 and r2 validated assessments
- —Risk analysis and documented remediation planning
Covered entities, business associates and health-technology vendors — anyone whose systems create, receive, maintain or transmit protected health information.
- —Risk analysis
- —Safeguard testing
- —HITRUST validation
- —Remediation plan
PCI DSS 4.0
Cardholder data, audited.
SAQ guidance for merchants, and Report on Compliance support for service providers. We hold the line on scope so the audit reflects what's actually in the cardholder data environment.
- —Cardholder data environment scoping and network segmentation review
- —SAQ guidance for merchants; Report on Compliance support for service providers
- —Gap remediation against the 4.0 requirements, including the new authentication controls
- —Attestation of Compliance (AOC) preparation
E-commerce merchants, payment processors and any service provider that stores, processes or transmits cardholder data.
- —Scope definition
- —Gap remediation
- —RoC drafting support
- —Attestation of Compliance
The deliverable is a bound report — written to be read, cited, and defended.
NIST CSF & 800-53
For federal and federal-adjacent systems.
Cybersecurity Framework profile development and 800-53 control assessments for organisations contracting with, or selling into, the public sector. We map findings to FedRAMP and CMMC readiness where adjacent.
- —Cybersecurity Framework current-state and target-profile development
- —NIST SP 800-53 control assessments
- —POA&M drafting and remediation sequencing
- —FedRAMP and CMMC readiness mapping where adjacent
Government contractors, agencies and companies selling into the public sector, or preparing a FedRAMP or CMMC submission.
- —Current/target profile
- —Control assessment
- —POA&M drafting
- —FedRAMP gap memo
Penetration Testing
Adversarial, not theatrical.
Black, grey and white-box engagements against web applications, APIs, cloud estates and internal networks. Each test is led by an OSCP-certified operator and concludes with an executive narrative plus a developer-grade technical appendix.
- —Black, grey and white-box engagements against web applications, APIs, cloud estates and internal networks
- —Manual exploitation led by an OSCP-certified operator — not automated scanner output
- —Threat modelling and attack-surface mapping before testing begins
- —Executive narrative plus a developer-grade technical appendix, with a retest of remediations
Engineering and security teams preparing for enterprise sales, satisfying annual testing requirements, or validating new products and major releases.
- —Threat model
- —Manual exploitation
- —Technical findings
- —Retest of remediations
Vendor & Third-Party Risk
Audit the supply chain.
Independent assessments of critical vendors, subprocessors and acquisition targets. Used by procurement, security and M&A teams when an internal questionnaire is no longer enough to satisfy the board.
- —Independent assessments of critical vendors, subprocessors and acquisition targets
- —Tiered vendor risk classification aligned to data sensitivity
- —Continuous remediation tracking across the vendor lifecycle
- —A board-ready summary of concentration and dependency risk
Procurement, security and M&A teams whose vendor population has outgrown questionnaires — and boards that need a defensible picture of third-party exposure.
- —Vendor inventory
- —Tiered assessments
- —Remediation tracking
- —Board-ready summary
Virtual CISO
A senior voice on retainer.
Partner-level security leadership for organisations between full-time hires. We chair your security council, brief the board, and shepherd remediation between formal audit windows. Engagements are bounded — never open-ended.
- —Partner-level security leadership between full-time hires
- —Quarterly risk roadmap and remediation prioritisation
- —Security council chairing, board briefings and board-report preparation
- —Shepherding remediation between formal audit windows, and policy stewardship
Organisations between CISO hires, or those too small for a full-time executive but facing customer, regulator or board demands for accountable security leadership.
- —Quarterly roadmap
- —Board reporting
- —Audit shepherding
- —Policy stewardship
Unsure which framework applies?
Tell us about the customers asking and the data you hold. We'll tell you what is required, what is theatre, and what you can defer.