Readiness toards Cyber Essentials Plus, ISO-aligned controls, and evidence strength.

Tier 2 moves beyond baseline readiness into validated assurance.

It confirms whether stated controls exist, operate effectively, and can withstand scrutiny from insurers, auditors, and regulators.

We prepare SMEs for:

• Cyber Essentials Plus (technical validation readiness)
• ISO/IEC control alignment and assurance expectations
• Insurer due diligence and audit scrutiny
• Evidence-based security governance

Deliverables

• Validated control position (what exists vs what is assumed)
• Evidence strength assessment (documented, repeatable, defensible)
• Identification of control gaps and inconsistencies
• Mapping to CE+, ISO/IEC, and regulatory expectations
• Prioritised actions to strengthen assurance posture
• Board-level assurance report suitable for audit and insurers

Expectations

• Structured validation questionnaire and evidence review
• No intrusive system access or exploitation activity
• No disruption to operations
• Analysis of control design, implementation, and supporting evidence

When to Use Tier 2

• Preparing for Cyber Essentials Plus
• Strengthening governance and audit readiness
• Supporting insurer or regulatory review
• Following Tier 1 baseline to validate real capability

Value Proposition

We verify whether your controls are real, effective, and defensible – not just assumed.

We translate control strength into assurance confidence, aligned with Cyber Essentials Plus, ISO, and insurer expectations.

No disruption.

Just a defensible, board-level view of readiness and a clear path to improvement.

USP

Turning security controls into validated, evidence-backed assurance

Not a penetration test
Not a certification body
Not a generic compliance review

Instead, we provide:

Control validation grounded in structured analysis
Evidence strength and consistency assessment
Clear linkage between controls and regulatory expectations
Outputs designed for boards, insurers, and auditors

Simple to engage. Rigorous in validation.

Built on structured assurance modelling – not assumption.

Simple to engage. Precise in outcome.

Built on quantitative, structured modelling – not opinion.

Engagement scope depends on control depth and evidence maturity.