Security & Compliance

┌ ┐ └ ┘

Most small businesses don’t need an enterprise security programme. They need the basics done properly, and proof that they’re done, not just claimed. I get you through Cyber Essentials, Cyber Essentials Plus, or ISO 27001 where it’s genuinely warranted, but the certificate is the by-product. The actual job is making sure the controls it describes are real, not just written down for the auditor, including the assumption that someone else is backing up your data. Most cloud platforms’ own terms say plainly that backup is your responsibility, not theirs.

What’s included:

• Cyber Essentials and Cyber Essentials Plus certification
• ISO 27001 readiness, with controls implemented, not just documented
• Cloud security, access control, and disaster recovery planning, not just assumed to be someone else’s job