Cybersecurity & ISO 27001 · Manchester & the North West
Specialist security expertise, with a commercial view of risk.
Assessment and support, not certification. We are not an accredited certification body. We do not issue ISO 27001 or Cyber Essentials certificates and cannot guarantee certification.
What we do
Cybersecurity and information security services.
Cybersecurity assessments
A practical review of your systems, cloud services, devices and settings, with prioritised findings in plain English.
Cyber risk assessments
Identifying the cyber risks that matter most to your business and what they could cost, so you can prioritise investment.
ISO 27001 gap assessments
Where you stand against ISO/IEC 27001:2022 today, what is missing, and how much work closing the gaps will take.
ISO 27001 compliance reviews
Assessing whether your ISMS meets the standard's requirements in practice, by reviewing controls, records and evidence.
Information security control reviews
Testing whether controls such as access management, backups and supplier security are designed well and working as intended.
Internal audit support
Planning and supporting internal audits of your ISMS, delivered by appropriately qualified people.
Security improvement and remediation
Fixing the weaknesses that matter, directly or alongside your IT provider, and checking the changes work.
Ongoing compliance support
Periodic reviews, evidence checks and oversight to keep controls working and your ISMS up to date.
ISO 27001 compliance assessment
Do your controls and evidence meet the standard?
How we assess compliance
- 1
Review controls
We examine how your ISMS and Annex A controls are designed and applied.
- 2
Test the evidence
We check records, logs and documents to see whether controls operate as intended.
- 3
Identify gaps
We report clearly where you meet the requirements and where you fall short.
- 4
Recommend improvements
We give practical, prioritised recommendations, and can help you implement them.
Ways to work with us
Choose the support that fits.
ISO 27001 consultancy
Gap assessments, compliance reviews, ISMS implementation and certification readiness.
Cyber Essentials readiness
Readiness checks against the five Cyber Essentials controls and help fixing the gaps.
Security Improvement Programme
A structured programme to fix vulnerabilities, from MFA to backups and incident planning.
Ongoing Protection Partner
Regular, independent oversight of your security and compliance, without a full-time hire.
Why a finance-led business offers security
Security decisions are investment decisions. Because Ledger & Lock also brings senior finance expertise, we prioritise security work by its likely financial and operational impact, and we look closely at where cyber risk and financial controls meet, such as payment fraud.
Being precise
What we do, and what we don't.
We do
- Assess security and compliance independently
- Review ISO 27001 controls and evidence
- Identify gaps and recommend improvements
- Help implement and maintain improvements
We don't
- Issue ISO 27001 or Cyber Essentials certificates
- Guarantee certification or protection
- Provide 24/7 monitoring or emergency response
- Replace your IT provider
FAQs
Cybersecurity questions, answered plainly.
Are you a certification body?
No. We assess and support compliance, but we do not issue ISO 27001 or Cyber Essentials certificates. Certification is carried out independently by an appropriately accredited certification body, and no consultancy can guarantee the outcome.
What does an ISO 27001 compliance review involve?
We review your ISMS documentation, risk assessment, Statement of Applicability and the evidence that controls are operating, interview the people responsible, and report where you meet the requirements, where there are gaps and what to do about them.
Do you replace our IT provider?
No. We provide independent assessment and advice and work alongside your IT provider, who usually carries out day-to-day technical changes.
Do you provide 24/7 monitoring or emergency response?
No. We are not a managed security service or an emergency incident response provider. We help you prepare, including identifying specialist responders in advance.
Next step
Find out where your security really stands.
Start with a short conversation about your systems, your customers' requirements and any concerns. We'll tell you honestly what would help.
30 to 45 minutes, by video or in person
At a time that suits you.
A conversation, not a sales pitch
We want to understand your business first.
A clear proposal
If we can help, you will know what we suggest and what it will cost.