Compliance
Cyber Essentials
Cyber Essentials Plus
UK GDPR
Data Protection Act 2018
ICO Registered
ISO 27001 aligned
Controls
Information Security
- Information Security Policy
- Data classification & handling
- Encryption at rest & in transit
- Asset inventory & management
Access & Identity
- Multi-factor authentication (MFA)
- Role-based access control (RBAC)
- Least-privilege & joiner/leaver process
- Privileged access management
Threat Management
- Managed EDR / anti-malware
- 24/7 monitoring & alerting
- Vulnerability & patch management
- Penetration testing
Incident Response
- Documented Incident Response Plan
- 72-hour breach notification
- Defined escalation paths
Business Continuity
- Backup & disaster recovery (RTO/RPO)
- Business Continuity Plan
- Tested recovery procedures
Organisational Security
- Staff security awareness training
- Background checks & DBS where relevant
- Change management process
- Third-party / supplier risk management
Data Security
- Encryption at rest & in transit
- Access monitoring & logging
- Encrypted, monitored backups
- Secure disposal & certificates of destruction
Data Privacy
- UK GDPR & DPA 2018 compliance
- Data Protection Officer
- Data Processing Agreements
- Subject access request process
Endpoint Security
- Endpoint Detection & Response (EDR)
- Disk encryption
- Mobile Device Management (MDM)
- Data Loss Prevention (DLP)
Network Security
- Next-generation firewall
- Intrusion detection & prevention (IDS/IPS)
- DNS filtering & anti-DDoS
- Email protection (SPF, DKIM, DMARC)
Infrastructure
- UK-based cloud hosting
- SOC 2 Type II data centres
- Physical access controls
- Segregated production & test environments
AI Governance
- Ethical use of AI & internal policy
- Managing AI vendor security
- Human oversight of AI tooling