Complete vCISO
For organisations where compliance has to be somebody's actual job. We take on the security function end to end (the platform, a Security Operations Centre watching 24 hours a day and 365 days a year, the incidents, the registers and the reporting) and we stand behind it in writing.
What "we run it" actually means
Concretely, so there is no gap between what you expect and what arrives.
A named virtual CISO
One person who knows your organisation, attends your management meetings, writes the board report and is on the other end when something happens.
We operate the platform
Deployment, configuration, updates, tuning and the daily queue of things that need attention, on every site, vessel and machine.
A Security Operations Centre
Watched 24 hours a day, 365 days a year. Attacks do not wait for Monday, and the hours nobody is looking are the hours they are chosen for.
The full incident lifecycle
Detection, triage, containment, investigation and the regulatory notification, drafted, filed on your approval, inside the clock.
Registers maintained with you
Policies, risks, assets, suppliers, training, reviews and incidents, kept current, evidenced from what the platform observed, ready for an assessor.
Testing and exercises
Assessments, phishing simulations, restore tests and facilitated crisis exercises for your leadership, with the outcome written down, including what failed.
Independent review
An arranged, arm's-length review of the programme on an agreed cycle, because a security function that only ever marks its own homework is not one.
The year, laid out
Complete is a rhythm, not a retainer you hope somebody is spending.
| Cadence | What happens |
|---|---|
| Continuous, 24/365 | Watched by the Security Operations Centre: findings triaged as they arrive, the queue worked, alerts routed to the people who need them, and somebody awake when one matters at three in the morning. |
| On an incident | We run it: contain, investigate, record, and draft the 24-hour, 72-hour and final notifications against the clock. |
| Monthly | A written operational report: what changed, what was blocked, what is outstanding and what we did about it. |
| Quarterly | Posture and effectiveness review with your management, plus a management report written for people who are personally accountable. |
| Twice a year | Restore testing and a crisis exercise, with the results recorded as evidence. |
| Annually | Full reassessment, refreshed risk analysis, independent review, and the evidence pack for audit or certification. |
What we guarantee, and what nobody can
- An agreed service level, with response times written into the contract
- That the controls in scope are deployed, operating and evidenced continuously, not at audit time
- That your regulatory notifications are drafted and ready inside the deadline
- That your registers and evidence will stand up to an assessor, and we attend the audit with you
- That a gap in our equipment or our software (the appliance and the platform we run for you) is fixed at no cost to you
- That a gap anywhere else in your estate is written up with a recommendation and a priority, so you know what to do about it and what it would take
- That you cannot be breached. Anyone who does is selling you a feeling.
- That your management's legal accountability transfers to us. Under NIS2 it does not, and it cannot be contracted away.
- That compliance is a state you reach once. It is a thing you keep doing, which is exactly why this is a service.
- That we can cover systems you do not let us see. Scope is agreed in writing, and so is what sits outside it.
- That we will repair somebody else's product for free. Outside our own appliance and software we advise, prioritise and can carry out the work, but we quote for it rather than absorb it.
This is what we mean by guaranteed compliance: not a promise that a regulator will never knock, but a commitment that when they do, the work will have been done, the evidence will be there, and you will not be assembling it that week.
Complete is right for you if
- You are an essential or important entity under NIS2, or fall under IMO cyber resilience
- Customers, insurers or regulators ask you for evidence regularly
- Hiring a security lead is not proportionate, but needing one is real
- Your board wants somebody who can answer for it in the room
- Something happening at 2am on a Sunday would currently be found on Monday
- You have a capable team and want tooling: see with an IT team
- You want the platform and can run it: see Essentials
- You need one specific product, not a function: see Custom
Let's scope the engagement
Complete is written to your organisation: the scope, the service level and the reporting are agreed before anything is signed. The first conversation costs you nothing and usually clarifies more than it sells.