Practitioner-led readiness for Cyber Essentials Plus, ISO 27001 and SOC 2. We close the gaps and build the evidence. The certificate is always issued by an accredited independent body.
ISO 27001 and SOC 2 are now the price of enterprise and US contracts. In the UK, Cyber Essentials mandates MFA on cloud services and gates higher-risk government and NHS work. The tooling built for this is priced and designed for funded US SaaS firms, and most organisations end up with a spreadsheet, a consultant’s template and a lot of unanswered questions.
TrusTrak does readiness the practical way. People who have run cloud security in a regulated bank review your controls, fix what can be fixed, write the policies that match how you actually work, and assemble the evidence an assessor will ask for.
One rule we never bend: TrusTrak prepares, it never certifies. Your certificate comes from an accredited body, which is what makes it worth having.
The five controls checked hands-on: firewalls, secure configuration, access control, malware protection and patch management. Gaps fixed, evidence collected, and a dry run before the assessor arrives.
Gap assessment, risk treatment, Statement of Applicability, policies written for your organisation, and the ISMS set up so it can be run by your team afterwards.
Control design and evidence for the trust services criteria your customers care about, aligned with your cloud estate so the evidence is produced by the systems rather than typed into a spreadsheet.
A security lead for a day a week or a day a month: risk register, supplier reviews, incident planning, board reporting and the ongoing evidence that keeps a certification alive.
Which certification you need, who is asking for it, and when.
Controls reviewed against the standard. Findings ranked by effort and risk.
Technical gaps fixed by us, policies and processes written with you.
Assembled, organised and rehearsed, so the assessment is a formality.
An accredited body assesses and issues the certificate. We stay on for the questions.
No, and you should be wary of anyone who offers to. Certification comes from an accredited body such as a UKAS or IASME-accredited certification body in the UK. We prepare you for it.
It depends on how many gaps there are, but for a small or mid-size organisation with cloud-based IT it is usually weeks rather than months.
Platforms are good at tracking. They do not fix your firewall rules, write a policy that matches your business, or sit in the room with the assessor. That is the part we do.
RiskGuard is our own product for affordable first-time certification. It is early stage with founding customers, and for some organisations it is the better starting point. We will tell you which on the call.
Cloud readiness assessment, landing zone and certification readiness as one programme, for organisations that need to be in the cloud and able to prove it is secure in the same quarter.
AWS first, Azure where you are Microsoft-led. From readiness assessment to landing zone to migration, and the retainer that keeps it tight.
Book a free 30-minute readiness call. We tell you plainly what you need, roughly what it costs, and whether you need us yet.