The rules your clients, insurers and auditors actually ask about.
Cyber Essentials, ISO 27001, UK GDPR and the questionnaires that arrive with a big contract. What each one covers, what evidence it wants, and which service gets you through it.
Frameworks and obligations
Cyber Essentials
A UK government-backed scheme covering five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. Scope now includes cloud services and home-working devices, multi-factor authentication is mandatory, and patches are expected within 14 days.
A completed self-assessment questionnaire, backed by evidence you can show: device lists, patch status, account reviews, MFA coverage.
Cyber Essentials Plus
The same five controls, but verified by an assessor who tests a sample of your devices rather than taking your word for it. Most firms pass it only after they have held the basic certificate for a while and fixed what it surfaced.
A hands-on technical audit by an accredited certification body, usually within three months of your basic certificate.
ISO 27001:2022
An information security management system, not a product. It asks how you decide what to protect, how you handle risk, and whether you can prove you follow your own rules. Larger clients and public tenders ask for it by name.
Policies, a risk register, a statement of applicability, internal audit records and management review minutes.
UK GDPR and the Data Protection Act
Not optional and not a certificate. If you hold personal data you need a lawful basis for it, appropriate security around it, and the ability to report a qualifying breach to the ICO within 72 hours of becoming aware of it.
A record of processing, a retention schedule, supplier due diligence and a breach procedure someone has actually rehearsed. Secure Select is ICO registered, number ZC077967.
Supply chain questionnaires
The most common compliance pressure on a small firm is not a regulator, it is a customer. A client, an insurer or a tender sends a security questionnaire and expects answers that stand up.
Honest answers with evidence behind them, and a plan for the gaps rather than a blank column.
NIS2 and sector rules
NIS2 applies to essential and important entities in the EU, and its effect reaches UK suppliers through contracts rather than through UK law. If your customers are in scope, expect their obligations to arrive as questions for you.
Incident reporting timelines, risk management measures and supplier assurance, documented in advance.
Evidence that keeps itself up to date.
The tiring part of compliance is not the certificate, it is proving the same things again six months later. Compliance Autopilot is the platform we are building to take that job on: it connects to the systems you already run and scores your posture from live evidence rather than from a spreadsheet someone updated last spring.
It is in development, it is not on sale, and nothing on this page depends on it.
Explore Compliance AutopilotCompliance, answered
No, and nobody should tell you they can. Certificates are issued by accredited certification bodies.
What we do is get you ready to pass: close the gaps, gather the evidence and complete the paperwork with you.
Cyber Essentials is the sensible baseline for almost every organisation, and it is what most clients and insurers ask for.
ISO 27001 is worth it when a large client or a tender demands it. UK GDPR is not a choice, it applies already.
The readiness work is typically two weeks, and the sprint is priced per engagement with a quote agreed up front.
How quickly you certify after that depends on your certification body, not on us.
With a security assessment, so you know which answers were wrong and why.
Most questionnaire failures come down to a handful of fixable things: no MFA, no patching evidence, no backup testing, no written incident plan.
Not on its own. A framework is a floor, not a ceiling, and a certificate proves you met that floor on one day.
It is still worth having, because the floor is where most attacks are stopped, and because your clients ask for it.
Not sure which framework applies to you?
Take the free two-minute check, or send us the questionnaire you have been asked to fill in and we will tell you honestly what it will take.