Virtual CISO
Security strategy, risk register, policy ownership and board reporting.
GRC & Compliance Consulting
Governance, Risk and Compliance Without the Full-Time Overhead
Governance, risk and compliance consulting that gives you security leadership, audit readiness and continuous protection, without hiring a full in-house team.
Virtual Leadership
Senior Security and Privacy Leaders, Part Time
Many growing firms need a security head and a privacy officer long before they can justify full-time hires. Our virtual leaders own your program, report to your board and represent you in customer and auditor reviews.
Virtual DPO
Privacy program, data mapping, DPDP and GDPR obligations and data subject requests.
Security Advisor
On-call guidance for customer questionnaires, vendor reviews and new product launches.
Compliance Programs
From Gap Analysis to Audit Day
We prepare you for the audit; an accredited independent body issues the certificate or report.
Gap AnalysisMeasure current controls against the target framework
Readiness AssessmentPrioritise the gaps by risk and audit impact
Control MappingOne control set mapped across ISO 27001, SOC 2, HIPAA and more
Policies & SOPsPolicy architecture and procedures your team will follow
EvidenceCollect and organise the evidence auditors ask for
Mock AuditRehearse the audit and close findings before the real one
Security Testing
Find Weaknesses Before Attackers Do
Application Testing
Web, API and mobile application security testing and secure code review.
Cloud & Container Testing
Configuration review and testing of cloud accounts, Kubernetes and container images.
Penetration Testing
Internal and external network penetration testing with clear, prioritised fixes.
Managed Detection & Response
Round-the-Clock Monitoring
- Managed security operations with 24/7 detection and response
- SIEM and SOAR set up, tuned and operated for you
- Detections mapped to MITRE ATT&CK
- Escalation straight into our incident response team
AI Compliance
Compliance for AI Systems
ISO 42001 readiness and gap analysis against the EU AI Act and NIST AI RMF, run alongside your security program so AI controls share the same evidence.
FAQ
Frequently Asked Questions
What is a virtual CISO?
A virtual CISO is an experienced security leader who works with you part time. They set your security strategy, own the risk register and policies, answer customer and auditor questions and report to leadership, without the cost of a full-time executive.
What is the difference between SOC 2 and ISO 27001?
SOC 2 is an attestation report issued by a licensed CPA firm against the AICPA Trust Services Criteria, and is most often requested by US customers. ISO 27001 is an international certification of your information security management system, issued by an accredited certification body. Many controls overlap, so we prepare for both with one program.
How long does audit readiness take?
It depends on your scope and how mature your controls already are. The gap analysis at the start gives you a prioritised plan and a realistic timeline before you commit to an audit date.
What happens in a mock audit?
We run the audit the way an external auditor would: sampling controls, requesting evidence and interviewing control owners. You get a list of findings to close before the real audit.
Does India's DPDP Act apply to my business?
The Digital Personal Data Protection Act applies to digital personal data processed in India, and to processing outside India when it relates to offering goods or services to people in India. A virtual DPO can assess your obligations and build the privacy program to meet them.