The checklists we use on real engagements.
These are not marketing one-pagers. They are the working documents our consultants carry into client environments — written down so you can run the same checks yourself, whether or not you ever work with us.
Cyber Essentials Plus: Pre-Audit Readiness Checklist
The checks we run before a client sits a CE Plus audit. Built from the failure points we see most often in SME estates — third-party patching, local admin rights, MFA gaps and the evidence assessors actually ask for.
- The 14-day patching rule and how to evidence it
- Where the practical test day catches people out
- Home workers, BYOD and scope boundary questions
Qualys VMDR: Configuration Audit Checklist
The sanity-check we run when we inherit an existing Qualys subscription. Most estates we take over have scanned for years without reducing risk — these are the configuration faults behind that, in the order we check them.
- Asset reconciliation, stale hosts and duplicates
- Authentication success rates — the silent killer
- Tagging, TruRisk tuning and patch job validation
ISO 27001:2022: Statement of Applicability Scoping Matrix
A working framework for scoping your SoA before you pay a consultant or a certification body. For each Annex A theme: what genuinely applies to an SME, what evidence an auditor expects, and who should own it.
- All four Annex A themes, translated for SMEs
- Which exclusions are defensible — and which are not
- What to have finished before you book the certification body
Field notes, not vendor documentation.
Every item in these documents exists because we have seen it go wrong in a real organisation — an audit failed on a forgotten Adobe Reader install, a Qualys estate reporting fiction because authentication had been broken for a year, an SoA that fell apart when the auditor cross-checked it against the risk assessment.
If you work through one of these and find gaps you are not sure how to close, that is usually the point where a short conversation saves a long week. You can reach us through the contact page — the person who replies will be a consultant, not a salesperson.