Security assurance
Your clients ask for proof of security. We help you prepare it.
A customer sends a security questionnaire. A renewal needs updated evidence. Your team needs policies that describe how things actually work. We help small businesses turn those requests into clear answers, useful documents and a practical plan for the gaps.
A small team still needs a credible answer.
You may have a capable IT provider and sensible day-to-day practices, but no time to translate them into an assessor's spreadsheet. We work with you and your existing provider to check the facts, explain the controls and identify what still needs attention.
Useful when
- A customer or prospective client asks for a supplier security assessment
- You need evidence to support the answers you have already drafted
- Your policies are missing, outdated or disconnected from daily work
- You want a clear view of security priorities before spending on fixes
Start with what you need now.
Four ways to get support. Each has its own agreed scope, deliverables and fee; you do not need to take all four.
Answers backed by evidence
We help prepare supplier security questionnaires and respond to assessor follow-up. The aim is an accurate account of your current security, with gaps described plainly and future actions labelled as plans.
What we do
- Confirm which services, systems and data the request covers
- Review existing answers and supporting documents
- Check agreed settings through authorised read-only access
- Draft responses and organise evidence against question references
What you receive
- A completed or reviewed questionnaire in the requested format
- An indexed evidence pack for the agreed questions
- A list of gaps and proposed next steps
- A review session and an agreed allowance for follow-up questions
Documents your team can actually use
Short, practical documents built around your people, systems and responsibilities. We work through the decisions with you, rather than handing over a policy library that nobody owns.
Possible inclusions
- Information security policy and responsibilities
- Incident response and business continuity plans
- Joiner, mover and leaver procedures
- Risk, supplier and access review registers
Putting them to work
- Named owners and an agreed review schedule
- An initial risk assessment and priorities
- A walkthrough or tabletop exercise where scoped
- Editable documents and a handover for your team
Understand the systems behind the answers
A scoped review of the technology your business relies on. We explain the risks, the practical options and the order in which to address them, working alongside your existing IT support.
Areas we can review
- Microsoft 365 identity, administrator access and sharing
- Company devices and personal devices used for work
- Backup arrangements and recovery readiness
- Remote access, older systems and monitoring needs
What you receive
- Findings explained in business terms
- A prioritised remediation roadmap
- Recommendations suited to your size and resources
- A walkthrough with you and your IT provider
Make the next request easier
Once the foundations exist, an agreed review cadence keeps them useful. We can help maintain the evidence, review changes and prepare for the next customer questionnaire without starting from scratch.
Support can include
- Policy and evidence reviews on an agreed schedule
- New questionnaires and customer follow-up
- Access reviews and incident response exercises
- Tracking agreed improvements and material changes
A clear arrangement
- An agreed scope and allowance for each period
- Reusable records that remain with your business
- Coordination with your existing IT provider
- Monitoring and operational support scoped separately
Clear about what assurance means.
Accurate, approved and in your hands
We prepare and review; your business approves its statements and submits them. We identify missing evidence and gaps rather than treating a planned fix as an existing control. You keep the agreed deliverables for future use.
Changes are separately agreed
Remediation, security hardening and ongoing monitoring need their own scope and authorisation. This service does not provide certification, legal advice or a guarantee that a customer will accept your submission.
From request to a reusable assurance pack
Start with the request
Send us the questionnaire, renewal request or security concern. We agree what needs answering, which systems matter and what a useful outcome looks like.
Check the evidence
A working session, document review and agreed read-only configuration checks establish what you do today. Assumptions and missing evidence stay visible.
Prepare the pack
We write clear answers and practical documents, organise the supporting evidence and separate existing controls from planned improvements.
Review and hand over
You review and approve your statements before submission. We walk through the gaps, agree priorities and hand over reusable documents and evidence.
Who you work with
Technical checks. Plain English advice.
Rinto Ismail brings hands-on infrastructure experience, security programme work and incident investigation to the same conversation. That helps connect what an assessor asks with what your business actually does.
Meet Rinto and view credentials →