From gap analysis to certificate.
We prepare your business for SOC 2, ISO 27001, Cyber Essentials, GDPR and Amazon’s data protection review. Choose a framework to see your roadmap.
- Gap analysis and control mapping
- Policy suite and risk register
- Evidence collection plan
- Penetration test report
- Auditor liaison
- Scope and ISMS definition
- Statement of Applicability
- Risk assessment and treatment plan
- Internal audit and management review
- Certification body support
- Scope and device review
- Fixes for the five controls
- Self-assessment questionnaire help
- Plus technical readiness check
- Assessor introduction
- Data mapping and lawful basis
- Privacy notices and DPIAs
- Subject-rights procedures
- Breach response plan
- Processor and vendor review
- Privacy gap analysis
- PIMS scope and roles
- Controller and processor controls
- Records of processing
- Audit support
- DPP gap assessment
- Bespoke policy suite
- SP-API-focused penetration test
- 30-day scanning evidence
- Submission support
We get you ready. Your auditor certifies.
- Gap analysis against your framework
- Policies, procedures and risk register
- Control implementation support
- Staff security awareness training
- Penetration test and technical evidence
and handover
- Reviews your evidence
- Interviews your team
- Tests controls independently
- Issues the report or certificate
We introduce trusted auditors and stay beside you through the audit, answering evidence requests.
One set of controls. Many frameworks.
Frameworks overlap heavily. Build the controls once and reuse the evidence. Hover a row to see where it counts.
| Control area | SOC 2 | ISO 27001 | Cyber Essentials | GDPR | ISO 27701 | Amazon SP-API |
|---|---|---|---|---|---|---|
| Access control and MFA | Covered | Covered | Covered | Covered | Covered | Covered |
| Risk assessment and register | Covered | Covered | Not covered | Covered | Covered | Not covered |
| Incident response plan | Covered | Covered | Not covered | Covered | Covered | Covered |
| Vulnerability management and testing | Covered | Covered | Covered | Not covered | Not covered | Covered |
| Data retention and deletion | Not covered | Covered | Not covered | Covered | Covered | Covered |
| Vendor and supplier management | Covered | Covered | Not covered | Covered | Covered | Covered |
| Security awareness training | Covered | Covered | Not covered | Covered | Covered | Not covered |
| Encryption and secure configuration | Covered | Covered | Covered | Covered | Not covered | Covered |
Most control areas count towards four or more frameworks.Covered | ||||||
Everything between you and the audit.
Your own testers back the technical evidence, so you don’t need a separate security vendor.
About our penetration testingGap analysis
Your controls measured against the framework.
Policy and procedure writing
Bespoke documents that match how you work.
Control implementation
Hands-on help closing gaps, not just a list.
Risk assessment and register
A living record of risks and how you treat them.
Staff awareness training
Short, practical training your team will finish.
Evidence and audit prep
Organised evidence and dry-run interviews.
Auditor introductions
Vetted auditors at fair prices.
Penetration test as evidence
Our own testers supply the technical proof.
Ongoing monitoring with a vCISO
Stay compliant as your business changes.
Start where you are.
Straight answers.
Do you issue the certificate?
No. An independent auditor or certification body does, which is what gives the certificate its value. We prepare you, introduce auditors and support the audit.
How long does it take?
It depends on the framework and where you start. We agree a timeline with you after a readiness assessment.
Can we pursue more than one framework?
Yes, and it’s efficient. Most controls overlap, so a second framework costs far less than the first.
We have no security team. Is that a problem?
No. Most of our clients are small teams. We do the heavy lifting and keep your effort to a few hours a week.
Do we need a penetration test?
SOC 2 and ISO 27001 auditors usually expect one. Amazon requires it for PII access. We run it ourselves, so the evidence matches your controls.
What happens after we’re certified?
Certificates renew annually. Our ongoing package keeps evidence fresh and controls working so renewal is routine.
Know exactly what’s between you and certified.
A 30-minute call to pick a framework, check your readiness and agree a realistic timeline.