Fixed-scope assessments
A defined scope, timeline and report. Best for testing, reviews and readiness work.
Standards, met with evidence.
We prepare the controls, policies and records an auditor or regulator will ask to see.
Compliance is proved with evidence, not intentions. We help organisations put the controls in place, write the policies that describe them and keep the records that show they work, so audits become a confirmation rather than a discovery.
What we deliver
- ISO/IEC 27001 readiness
- UAE Information Assurance Standard readiness
- UAE PDPL and DIFC data-protection compliance
- Policies
- Risk registers
What you receive
- Gap assessment
- Where you stand against the standard, control by control.
- Policies and procedures
- Written for how your organisation actually works, and approved by your leadership.
- Risk register
- Risks identified, rated and owned, with treatment plans.
- Evidence pack
- The records an auditor will ask for, organised before they ask.
How an engagement runs
- Scope
- We agree what is in and out of scope, the rules of engagement and who to call if something critical is found.
- Prepare
- Access, accounts and test windows are arranged so the work does not disrupt your operations.
- Deliver
- The assessment, design or readiness work itself, with progress updates at agreed points.
- Report
- Every engagement ends with an executive summary and a prioritised remediation plan.
- Verify
- Once fixes are made, we re-test or review them and confirm what has been closed.
How we engage
Managed security retainers
Ongoing monitoring, vulnerability management and advice, delivered with Kytheos.
Retained incident response
Agreed response arrangements in place before you need them.
Concessional SME packages
Assessments and awareness training sized for small and mid-sized businesses.
Questions clients ask
Can you certify us?
No. Certification is granted by an accredited certification body. We prepare you for that audit.
Do you cover data protection as well as security?
Yes, including the UAE PDPL and the DIFC Data Protection Law.
Begin with an assessment.
Our work follows recognised frameworks, including OWASP, NIST CSF and MITRE ATT&CK. Every engagement ends with an executive summary and a prioritised remediation plan.