SVC.01.1
ISO 27001 certification and ISMS implementation
We build the management system and evidence your auditor will ask for, and stay with you through certification.
SVC.01
Certification you can defend in the audit room.
Plenty of firms will sell you a policy pack. It will pass a tick-box review and fail the first real one. We build the management system, implement the controls with your engineers, produce the evidence, and stay with you through the audit and the surveillance cycle after it.
Services
What we do
SVC.01.2
Information Security Office as a Service (vCISO)
Outsourced security leadership for organisations that need the function before they need a full-time hire.
SVC.01.3
Risk assessment and risk register management
Identify what actually threatens you, and keep the register current as things change.
SVC.01.4
Penetration testing and technical assurance
Application, infrastructure and cloud testing, delivered in house by our own tester, with retest included.
SVC.01.5
Secure code review and architecture review
We read the code and the design, not just the scan output.
SVC.01.6
Third party and vendor risk management
A programme you can run, not a spreadsheet that ages.
SVC.01.7
Cyber Essentials and Cyber Essentials Plus
The baseline that increasingly gates procurement and insurance.
SVC.01.8
Incident response planning and tabletop exercises
A plan your people have actually rehearsed.
Deliverables
What you get
- 01A scoped ISMS with the Statement of Applicability mapped to your real systems.
- 02Policies written for your organisation, not a template pack with your logo on it.
- 03Implemented controls, with the engineering work done alongside your team.
- 04An evidence pack an auditor can work through without a meeting.
- 05Internal audit and management review, run properly and minuted.
- 06Named support through Stage 1 and Stage 2, and through the first surveillance audit.
Engagements
Engagement
ISO 27001, readiness to certification
Shape
Fixed fee, 12 to 20 weeks
From
from £15,000
Engagement
Cyber Essentials and Cyber Essentials Plus
Shape
Fixed fee, 3 to 5 weeks
From
from £1,500
Engagement
Penetration test
Shape
Per engagement, retest included
From
from £3,000
Engagement
vCISO retainer
Shape
Monthly, 12 month term
From
from £2,000 per month
Engagement
Third party risk programme
Shape
Fixed fee
From
from £8,000
Engagement
Incident response plan and tabletop
Shape
Fixed fee
From
from £4,000
Ranges are indicative. Every engagement is scoped and quoted as a fixed fee before it starts, so you are not managing a day rate.
Fit
Who this is for
01
You have signed a contract that requires ISO 27001 and you have months, not years.
02
Your last certification was a paper exercise and the surveillance audit is coming.
03
You are losing deals in security review.
04
You need a security function but cannot yet justify a full-time CISO.
FAQ
Questions, answered.
Next step
Start with a conversation, not a proposal.
Thirty minutes. We will tell you what we would do, what it would take, and whether we are the right firm for it.