Service Catalogue

Package selector

What’s on your mind right now?

Pick the statement closest to your situation and we’ll point you to the right starting package.

  • Concern about cyber security, without a clear starting point

    01 · Recommended starting point

    Cybersecurity Health Check

    A fast, remote review of your security posture, benchmarked against Cyber Essentials and ISO 27001. You’ll get a clear picture and a prioritised list of what to fix first.

    £4,500Indicative fee
    1–2 weeksElapsed time

    What we do

    • Confirm scope against Cyber Essentials and ISO 27001 Annex A
    • Review policies, technical setup and third-party/cloud arrangements
    • Interview your IT lead and firm leadership
    • Score each area red, amber or green
    • Deliver a report and walk your leadership through it

    What’s not included

    This is a review, not a fix. Penetration testing and implementation are available as a next step.

    Download the full catalogue

  • Preparing for a client panel, tender or due diligence request

    02 · Recommended starting point

    Information Security Maturity Review

    We assess your security arrangements against the NIST Cybersecurity Framework, scoring each domain to build a maturity heat-map and a realistic improvement roadmap.

    £6,000Indicative fee
    2–3 weeksElapsed time

    What we do

    • Apply a five-point maturity scale across NIST CSF’s six domains
    • Gather evidence across policies, process and technical controls
    • Interview governance, IT and risk stakeholders
    • Score each domain and benchmark against peers
    • Set a target state and a prioritised roadmap

    What’s not included

    We assess and recommend; building your policies or running the improvement programme is a next step.

    Download the full catalogue

  • Actively pursuing ISO 27001 certification

    03 · Recommended starting point

    ISO 27001 Readiness Assessment

    A full gap analysis against every ISO/IEC 27001:2022 clause and Annex A control, run by our ISO 27001 Lead Auditors.

    £6,750Indicative fee
    3–4 weeksElapsed time

    What we do

    • Agree the boundary of your ISMS
    • Check every mandatory clause and all 93 Annex A controls
    • Review documentation and talk to key stakeholders
    • Draft a Statement of Applicability for sign-off
    • Score certification readiness and set a route to get there

    What’s not included

    ISMS documentation, internal audit set-up and the certification audit itself are next steps.

    Download the full catalogue

  • Uncertainty about GDPR or data protection compliance

    04 · Recommended starting point

    GDPR & Data Protection Review

    A practical review of how you handle personal data against UK/EU GDPR, giving you a clear picture of your risk and what to fix first.

    £4,500Indicative fee
    2–3 weeksElapsed time

    What we do

    • Benchmark against the ICO’s Accountability Framework and GDPR’s core articles
    • Review your record of processing (ROPA) and lawful basis
    • Walk through data subject rights and retention practice
    • Check processor contracts and international transfer safeguards
    • Build a remediation plan, prioritised by risk

    What’s not included

    Not legal advice or a formal DPO appointment. Building a ROPA from scratch is a next step.

    Download the full catalogue

  • Growing reliance on outsourced or cloud suppliers

    05 · Recommended starting point

    Third-Party Risk Review

    We review how you manage risk from outsourced providers and key suppliers, for a sample of your most important relationships.

    £4,500Indicative fee
    2–3 weeksElapsed time

    What we do

    • Review how you classify suppliers by criticality
    • Check due diligence and onboarding practice
    • Review contracts and controls for a sample of key suppliers
    • Assess ongoing monitoring of supplier performance and risk

    What’s not included

    We assess how you manage supplier risk; we don’t audit the suppliers themselves.

    Download the full catalogue

  • Preparing for a regulatory or professional body inspection

    06 · Recommended starting point

    Internal Audit Effectiveness Review

    An independent look at your internal audit methodology, resourcing, independence and reporting, benchmarked against the IIA’s international standards.

    £5,250Indicative fee
    2–3 weeksElapsed time

    What we do

    • Benchmark against the IIA’s IPPF and relevant ISQM requirements
    • Review methodology, charter and planning approach
    • Check audit coverage against your risk profile
    • Assess independence, competency and resourcing

    What’s not included

    A review of effectiveness, not a regulatory inspection, and it doesn’t provide assurance to a regulator.

    Download the full catalogue

  • Wanting more structured, documented risk management

    07 · Recommended starting point

    Enterprise Risk Management Health Check

    We review your risk governance, registers, appetite and reporting against COSO ERM and ISO 31000.

    £4,500Indicative fee
    2–3 weeksElapsed time

    What we do

    • Benchmark against COSO ERM and ISO 31000
    • Review who owns risk and how it’s governed
    • Assess your risk register’s design and quality
    • Check how and how often risk is reported to leadership

    What’s not included

    If you don’t have a risk register yet, building one is a first step, not part of this review.

    Download the full catalogue

  • Concern about continuing to serve clients through disruption

    08 · Recommended starting point

    Operational Resilience Assessment

    We assess your ability to withstand disruption, critical services, dependencies, continuity plans and incident readiness.

    £5,250Indicative fee
    2–3 weeksElapsed time

    What we do

    • Benchmark against ISO 22301 and relevant professional body expectations
    • Identify critical, client-facing services and deadlines
    • Map dependencies: people, technology, premises, third parties
    • Review continuity/DR plans and incident readiness

    What’s not included

    Live crisis simulations and technical DR testing are available as a next step.

    Download the full catalogue

  • Accepting or processing card payments, unsure of PCI DSS scope

    09 · Recommended starting point

    PCI DSS Scoping & Gap Assessment

    We map your cardholder data environment, confirm your compliance route, and assess your controls against PCI DSS v4.x.

    £6,750Indicative fee
    3–4 weeksElapsed time

    What we do

    • Map cardholder data flows and the CDE boundary
    • Confirm your merchant/service provider level and validation route
    • Review network segmentation, where used
    • Assess applicable PCI DSS v4.x requirements

    What’s not included

    Formal PCI DSS validation is completed independently; we can help you get there.

    Download the full catalogue

  • Not sure, or several areas of concern at once

    01 + 04 · Recommended starting point

    Cybersecurity Health Check + GDPR & Data Protection Review

    These two pair naturally as a first step, given the overlap in evidence gathering and stakeholder time.

    £4,500Indicative fee
    each, run in parallelElapsed time

    What we do

    • Two independent reviews, scoped and delivered together
    • One combined kick-off and evidence request
    • Two separate reports with prioritised recommendations

    What’s not included

    A short scoping call is always an option, with no obligation.

    Download the full catalogue

    Subscribe to Updates

    Receive regular updates from our expert consultants as they provide clarification and guidance on issues impacting your organisation.

    Subscribe >>