Adopt AI without opening the estate. The cyber form still comes back answered the same day.
AI fails on estates where security is ungoverned. Owned as one of the ten domains of The Technology Framework, cyber security means controls that are switched on and checked, evidence the insurer and the buyer can read, and a named senior who answers the board.
You keep the MSP if it works. The framework governs its security work: who patches, who tests the backups, who reviews access, and who checks it happened.
Cyber security is one dimension of The Technology Framework. Owned, the domain reads as a short list of questions with current answers, and one name against each of them.
The premium listens to the answers on the proposal form. So does the buyer's audit.
ISO 27001 and PCI DSS, implemented in a live estate inside a year.
Implementation is the job we know: controls chosen for the firm you actually are, evidence built as the work happens, owners and dates on every line.
We implement. We do not certify. An accredited assessor certifies, and the pack we build is the pack they read.
Controls that let the firm say yes safely.
Everyone tells firms to adopt AI. An assistant inherits whatever the estate already grants: the identities, the access, the shared drive. Security is the dimension that decides what an AI tool may see before anyone switches one on.
ISO 42001 can be scoped into the ISO engagement when it fits. The wider AI agenda has its own dimension: AI, under the framework.
The security questions come before the assistant.
Before Copilot switches on, the questions are the old ones: who can see what, which accounts have MFA, what has sat overshared for years. An assistant indexes whatever it is given.
The Copilot readiness sprint does that work on the tenant: Purview, oversharing, labels, the right seats. Independent of your Microsoft partner.
Renewal season becomes routine.
A fixed piece of work that implements the controls and builds the evidence pack. Cyber Essentials and CE+ for most firms of 50-200. ISO 27001 when you sell to enterprise, PE or the public sector.
Walk into every board meeting with the answers.
A named fractional Head of IT, one or two days a week, owns cyber security alongside the other nine domains: vendors, cost, infrastructure, and the rest. The board gets one person who answers for all of it.
Any single domain can be owned on its own, priced in conversation.
We sit with the people who actually run the estate. MSP, finance, operations, whoever holds the passwords.
Visible progress in weeks, with a board-readable outcome. On this dimension, often the control set switched on and the first evidence pack.
It's your call. Keep the seat filled at one or two days a week, or keep the gains and run it yourselves. Either way the place is stronger.
First we listen. Then visible progress, scoped at diagnose. Then it's your call. The same rhythm as how we work across the practice.
No. Cyber security is one of the ten domains of The Technology Framework. It is bought two ways: the CE+ / ISO 27001 sprint, with published prices, or owned continuously through the fractional Head of IT seat. Any single domain can be owned on its own, priced in conversation.
You can, and many firms have: Copilot licences bought while the shared drive is still open to everyone. An assistant inherits the access the estate already grants, so the order matters: controls on, oversharing closed, then the pilot. The framework's job is to make the safe yes the quick answer.
For most firms of 50-200, no. Security leadership sits in the same seat as the rest of IT: the vCISO job, without a second retainer. The MSP and your existing tools do the daily work. The framework governs them.
The Cyber Essentials scheme gets harder. MFA on every cloud service. Critical patches inside 14 days. A certificate that renews after that date is assessed against the new rules, and the gap between passing last year and passing now is exactly what the sprint closes.
We implement. We do not certify. An accredited assessor certifies Cyber Essentials, CE+ and ISO 27001. We build the controls and the evidence pack they assess.
MFA, patching, backups and access control, with evidence behind each answer. The premium listens to the answers on the proposal form. Owned properly, the same pack answers the form each year.
Keep it if it works. A security package runs tools. Ownership decides what good looks like, checks the controls are on, and signs the form. Under the framework that accountability sits with a named person, above the MSP.
The first conversation costs nothing and changes what happens next. Bring the thing that hurts, or the thing you want to build.
Call 0117 456 5486. The voice that answers is our own AI call agent, in production, on our own line. We run our practice on what we sell. Hear it running.
Talk to an agent starts a voice conversation with our own AI agent, right here on the page. Prefer email? Pick the thing that hurts above and your mail app opens with the subject filled in. Nothing sends from this page.
