A focused remit
Built around the work the business must repeatedly prove.
Our proposition is deliberately narrower than a generic cyber security company. It focuses on risk governance, information-security management, evidence readiness, customer assurance and practical leadership communication.
Evaluate the actual statement of work, qualifications and evidence-handling arrangements rather than relying on generic claims about security expertise. A provider of management-system advice is not automatically a penetration-testing company, managed detection service or certification body.
- Qualified human review for material security decisions
- Written responsibilities, capacity and exclusions
- Independent assessment and certification boundaries
- Client ownership of records and evidence
- No blanket promises of compliance or audit success
Working with specialists
The person doing the work matters more than the logo.
Security assurance relies on capable practitioners. Individual qualifications, audit experience and specialist responsibilities should be verifiable and disclosed when an engagement is scoped. The named lead and independent audit resources must be confirmed before selling the corresponding services.
Operational administration can be streamlined. Responsibility for risk judgements, independent assurance and customer-facing security claims cannot be handed to an unreviewed language-model output.
Buying transparently
Understand the contract before granting access.
We aim to state which systems are involved, which personnel may access information, what personal data is processed, how evidence is shared, and what happens when the engagement ends. Written terms must address subcontractors, confidentiality, information security and the applicable data protection responsibilities.
Our public guidance is educational and is not a substitute for legal advice, regulatory approval, an accredited audit or a formal assessment of your organisation.
Legal identity and accountability
Know who is contracting and who is actually delivering.
A buyer should be able to distinguish the operating legal entity, the contracting party, the lead responsible for advice and any subcontractor performing specialist security work. Those names must be in the written engagement documents. A trading brand alone does not demonstrate technical qualifications.
The company's registered office and registration number should be verifiable against Companies House; professional qualifications and professional indemnity cover should be evidenced directly. Professional credentials and business registration should be verified with their issuing organisations rather than inferred from marketing badges.
| Verification | What a buyer should request |
|---|---|
| Contracting entity | Companies House legal name and registered number |
| Practitioner competence | Named lead, relevant experience and credential verification |
| Independent assurance | Who audits, and who operates the controls |
| Service resilience | Named deputy, work allocation and escalation process |
| Data handling | Client-owned storage, processor terms and revocation plan |
Our editorial standard
Guidance should be useful before a sales conversation.
We separate illustrative sample records from actual customer experience and distinguish process guidance from legal requirements. Where an ISO reference, regulator rule or governmental recommendation matters, the current primary source should be supplied alongside the explanation. A useful public resource gives a buyer a way to check the answer—not just a reason to book a call.
Scope the service