SaaS & technology
Typical requirements
- ISO 27001 certification requested by customers
- SOC 2 reports requested by US customers
- Security questionnaires and customer due diligence
- Penetration testing evidence
Who we help
Six groups of organisations whose customers, partners or regulators expect evidence of how security, privacy and governance are managed.
AI companies
Typical requirements
- AI governance frameworks and accountability
- ISO 42001 readiness where certification is sought
- NIST AI RMF and EU AI Act alignment where relevant
- Information security and privacy foundations
FinTech & financial services
Typical requirements
- Information security governance and ISO 27001
- Operational resilience and business continuity
- GCC financial regulator requirements, including SAMA and QCB
- Third-party risk and customer assurance
Healthcare & HealthTech
Typical requirements
- Privacy governance for special category data
- Information security management and ISO 27001
- Sector assurance requirements set by health bodies and customers
- Continuity of critical services
Professional services
Typical requirements
- Client security questionnaires and audits
- ISO 27001 and Cyber Essentials
- Privacy governance
- Senior security oversight without a full-time appointment
Government and regulated supply chains
Typical requirements
- Cyber Essentials for relevant UK public sector contracts
- ISO 27001 and supplier assurance
- NCA and NIA requirements in Saudi Arabia and Qatar
- Business continuity expectations
Discuss your requirements
Tell us what you need to achieve and where the requirement applies. We will establish the appropriate route and expertise for the engagement.