Six sectors, each with its own regulator and change window

Trading, payments and core banking sit under supervision that names its artefacts: the register of information under DORA, the annual assessment under PCI DSS, the IT general controls evidence under Sarbanes-Oxley, the retention and access record under GDPR. Each one carries a date. We build the register and the test evidence alongside the controls, and the contract names the date each artefact is due.

• Register of information due on fixed dates
• Payment platforms changed without taking authorisation offline
• Supervisory notification on deadlines measured in hours
• Cardholder environments assessed annually against platforms that change weekly

Clinical systems carry patient safety, not just data. We work to the access controls and audit trails HIPAA and HITECH require, keep electronic records to the validation standard set by FDA 21 CFR Part 11, hold connected medical devices and legacy applications inside segmented networks, and maintain the GDPR record where patient data reaches the European Union. Change windows are agreed with clinical operations before design starts, and no change ships outside one.

• Change windows set by clinical operations and measured in minutes
• Connected medical devices with no supported patch path
• Patient data shared across systems, laboratories and suppliers
• Electronic records subject to validation and audit trail requirements

Generation, grid and water operations run on control systems built before the networks now attached to them. We separate operational technology from corporate IT and monitor both, working to NERC CIP asset categorisation, IEC 62443 zone and conduit design, and the notification deadlines each NIS2 transposition sets. Work is scheduled inside the outage season you give us, and monitoring is designed not to touch safety instrumented systems.

• Operational technology and IT converging faster than the controls around them
• Safety instrumented systems that stay online through the work
• Regulated outage windows measured in hours per year
• Field engineers working hundreds of kilometres from the nearest colleague

Public bodies buy on published criteria, publish their spend and answer to auditors. Control selection and tailoring run against NIST SP 800-53, profile work against NIST CSF 2.0, and suppliers to defence programmes are prepared for CMMC Level 2. Assurance documentation is written to your template and your evidence standard, and milestones are set against your fiscal year.

• Procurement with fixed evaluation criteria and published spend
• Legacy estates carrying decades of policy change
• Assurance documentation written to the agency's own template
• Delivery milestones that must survive an annual budget cycle

A stopped line costs a known amount per hour. We inventory plant networks in live production, segment them from the enterprise under IEC 62443 zone and conduit design, and assemble the supplier assurance and notification evidence NIS2 asks for. Every supplier account we issue is scoped, logged and time-limited, and segmentation is staged around your shutdowns.

• Production networks flat, unsegmented and rarely inventoried
• Supplier access spanning several countries and contracts
• Maintenance windows limited to planned shutdowns
• Plant equipment supported long past its vendor's end of life

Client confidentiality is the product, whether the file is a matter, an audit or a valuation. Client contracts impose their own security regimes, GDPR sets retention and access, and Sarbanes-Oxley sets the evidence audit practices are asked to produce. Engagement-level access boundaries are designed first, and we answer the client questionnaires in your name, on your deadline.

• Client security questionnaires arriving before every engagement
• Privileged and price-sensitive material held across mailboxes and devices
• People working from courts, client sites and travel
• Advisory and audit practices requiring separated access