Services
Consulting across security, compliance and delivery
What each service covers, and exactly what you receive at the end of it.
Cyber Security
A clear view of your security position, and a practical plan to improve it. We look at your people, processes and technology together, then rank the work by business risk.
What we do
- Security risk assessments
- Security architecture and configuration reviews
- Hardening of servers, networks and cloud accounts
- Incident response planning and tabletop exercises
- Security awareness sessions for staff
What you receive
- Risk register with named owners
- Prioritised security roadmap
- Hardening baselines for your systems
- Incident response plan your team has rehearsed
Reference frameworks: NIST CSF, CIS Controls
Policy Documentation
Documents that staff can follow and auditors can accept. We write from how your organisation really operates, so the policy and the practice match.
What we do
- Information security policy sets
- Acceptable use, access control and data handling policies
- Business continuity and disaster recovery documents
- Standard operating procedures
- Review and update of existing documents
What you receive
- Complete, version-controlled policy set
- Procedures mapped to each policy
- Named owners and a review schedule
- Sign-off pack for management
Aligned to: ISO/IEC 27001, ISO/IEC 27002
Security Audit
An objective check of whether your controls exist, work and leave evidence. We audit against the standard you need, or against your own policies.
What we do
- Internal audits and readiness reviews
- Gap assessments against a chosen standard
- Access, change and backup control testing
- Third-party and vendor security reviews
- Follow-up reviews after remediation
What you receive
- Audit report with evidence for each finding
- Findings ranked by risk
- Corrective action plan with owners and dates
- Management summary
Audit approach follows: ISO 19011
ISO/IEC 27001
A working information security management system, not a folder of templates. We take you from first gap analysis through to the certification audit.
What we do
- Gap analysis against ISO/IEC 27001:2022
- ISMS scope and context definition
- Risk assessment and risk treatment planning
- Statement of Applicability
- Internal audit and management review
- Support during Stage 1 and Stage 2 audits
What you receive
- Documented ISMS ready for audit
- Risk treatment plan and Statement of Applicability
- Evidence pack for each applicable control
- Internal audit report and corrective actions
Standard: ISO/IEC 27001:2022, Annex A (93 controls)
DevOps
Faster, safer releases. We automate how you build, test and deploy, and build security checks into the pipeline so they run on every release.
What we do
- CI/CD pipeline design and setup
- Infrastructure as code
- Containers and Kubernetes
- Monitoring, logging and alerting
- Automated code, dependency and secret scanning
What you receive
- Automated, repeatable deployments
- Infrastructure defined in version control
- Dashboards and alerts for your services
- Runbooks and a handover to your team
Practice area: DevSecOps
Penetration Testing
We attack your systems the way a real adversary would, under written authorisation and agreed rules. You see what can really be exploited, not a raw scanner export.
What we do
- Web application and API testing
- Mobile application testing
- Internal and external network testing
- Cloud configuration testing
- Retesting after you remediate
What you receive
- Executive summary for management
- Technical report with proof for each finding
- Severity rating and fix guidance
- Retest confirmation of closed findings
Methodology references: OWASP WSTG, PTES, NIST SP 800-115
