Security assurance: Cyber Essentials, ISO 27001 and PCI DSS

More and more businesses are being asked to prove that they look after information properly. A customer wants Cyber Essentials before they will sign a contract. A larger client sends a security questionnaire that asks about ISO 27001. Your card payment provider asks you to confirm you meet PCI DSS. Your insurer wants evidence before it renews your cyber cover.

We help you answer those requests with confidence. For our government clients we assess systems against these standards and prepare their suppliers to meet them, so we know what assessors look for and where businesses usually fall short. This service extends that experience to all our customers, small or large: pragmatic, accurate support from the outset on what the standard actually asks of a business like yours, what you already have, what you need to change and what you can safely leave alone.

Cyber Essentials

Cyber Essentials is the UK government-backed scheme that sets out the basic protections every business should have: secure settings, firewalls, access control, malware protection and up-to-date software. Many public-sector contracts require it, and it is often the first thing a larger customer asks for.

We check your systems against the requirements, fix the gaps, help you complete the self-assessment and prepare you for the hands-on Cyber Essentials Plus test if you need it. Afterwards we help you keep the controls in place, so renewal each year is routine rather than a scramble.

ISO 27001

ISO 27001 is the international standard for managing information security. Certification shows customers, partners and regulators that security is managed properly across your business, not just bolted on to the IT.

We help you build and run the management system behind it: understanding the risks to your information, writing policies that reflect how you actually work, choosing the controls that matter, keeping the evidence an auditor will ask for and running the regular reviews that keep it current. Where you already have good practice, we document it rather than replacing it.

PCI DSS

If you take card payments, your bank or payment provider requires you to meet the Payment Card Industry Data Security Standard (PCI DSS). For most small businesses this means completing a self-assessment questionnaire and showing that card data is handled safely.

We help you work out which questionnaire applies, reduce the amount of card data your systems touch so there is less to protect, put the right controls around what remains, and complete the assessment accurately.

How we work

• From the outset: we tell you early what each standard will involve for your business, in time, cost and disruption, so there are no surprises later.
• Pragmatic: we fit the controls to your size and the way you work, and we say when something is not worth doing.
• Accurate: we help you answer assessments truthfully, with evidence from your own systems, so what you declare stands up to scrutiny. We advise and prepare you; the certificate itself is issued by the scheme’s assessors.
• Ongoing: standards are maintained, not just achieved. We help you keep the controls working, handle renewals and respond to new questionnaires as they arrive.

Security assurance is part of our wider information security service. The technical work it relies on is covered by cloud and infrastructure security, backups and recovery, anti-virus and monitoring.

Based in Chorley, we support businesses across Lancashire and Greater Manchester. Contact us to talk about what you have been asked for and where you are now.