Cyber security for the public sector and its suppliers
Public bodies are held to rising cyber standards, and so are the suppliers they rely on. We help public sector organisations and the companies that serve them meet CAF-based expectations, satisfy procurement requirements and protect the public services people depend on.
Talk to a member of our teamThe challenge
What's driving security in your sector
CAF-based assurance
Government and many public bodies use the NCSC Cyber Assessment Framework as the basis for assurance, so you need a clear, evidenced view of your position against it.
Supplier requirements
Cyber Essentials, and often Cyber Essentials Plus, is required for many central government contracts that involve personal data or IT services.
Rising standards
Government's cyber strategy and its Cyber Action Plan aim to hold the public sector to consistent minimum standards, backed by cross-government investment.
Board oversight
The Cyber Governance Code of Practice sets out what boards and senior leaders are expected to do to oversee cyber risk.
How we help
Practical support, from strategy to evidence
We bring our six core services together around the requirements that matter in your sector, so effort goes into the controls and evidence that make the difference.
Cyber Security Advisory
Independent advice for senior leaders and boards on cyber risk, priorities and investment cases.
Governance & Risk Management
Risk management and governance aligned to the CAF and the Cyber Governance Code of Practice.
Audit & Assurance
CAF self-assessment support, evidence reviews and independent assurance.
Threat Modelling
Threat modelling of critical services and new digital services to support secure design.
Cyber Security Frameworks
Cyber Essentials and Cyber Essentials Plus readiness for suppliers, and ISO/IEC 27001 alignment.
At a glance
Key requirements and frameworks
| Requirement | What it covers |
|---|---|
| NCSC Cyber Assessment Framework | Outcome-based assessment used across government and the wider public sector |
| Cyber Essentials / Plus | Common requirement for government suppliers |
| Cyber Governance Code of Practice | Expectations for boards and directors on cyber risk |
| ISO/IEC 27001 | Certifiable management system, often accepted in procurement |
| UK GDPR | Security of personal data, overseen by the ICO |
A summary for guidance only, correct as of October 2026. Requirements change; check the source for your situation.
FAQs
Common questions
Let's talk about your next step
A short, no-obligation conversation to understand where you are and what would help most.