Advisory & assessment
Understand your position against the standard and what it will take to close the gap.
Learn more
Cyber security & compliance consultancy
Achieve and maintain compliance with confidence.
Expert-led consultancy across ISO 27001, SOC 2, NIST, PCI DSS, NIS2 and DORA. We assess where you stand, build the programme with your team, and stay with you through certification and beyond.
- Fixed-scope engagements
- Practitioner-led
- Independent of certification bodies
- 50+Clients protected
- 22Professional certifications
- 11Frameworks covered
Certified expertise
- CISSP
- CISA
- ISO 27001 Lead Auditor
- CISMP
- CompTIA CySA+
- CompTIA Security+
- +16 more
Our services
All servicesFour ways we help, depending on where you are.
Implementation
Build the management system, controls, documentation and evidence with your team.
Learn moreAudit & assurance
Independent testing of the system before your certification body, customers or regulator do.
- Internal audit (ISO 19011)
- Mock Stage 2 / Type II assessment
- Supplier security assessment
- Management review facilitation
Testing & resilience
Find the weaknesses before attackers do, and be ready when something gets through.
Learn moreSectors
Deep experience in regulated and high-assurance sectors.
Financial services
DORA, PCI DSS and regulator expectations for operational resilience.
Defence & government supply chain
CMMC, NIST 800-171, Cyber Essentials Plus and security-cleared delivery.
Technology & SaaS
ISO 27001 and SOC 2 to unblock enterprise procurement.
Critical infrastructure & energy
NIS2 obligations, OT-aware risk assessment and incident readiness.
Healthcare & life sciences
Data protection, ISO 27001 and supplier assurance for sensitive data.
Legal & professional services
Client-driven certification and confidentiality controls.
Manufacturing
Supply chain security requirements from customers and insurers.
Public sector
Cyber Essentials, NCSC CAF alignment and framework-based assurance.
Why Forged Compliance
Compliance that holds up after the certificate is issued.
Most programmes are built to pass one audit. Ours are built so your own team can run them, evidence them, and pass the next one without us.
- Practitioner-ledLed by CISSP, CISA and ISO 27001 Lead Auditor certified practitioners who have implemented and audited the standards we advise on.
- Fixed scope, fixed priceDeliverables, timeline and price agreed in writing before work starts.
- IndependentWe prepare you for certification and support you through it; we do not certify, resell or refer for commission.
- Documentation written in-houseComplete policy, standard and procedure sets, maintained to current framework editions.
A typical certification engagement
Around sixteen to twenty weeks from first call to Stage 2, depending on what already exists.
Weeks 1–3Gap assessment and roadmap
Weeks 4–14Build: risk, controls, documentation, evidence
Weeks 15–17Internal audit and management review
Weeks 18–20Stage 1 and Stage 2 support
Insights & resources
All guidesGuidance from our consultants.
Guide
Policies vs standards vs procedures: what each one is for
The three words get used interchangeably, and it causes findings. A simple test for which is which.
Comparison
ISO 27001, SOC 2, NIST, PCI DSS, NIS2, DORA: which applies to you?
Usually you do not choose; something chooses for you. A side-by-side of the frameworks we work with.
Explainer
NIST 800-171 R3 and CMMC Level 2: what assessors actually check
Assessors work from the 800-171A objectives, not the requirement text. What that means for your evidence.
Documentation
View the catalogueComplete, editable compliance documentation.
The policy, standard and procedure sets we use on engagements, available to buy directly.
£495
Policies & Standards — ISO/IEC 27001:2022
A complete policy and standards set structured to the 93 Annex A controls of ISO/IEC 27002:2022, plus the clause 4–10 management-system requirements.
£1,250NIST SP 800-171 R3 & CMMC Level 2 Programme
Everything a defence supplier needs to document CUI handling: policies, standards, procedures, System Security Plan and POA&M, aligned to 800-171A assessment objectives.
£595Procedures Library
Step-by-step operating procedures that show how each control is actually carried out, who does it, how often, and what record it produces.
Speak to a consultant
A 30-minute scoping call to understand your obligations, timeline and options. No obligation.