Advisory & assessment
Understand your position against the standard and what it will take to close the gap.
Compliance documents with your name already on them.
Written by practising auditors. Buy a complete, editable set and download it within minutes, with your organisation's name and logo in every document. Or bring our consultants in to assess, implement and see you through ISO 27001, SOC 2, NIST, PCI DSS, NIS2 and DORA.
- Smart scoping, flexible pricing
- Practitioner-led
- Independent of certification bodies
- 50+Clients protected
- 25+Professional certifications
- 17+Frameworks covered
Certified expertise
- CISSP
- CISA
- ISO 27001 Lead Auditor
- CISMP
- CompTIA CySA+
- CompTIA Security+
- 25+ in total
Compliance Finder
Choose your sector and where you operate. You get a shortlist of the laws and standards you are likely to face, the services that help, and the documentation that fits.
Your shortlist appears here
- RequirementsThe laws, contracts and standards likely to apply, and why
- ServicesWhere our consultants can help first
- DocumentationThe sets that fit, with bundles where they save money
Deep experience in regulated and high-assurance sectors.
Choose yours to see what applies in the Compliance Finder.
Financial servicesDORA, PCI DSS and regulator expectations for operational resilience.Defence & government supply chainCMMC, NIST 800-171, Cyber Essentials Plus and security-cleared delivery.Technology & SaaSISO 27001 and SOC 2 to unblock enterprise procurement.Critical infrastructure & energyNIS2 obligations, OT-aware risk assessment and incident readiness.Healthcare & life sciencesData protection, ISO 27001 and supplier assurance for sensitive data.Legal & professional servicesClient-driven certification and confidentiality controls.ManufacturingSupply chain security requirements from customers and insurers.Public sectorCyber Essentials, NIST CSF and framework-based assurance against national baselines.
Four ways we help, depending on where you are.
Implementation
Build the management system, controls, documentation and evidence with your team.
Audit & assurance
Independent testing of the system before your certification body, customers or regulator do.
Testing & resilience
Find the weaknesses before attackers do, and be ready when something gets through.
Compliance that holds up after the certificate is issued.
Most programmes are built to pass one audit. Ours are built so your own team can run them, evidence them, and pass the next one without us.
- Practitioner-ledLed by CISSP, CISA and ISO 27001 Lead Auditor certified practitioners who have implemented and audited the standards we advise on.
- Smart scoping, flexible pricingScoped to what you actually need and priced to suit how you work: a defined project, phased delivery or an ongoing retainer.
- IndependentWe prepare you for certification and support you through it; we do not certify, resell or refer for commission.
- Documentation written in-houseComplete policy, standard and procedure sets, maintained to current framework editions.
From first call to audit-ready, in sixty seconds.
A typical certification engagement
Around sixteen to twenty weeks from first call to Stage 2, depending on what already exists.
Weeks 1–3Gap assessment and roadmap
Weeks 4–14Build: risk, controls, documentation, evidence
Weeks 15–17Internal audit and management review
Weeks 18–20Stage 1 and Stage 2 support
Complete, editable compliance documentation.
The policy, standard and procedure sets we use on engagements, available to buy directly.
£495
Policies & Standards — ISO/IEC 27001:2022
A complete policy and standards set structured to the 93 Annex A controls of ISO/IEC 27002:2022, plus the clause 4–10 management-system requirements.
£1,250NIST SP 800-171 R3 & CMMC Level 2 Programme
Everything a defence supplier needs to document CUI handling: policies, standards, procedures, System Security Plan and POA&M, aligned to 800-171A assessment objectives.
£595Procedures Library
Step-by-step operating procedures that show how each control is actually carried out, who does it, how often, and what record it produces.
Guidance from our consultants.
Guide
Policies vs standards vs procedures: what each one is for
The three words get used interchangeably, and it causes findings. A simple test for which is which.
Comparison
ISO 27001, SOC 2, NIST, PCI DSS, NIS2, DORA: which applies to you?
Usually you do not choose; something chooses for you. A side-by-side of the frameworks we work with.
Explainer
NIST 800-171 R3 and CMMC Level 2: what assessors actually check
Assessors work from the 800-171A objectives, not the requirement text. What that means for your evidence.
Speak to a consultant
A 30-minute scoping call to understand your obligations, timeline and options. No obligation.