Compliance & governance
Compliance as a by-product of well-run IT.
Compliance isn't a document; it's proof that your controls work. We write the policies, implement the technical controls, collect the evidence and run the audits, so compliance becomes a by-product of well-run IT rather than a yearly scramble.
Frameworks
The standards we work to
POPIA
South Africa's Protection of Personal Information Act requires 'appropriate, reasonable technical and organisational measures'. We translate that into concrete controls, an information officer toolkit and breach-response readiness.
ISO/IEC 27001
Gap assessment, Statement of Applicability, risk register, policy set and internal audit, so you walk into certification prepared.
CIS Controls v8
The practical baseline we measure every environment against, prioritised by Implementation Group so SMEs start with what matters.
NIST CSF 2.0
Govern, Identify, Protect, Detect, Respond, Recover: the structure for board-level reporting on cyber maturity.
Services
How we deliver it
Policy & governance
A policy set your people will actually follow: acceptable use, access control, backup, incident response, supplier security, and the governance rhythm to keep them current.
Compliance audits
Independent internal audits against POPIA, ISO 27001 or a customer framework, with findings and corrective actions tracked to closure.
Evidence as a service
Audit evidence collected continuously from your Microsoft 365, Azure and security tooling, so answering a due-diligence questionnaire takes hours, not weeks.
Virtual CISO
Senior security leadership on a retainer: risk decisions, board reporting, incident command and vendor oversight, without a full-time hire.
Facing a questionnaire, a renewal or a regulator?
We'll tell you in one call what evidence you already have and what's missing.