SERVICES / SECURITY
Security that stands up to audit
We help you design controls and produce the evidence auditors and customers ask for.
An audit or a client security review is coming, the evidence is scattered across teams and the deadline is fixed. We design and build controls into the systems you run, on AWS, Microsoft Azure or Google Cloud, so the answers come with evidence. We don’t run a security operations center: detection is designed by us and run by your team or your managed security provider.
What we do
Identity and zero trust
Access decided per request, not per network location. One identity across your estate, with entitlements granted, reviewed and removed on purpose.
- Single sign-on and MFA with Microsoft Entra ID, AWS IAM Identity Center, Google Cloud IAM or Okta
- Privileged access with approval and expiry
- A joiner-mover-leaver process
Threat detection and response design
Detection rules and response runbooks so alerts arrive with the context your team, or your managed security provider, needs to act.
- SIEM design on Microsoft Sentinel, Amazon Security Lake with Amazon GuardDuty, or Google Security Operations
- Detection rules tuned to your estate
- Response runbooks with named owners
Data protection
Classify what matters, encrypt it in transit and at rest, and control where it is allowed to go.
- Classification and labeling
- Data loss prevention policies
- Key management in your cloud’s key service
Compliance and audit evidence
Controls mapped to the frameworks you are held to, with the evidence auditors ask for collected as your systems run.
- Control mapping and gap analysis
- Evidence collected automatically where possible
AUDIT READINESS
What your auditor asks, and what we build
Each question an auditor or a client security review will ask, and the control we put in place so the answer comes with evidence.
Who can access production, and who approved it?
Roles in your identity provider (such as Microsoft Entra ID, AWS IAM Identity Center or Google Cloud IAM), just-in-time privileged access, and access reviews with an exportable log.
How do you detect and respond to incidents?
Detection rules and response runbooks in your SIEM (such as Microsoft Sentinel, Amazon Security Lake with Amazon GuardDuty, or Google Security Operations), run by your team or your managed security provider.
How is sensitive data classified, protected and encrypted?
Classification and labeling, data loss prevention policies, and encryption keys held in your cloud’s key management service.
How do changes reach production, and who signed them off?
Infrastructure and policy as code, with peer review, pipeline approvals and a change history for every release.
How do you manage risk from third parties and AI models?
An inventory of suppliers and models in use, private access to AI endpoints, and logging of who called which model with what data.
Can you show the evidence for the last twelve months?
Logs and control evidence retained to your policy in immutable storage, exportable on request.
Our solutions
Get ready for a first or renewal audit against your target framework, with gaps closed in priority order.
- Control mapping and gap analysis
- Evidence collection designed in
- Readiness for the auditor who certifies
Answer long security questionnaires from your customers with evidence rather than assurances.
- Reusable answer library
- Evidence linked to each control
- Gaps flagged before the deadline
The same identity, data protection and logging rules applied to the AI models your teams are building on, designed in from the start.
- Model endpoints behind private networking and your identity provider
- Controls against prompt injection and data leakage
- Model access logging: who called which model, with what data
- Retrieval scoped to what each user is already allowed to see
COMPLIANCE FRAMEWORKS
Frameworks we design controls against
We help you design and evidence controls against these standards and regulations. We don’t certify or audit, and listing a framework here is not a claim of certification.
SOC 2
Trust services criteria for service organizations
ISO/IEC 27001
Information security management
HIPAA
US healthcare data protection
PCI DSS
Payment card data security
GDPR and UK GDPR
EU and UK data protection
DORA
EU digital operational resilience for financial entities
NIS2
EU cybersecurity rules for essential and important entities
UK Cyber Essentials
UK baseline technical controls
UAE IA standards
UAE information assurance standards
ISO/IEC 42001
Management systems for AI
How it runs
Review
A security architecture review of your current estate against your target framework.
Prioritize
Gaps ranked by risk and by what your auditor or customers will ask about first.
Build
Controls built into your identity, cloud, pipelines and data platform, with evidence collection designed in.
Hand over
Runbooks and evidence exports for your team or your managed security provider to operate.
What you get
- Controls mapped to your target framework
- Evidence collected as your systems run
- Detection rules and response runbooks with named owners
- An access model with reviews and an exportable log
- Documentation ready for your auditor
Questions we get asked
Do you run a security operations center?
No. We design detection and response and build it into your estate. It is run by your team or your managed security provider.
Can you certify us against SOC 2 or ISO/IEC 27001?
No. We help you design and evidence the controls, and prepare you for the independent auditor who certifies.
Which clouds and security tools do you work with?
AWS, Microsoft Azure and Google Cloud, and their native identity, SIEM and data protection services, alongside tools such as Okta, HashiCorp Vault and Splunk where you already run them.