Talk to an architect

Managed Security

Security engineered in, compliance built to pass.

Readiness for ISO 27001, SOC 2, NIS2, DORA, PCI DSS, HIPAA, Cyber Essentials and CMMC, with policies, risk management and evidence run as an operating program.

Talk to an architect What is included

Sound familiar

Where this usually starts.

Security bolted on before an audit fails the audit. We design controls that work in operation and build the compliance program around them, aligned to the frameworks your customers and regulators actually ask about, so evidence is a by-product of how the work runs rather than a scramble before the auditor arrives.

Tick the ones that sound like your situation.

Scope

What is included.

  • Gap assessment

    Your current controls measured against the framework you are asked about.

  • Policies and procedures

    A policy set written for how you actually work, approved and published.

  • Risk management

    A risk register with owners, treatment plans and reviews.

  • Control implementation

    Technical and organizational controls built, not just documented.

  • Evidence collection

    Evidence gathered continuously from the systems that produce it.

  • Audit support

    Preparation for, and support during, the certification or attestation audit.

Reference architecture

From every signal to one response, and the evidence for the audit.

Governance sits at the top of the security architecture: controls and evidence drawn from the systems below, and risk reporting that turns them into decisions for leadership and answers for auditors.

From every signal to one response, and the evidence for the audit. TELEMETRY DETECT RESPOND GOVERN Email Endpoints Identity Cloud SIEM EDR and XDR Vulnerabilityscanning SOC analysts Containment Incident response Controls andevidence Risk reporting

What this service delivers here

  • Controls and evidence

    Each control mapped to ISO 27001, SOC 2 or NIS2, with its evidence kept current.

  • Risk reporting

    What is exposed, what was fixed and what remains, with owners.

Walk through every flow in Managed Security

Before you start

Decisions to settle early.

  • Which framework first

    The one your customers or regulators ask about. Others are mapped onto the same controls later.

  • Build in-house or outsource

    Some organizations want to own the program; others want it run for them. Either way, controls must work in operation.

  • Which tools hold the evidence

    Compliance platforms automate evidence collection; a well-organized library can be enough for smaller programs. We recommend by scale.

Approach

How the work runs.

  1. Assess

    Current controls against the framework

  2. Build

    Policies and controls that work in operation

  3. Evidence

    Collected as the work runs

  4. Audit

    Supported through to the auditor's report

Commercials

How it is bought.

  • A fixed-fee assessment

    We measure your current practice against the framework you are asked about and review existing policies and evidence. You receive the gap assessment and a fixed price for the program.

  • A fixed-price build

    Policies, the risk register, control implementation, evidence collection and audit preparation for the framework in scope, at a fixed price.

  • Running it afterwards

    Between audits, the program can continue monthly or quarterly with risk reviews, internal audits and evidence checks.

Start with the assessment.

Scope an assessment

Worked example

A certification a customer now requires.

Say a software company's largest prospect requires an information security certification before it will sign. The company has sound engineering habits, but no policies, no risk register and no evidence an auditor would accept.

  1. Assess

    We measure current practice against the standard and find that many controls already operate, but nothing records that they do.

  2. Build

    Policies are written for how the company actually works, a risk register is set up with owners, and the missing controls are implemented.

  3. Evidence

    Evidence is collected from the systems that produce it, such as access reviews, change records and backup reports, so it builds up as the work happens.

  4. Audit

    The company goes through the certification audit with our support, and the auditor's questions are answered from the evidence library.

At the end, the company goes into its audit with a working management system and evidence for each control, and the next audit becomes a review of evidence it is already collecting.

An illustration

An illustration, not a client account.

Where it goes wrong

What we design out.

  • Policies written for the auditor

    Documents nobody follows fail the first sample test. Policies describe how you actually work.

  • Evidence gathered the week before

    A scramble before the audit produces gaps and stress. Evidence comes from systems as the work happens.

  • One program per framework

    Running separate programs for each standard multiplies the work. Overlapping controls are mapped once and reused.

Outcomes

What it changes.

  • Questionnaires answered

    Customer security questionnaires are answered from documented controls, quickly and consistently.

