The evidence
Walk into the insurance renewal with a pack they can read.
Cyber Essentials and Cyber Essentials Plus for the form that keeps coming back. ISO 27001 when you sell to enterprise, PE, or the public sector. We implement the controls. An accredited assessor certifies.
The next cyber form comes back with questions nobody can answer. That is the cost of waiting.
Who this is for
Finance directors and managing directors who have become the IT department. Professional services of 50-200. South West wealth, IFA, and SIPP firms. PE-backed businesses that need evidence in the data room.
You need a pack the insurer can read.
What we do
We implement. We do not certify.
PCI DSS appears in our proof because it was implemented in a live estate, in twelve months, alongside ISO 27001. It is a fact. It is not a sixth offer. The assurance we sell here is CE, CE+, and ISO 27001.
How it runs
01 Diagnose. We sit with the people who actually run the estate. We read the last insurer form, the last buyer questionnaire, and the last "we will do that next quarter".
02 A 90-day sprint. Board-readable outcome: a control pack, a gap list that has been closed or owned, and a date with an accredited assessor if you are ready.
03 Then a retainer if the seat still needs filling. Someone has to keep the pack alive. That is the fractional Head of IT seat. Or we leave the place stronger and you run the cycle yourselves.
What you leave with
Questions
No. The Technology Framework is not a certification body. We implement the controls. An accredited assessor certifies CE, CE+, and ISO 27001.
Cyber Essentials is the self-assessed baseline most insurers now expect. CE+ adds a hands-on technical test by an assessor. If the renewal or the buyer asks for Plus, plan for Plus.
When you sell to enterprise, PE, or the public sector, and they ask for it in the contract or the data room. We implement. The assessor certifies.
That is the point of the sprint. The renewal pack is documents, owners, and dates. Not a paragraph of intent.
Yes. You keep the MSP if it works. We sit above it and make the controls real. The MSP often does the tickets that the controls create.
No. Board cyber sits inside the Head of IT seat and this sprint. We do not sell a standalone vCISO line.
Related