Run a restore drill in an isolated environment →
A repeatable drill you can run on one service with its owner present, producing a measured recovery time and a written finding.
Working exercises
Tutorials you can run on a real service.
Each exercise has a scope to agree and a written result at the end. Work within an approved test environment.
Move privileged accounts to phishing-resistant sign-in →
An enrolment sequence for a small group of administrative accounts, with recovery designed before the first credential is issued.
Build a handover pack that survives Monday →
A structure for service documentation, plus the test that tells you whether it is finished.
Audit Windows editions against support dates →
Turn a vague estate list into a per-edition view with owners and deadlines attached.
Cyber Essentials 1: decide what certification needs to achieve →
Start with a credible scope, a funded plan and an honest understanding of what the certificate proves.
Cyber Essentials 2: find the real scope, including cloud and home working →
Reconcile devices, services and access paths before deciding which controls you need to prove.
Cyber Essentials 3: firewalls and secure configuration that match reality →
Turn defaults and inherited settings into a controlled baseline, then check what devices actually enforce.
Cyber Essentials 4: support and patching within the real deadline →
Build an update process that includes applications, remote devices and proof of installation.
Cyber Essentials 5: accounts, administrators and cloud MFA →
Prove who can sign in, what they can do and whether protection is actually enforced.
Cyber Essentials 6: malware protection and a truthful readiness review →
Check effective protection across the estate and turn technical results into answers you can defend.
Cyber Essentials 7: submit the self-assessment without guesswork →
Connect each answer to current evidence and give the signatory a declaration they can understand.
Cyber Essentials 8: prepare for Plus, handle findings and keep the certificate useful →
Make the whole estate ready for independent testing and understand the 2026 consequences of incomplete patch remediation.
ISO 27001 for IT managers 1: build a business-owned security programme →
Understand the standard, the certification route and the work that IT should—and should not—own alone.
ISO 27001 for IT managers 2: scope, obligations and information ownership →
Define a management system around real services and dependencies, including the issues outside IT's direct control.
ISO 27001 for IT managers 3: risks, treatment and the Statement of Applicability →
Connect business consequences to controls, with owners and a record of what is actually implemented.
ISO 27001 for IT managers 4: make everyday IT work produce useful evidence →
Turn access, patching, changes and recovery into repeatable controls without creating a second helpdesk.
ISO 27001 for IT managers 5: suppliers, people and information beyond the server room →
Close the gaps between technical controls and the business processes that depend on them.
ISO 27001 for IT managers 6: run an internal audit and useful management review →
Find weaknesses while you can still fix them, and give leadership decisions rather than a ceremonial presentation.
ISO 27001 for IT managers 7: survive Stage 1 and Stage 2 without theatre →
Prepare people and evidence for the first certification audits, including awkward questions and honest gaps.
ISO 27001 for IT managers 8: close findings and be ready for surveillance →
Fix causes, verify that changes work and keep the ISMS useful after certification.