  • Audits without a scramble

    Evidence collected as the work runs means the audit tests what exists.

  • Risk decisions on record

    Accepted risks are documented with an owner and a review date, which is what regulators expect to see.

How you will know it is working

  • Customer security questionnaires are answered from records.
  • Every risk in the register has an owner and a review date.
  • Evidence for each control is current at any point in the year.
  • Audits find fewer issues each cycle.

You keep

What you have at the end.

Handover pack

five items

  1. Gap assessment against the chosen framework Each requirement of the framework, how far your current practice meets it, and the work to close the gap.
  2. Policy set and procedures Policies written for how your organization works, approved by its leadership and published to staff.
  3. Risk register and treatment plan Your information risks with owners, ratings and the treatment chosen for each, reviewed on a schedule.
  4. Statement of applicability or control matrix Which controls apply, why, and how each is implemented, in the form your auditor expects.
  5. Evidence library ready for audit The records that show each control operating, collected from the systems that produce them.

The team

Who you work with.

  • Compliance lead

    Runs the gap assessment, owns the program plan and prepares for audit.

  • Security engineer

    Implements the technical controls and the evidence collection from systems.

  • Risk analyst

    Builds and maintains the risk register with your owners.

What we need from you

  • A sponsor from leadership who can approve policies.
  • Owners for the risks and controls in scope.
  • Access to the systems that produce evidence.
  • The questionnaire or requirement that started the work.

Detect, contain, recover and learn, with the same engineers throughout.

Questions

Questions we get asked.

Do you provide certification?

We provide engineering, assessment and readiness support aligned to the framework. Formal certification or attestation remains the role of an accredited independent assessor where one is required.

Where should we start if we have never had a security assessment?

With the systems that would hurt most if they failed, not with a framework checklist. A first assessment maps what you run, who can reach it and what an attacker would target, which is usually enough to reorder a security budget.

Can you help us respond to a client security questionnaire?

Yes, and it is a common starting point. The questionnaire is also a useful diagnostic: the questions you cannot answer confidently tend to be the same gaps a real assessment would find.

Can one program cover several frameworks?

Yes. ISO 27001, SOC 2, NIS2 and most sector rules overlap heavily, so we build one control set and map it to each framework rather than running parallel programs that duplicate the evidence.

What is the difference between ISO/IEC 27001 and SOC 2?

ISO/IEC 27001 is an international standard for an information security management system, certified by an accredited body, and common in Europe and the Middle East. SOC 2 is an auditor's attestation report on controls against criteria set by the AICPA, and common with North American customers. Many controls overlap, so one program can prepare for both.

Do NIS2 and DORA apply to us?

NIS2 applies to medium and large organizations in a wide list of sectors operating in the EU, and to some smaller ones in critical roles. DORA applies to financial entities in the EU and brings their critical technology providers under an oversight framework. We assess your position against the legal criteria, and your counsel confirms it.

How much documentation does a compliance program need?

Enough to show that controls are designed, implemented and operating, and no more. Policies are short enough to be read, procedures describe what people actually do, and most evidence comes from systems rather than from documents written for the audit.

What happens after certification?

Certification is kept through surveillance audits and a recertification cycle, so controls have to keep operating and evidence has to keep building up. We can support the program between audits with risk reviews, internal audits and evidence checks, so the next audit holds no surprises.

Ask about your situation

Answered from this site, with its sources.

Where it is bought

Governance, risk and compliance, by sector and region.

Sectors that ask for it

Region homes, and who signs

Often paired with

What usually comes next.

Everything in Managed Security

CONTACT

Turn security requirements into operating controls.

Whether the trigger is a questionnaire, an audit or a new regulation, start with a clear view of the control gaps.

  • Senior-led
  • Accountable
  • Direct
  • Fixed-price options
  • Compliance-ready
  • 24/7 capable

Prefer to talk it through? Call +92 (333) 32 11011

What happens next

  1. You pick the time

    Tell us which framework or regulation you are asked about and by whom; we book the call around you.

  2. Thirty minutes, with an engineer

    A compliance lead discusses what you already do and what an auditor would ask to see.

  3. A written assessment

    You receive the gap assessment and a fixed program price in writing.