Renewal season becomes routine. So does the AI question.
The insurer's proposal form, the buyer's questionnaire, the regulator's letter, and now the AI question arriving on each of them: every one answered from a pack that already exists, by an owner who already knows the answer.
AI stalls where compliance is ungoverned: the tool arrives before the policy, the form before the answer. Compliance is one of the ten domains The Technology Framework makes AI-ready. Owned in the seat by a named Head of IT, or delivered as a fixed sprint with published prices.
On the framework map, compliance gets one line: ISO 27001, PCI DSS, the regulator's questions, answered with documents. Owned properly, that means:
We implement. We do not certify. An accredited assessor certifies, and the pack we build is what they assess.
The insurance renewal. Professional indemnity and cyber insurers ask for MFA, patching, backups and access control on the proposal form. The premium listens to the answers.
The buyer's questionnaire. Panel and client audits increasingly ask for CE+, and for ISO 27001 at the top end. The firm that answers with a certificate stops writing essays.
When the domain is owned, both land on a pack that already exists.
The named senior behind the practice has implemented ISO 27001 and PCI DSS in a live estate, inside twelve months. Implementation means the controls, the policies and the evidence, done in a working business. That is the discipline this page describes.
When the insurer, a buyer or the regulator asks about AI, the firm should be able to answer in writing. That makes AI use a compliance object like any other: assessed, governed, documented. The work looks like this:
None of this slows adoption down. A written yes is faster than an argued maybe, and it survives the renewal.
Everyone tells firms to adopt AI. Nobody owns making the firm ready for it. So the pilot arrives before the policy, runs on data nobody cleared, and the first written answer about AI is drafted in a hurry, for an insurer.
Governed compliance turns that around: the firm can say yes to AI, safely, and show it said yes properly. That work has a named owner here. See how it connects on the AI dimension.
Walk into the insurance renewal with a pack they can read.
Cyber Essentials and CE+. ISO 27001 when you sell to enterprise, PE or the public sector. We implement the controls. An accredited assessor certifies. A fixed piece of work with a clear finish line: read the CE+ / ISO 27001 sprint.
A named fractional Head of IT owns compliance as one of the ten domains, alongside cost, cyber security and the rest. One or two days a week, on the leadership team, keeping the pack alive after the certificate arrives.
The sprint and the seat carry the published prices above. Any single domain can be owned on its own, priced in conversation. See where compliance sits on the framework map.
We sit with the people who actually run the estate. MSP, finance, operations, whoever holds the passwords.
Visible progress in weeks, with a board-readable outcome. Often the operating model, the vendor map, and the first evidence pack.
It's your call. Keep the seat filled at one or two days a week, or keep the gains and run it yourselves. Either way the place is stronger.
First we listen. Then visible progress, scoped at diagnose. Then it's your call. The same rhythm as how we work across the practice.
No. We implement. We do not certify. We build the controls, the policies and the evidence, and an accredited assessor carries out the certification. That separation is how the schemes are meant to work.
Cyber Essentials is a UK government-backed baseline of technical controls, and CE+ adds an independent technical assessment. ISO 27001 is a full information security management system, the certificate that enterprise, PE and public-sector buyers ask for. Many firms need the first now and the second when larger contracts arrive.
It depends on the estate and the standard. As a marker, the named senior behind the practice has implemented ISO 27001 and PCI DSS in a live estate inside twelve months. Your timeline is set at diagnose, honestly, before any work is priced.
Yes. The CE+ / ISO 27001 sprint is a fixed piece of work: CE+ readiness from £2,950 and ISO 27001 from £15,000. The seat makes sense when the board wants compliance owned continuously, alongside the other nine domains of the framework.
Two askers do most of the pushing. Professional indemnity and cyber insurers, whose proposal forms ask about MFA, patching, backups and access control. And buyer questionnaires, where panel and client audits ask for CE+ and, at the top end, ISO 27001.
Controls live in the business, so some of the work is yours: decisions signed off, owners named, a few habits changed. We run the programme, write the documents and collect the evidence, and we keep the asks of your team small and scheduled.
The first conversation costs nothing and changes what happens next. Bring the thing that hurts, or the thing you want to build.
Talk to an agent starts a voice conversation with our own AI agent, right here on the page. Prefer email? Pick the thing that hurts above and your mail app opens with the subject filled in. Nothing sends from this page.
The voice that answers the phone is our own AI call agent, in production, on our own line. We run our practice on what we sell.
