Security and Compliance

Implementing the controls a questionnaire, insurer or customer has asked for, and closing the gaps found along the way.

Most security work at this size is not sophisticated. It is multi-factor authentication that was never finished, accounts belonging to people who left, patches nobody owns, and backups that have never been restored. The gap between knowing that and having it done is where this work sits.

Who it is for

Companies that have been sent a security questionnaire by a customer.
Businesses renewing cyber insurance with new technical conditions attached.
Teams who know their patching and access control have drifted.
Founders who have never had anyone look at this properly.

Typical situations

A customer sent a security questionnaire

A larger client or prospect asks forty questions about your controls. Some answers are yes, some are no, and several are genuinely unknown. The deal is waiting on it.

The insurance renewal added conditions

Cover now depends on multi-factor authentication, tested backups or endpoint protection being in place. The policy is specific and the deadline is fixed.

Everyone has more access than they need

Permissions accumulate as people change roles, and accounts outlive the people who used them. Nobody has removed anything because nobody is certain what would break.

Backups exist but have never been restored

The backup job reports success every night. Whether the data can actually be restored, and how long that would take, has not been established.

What we deliver

A review of accounts, permissions and multi-factor coverage, with what to remove listed.
Multi-factor authentication implemented across the systems that matter.
A patching process with an owner and a schedule, not an intention.
Backups configured, and a documented restore test with the measured recovery time.
Centralised logging, so an incident can be reconstructed afterwards.
Written evidence of each control, in a form you can give an auditor or insurer.

Typical timeline

A fixed-price assessment usually takes one to two weeks once read-only access is granted. Implementation duration is set out in the assessment report and depends on scope and change windows.

Starts with a fixed-price assessment

Read-only access first, so nothing changes while we look. You get a written finding, a recommendation and a price before any work is agreed. If the finding is that you should do nothing yet, that is what it will say.

Book a fixed-price assessment

Common questions

Can you certify us for ISO 27001 or SOC 2?

No. Certification is issued by accredited bodies, and an independent assessor must evaluate the controls. We implement and document controls so that the assessment goes smoothly, but the audit itself has to come from somebody who did not build the system.

Can you fill in our customer's security questionnaire?

We can help you answer it accurately and identify which answers are currently no. We will not write an answer that is not true, and where a control is missing the honest answer with a remediation date is usually received better than a vague one.

Will you need administrative access to our systems?

Read-only access first, which is enough to assess. Anything beyond that is requested specifically, for a named purpose, and removed when the work is finished. An NDA is available before any access is granted.

What if you find something serious?

You are told immediately and directly, before the report. Findings are described plainly, with what is actually at risk, rather than scored and left for you to interpret.

Is this a penetration test?

No. A penetration test attempts to break in and tells you what an attacker could reach. This is about putting controls in place and keeping them working. The two are complementary, and a test is more useful once the obvious gaps are closed.

Nothing published on Security and Compliance yet. Advisories and articles tagged for this service will appear here as they are written.