ISO 27001 and Cyber Essentials, with the servers to back it up.
Customers ask for certification, and auditors ask for evidence. I write the technical policies, get the servers to meet them, arrange a penetration test through a specialist partner, and fix what it finds.
- ISO 27001
- Technical policies, Annex A controls and the evidence for them
- Cyber Essentials
- The five controls checked and fixed, for Basic and Plus
- Pen testing
- Arranged through a specialist partner, findings fixed and re-tested
- Price
- A fixed quote, in writing
What I do
The technical half of certification: the part an auditor or assessor checks on the servers themselves.
- 01ISO 27001 documentation
The technical policies and procedures: access control, patch and change management, backups, logging, asset register, supplier security. Written to match what really happens, so they stand up at audit.
- 02The servers brought up to the policies
The controls put in place and the evidence collected as you go: patch records, restore tests, access reviews, log retention.
How GUARD covers it → - 03Cyber Essentials and Cyber Essentials Plus
Firewalls, secure configuration, user access, malware protection and security updates, checked and fixed before you submit, with help on the questionnaire and the Plus assessor's tests.
- 04Penetration testing
Arranged through a specialist testing partner, scoped with you so it covers what your customers and auditor care about.
- 05Fixing the findings
Every finding fixed, re-tested and written up, with a note you can hand to your auditor or customer.
What you get
Technical policies your team can follow and an auditor can check against the servers.
Patch records, restore tests and access reviews ready before the audit, not rushed the week before.
Pen-test and audit findings fixed and re-tested, with a written note for each.
"One of those rare suppliers who feels more like a trusted member of the team than someone on the other end of a ticket system."
Angus B. · Founder, UK SaaS company"A reliable technical partner for ISARR over the last eight years. He supports both infrastructure and wider technical decision-making when we need senior input."
Nick Beale · ISARR"A trusted partner responsible for everything from AWS infrastructure, networking and security to operational support, monitoring and MySQL performance."
Jake Rudkin-Wilson · Head of Product Development, CameoQuestions
Are you a certification body?
No. I do the technical side: the policies, the controls on the servers and the evidence. Certification is done by an accredited body, and I can put you in touch with one.
Do you run the penetration test yourself?
No. Auditors and customers expect an independent tester, so I arrange it through a specialist partner, agree the scope with you, and then fix what it finds.
Will we pass Cyber Essentials?
That's the aim of the work. The five controls are checked and fixed before you submit, including the rule that high and critical security updates go on within 14 days, which weekly patching meets as a matter of course.
We already have ISO 27001. Can you help keep it?
Yes. Most of the work is keeping the technical controls and evidence current between audits: patch records, restore tests, access reviews and log retention, month by month.
How is it priced?
A fixed quote in writing, once I know your scope and where you are starting from. The pen test is quoted separately by the partner.
Got an audit or a questionnaire coming?
A 15-minute call: where you are now, what the certificate needs, and a fixed quote to get there.