Governance, audit
& compliance.

Technology due diligence for private equity and M&A, or sell-side readiness before you go to market. A fixed fee agreed before we start, and a remediation estimate the deal team can model.

A contract, a regulator, an insurer or a prime contractor has named a standard. We work out what applies, measure the gap, then close it in priority order.

It now has to stay true. We operate the controls and capture the evidence as the work happens, so the trail is current at the next assessment or questionnaire.

The evidence that your controls are in place and working, captured as the technology is run and packaged against the standard being assessed.

• Evidence packs
• Logging and records
• Internal review
• Between assessments

Preparation for Cyber Essentials and for Cyber Essentials Plus, which adds a technical audit where an assessor tests a sample of your devices and accounts, and the controls kept in place at each annual renewal. As an appointed Cyber Essentials and Cyber Essentials Plus certification body, we also assess and certify other organisations, including your suppliers.

• Readiness review
• Plus audit
• Annual renewal
• Supplier assurance

An information security management system (ISMS), from gap analysis and risk treatment to internal audit and certification support. We hold ISO 27001 ourselves. Your chosen certification body performs the external certification audit.

• Gap analysis
• ISMS build
• Internal audit
• Certification support

Alignment to the Cyber Assessment Framework for organisations in scope of the NIS Regulations, mapped across the framework's outcomes in the order that closes each gap.

• CAF objectives A to D
• NIS Regulations
• Gap to outcome mapping

What applies to you, from GDPR and the UK data protection regime to the rules your regulator enforces: Cyber Essentials, ISO 27001, FCA systems and controls, SRA, CQC, the NHS Data Security and Protection Toolkit, PCI DSS. Working out which of them applies is the first piece of work. A prioritised path, with the policies and evidence behind it, is the second.

• GDPR readiness
• Sector rules
• Policy frameworks
• Evidence

The documented backbone every standard expects: information security and acceptable use policies, access control and data retention procedures, continuity and incident response plans, written for how you work.

• Security policy
• Access control
• Data retention
• Incident plan

Fixed-fee technology due diligence for private equity and M&A: what a target's IT and custom software are worth, what they cost to own, and whether that changes your offer. If you complete, we can fix what we found.

• Deal Scan
• Technical DD
• Sell-side readiness
• PE and M&A