We partner with clients to deliver expertise exactly where it's needed, and deliver bespoke programmes providing risk assurance, information security, and regulatory compliance.
Solutions
Gain full visibility of your organisation's risks and mitigate their impact on its objectives.
Bespoke Services
Packaged Services
Protect your most valuable information assets in the face of evolving cyber threats.
Bespoke Services
Packaged Services
Compliance services to support your organisation in meeting its regulatory obligations.
Bespoke Services
Packaged Services
Find all our thought leadership, case studies, news, blogs, podcasts and regulatory calendar updates here.
See how Xcina has benefitted businesses like yours.
Listen in as our industry experts provide the benefit of their experience.
The latest from across our clients’ industries.
Insight, thought leadership and opinion from our expert consultants.
Package selector
Pick the statement closest to your situation and we’ll point you to the right starting package.
01 · Recommended starting point
A fast, remote review of your security posture, benchmarked against Cyber Essentials and ISO 27001. You’ll get a clear picture and a prioritised list of what to fix first.
This is a review, not a fix. Penetration testing and implementation are available as a next step.
02 · Recommended starting point
We assess your security arrangements against the NIST Cybersecurity Framework, scoring each domain to build a maturity heat-map and a realistic improvement roadmap.
We assess and recommend; building your policies or running the improvement programme is a next step.
03 · Recommended starting point
A full gap analysis against every ISO/IEC 27001:2022 clause and Annex A control, run by our ISO 27001 Lead Auditors.
ISMS documentation, internal audit set-up and the certification audit itself are next steps.
04 · Recommended starting point
A practical review of how you handle personal data against UK/EU GDPR, giving you a clear picture of your risk and what to fix first.
Not legal advice or a formal DPO appointment. Building a ROPA from scratch is a next step.
05 · Recommended starting point
We review how you manage risk from outsourced providers and key suppliers, for a sample of your most important relationships.
We assess how you manage supplier risk; we don’t audit the suppliers themselves.
06 · Recommended starting point
An independent look at your internal audit methodology, resourcing, independence and reporting, benchmarked against the IIA’s international standards.
A review of effectiveness, not a regulatory inspection, and it doesn’t provide assurance to a regulator.
07 · Recommended starting point
We review your risk governance, registers, appetite and reporting against COSO ERM and ISO 31000.
If you don’t have a risk register yet, building one is a first step, not part of this review.
08 · Recommended starting point
We assess your ability to withstand disruption, critical services, dependencies, continuity plans and incident readiness.
Live crisis simulations and technical DR testing are available as a next step.
09 · Recommended starting point
We map your cardholder data environment, confirm your compliance route, and assess your controls against PCI DSS v4.x.
Formal PCI DSS validation is completed independently; we can help you get there.
01 + 04 · Recommended starting point
These two pair naturally as a first step, given the overlap in evidence gathering and stakeholder time.
A short scoping call is always an option, with no obligation.
Receive regular updates from our expert consultants as they provide clarification and guidance on issues impacting your organisation.
Subscribe >>