Prove your security holds up, and make it a reason your clients choose you.
Proof is becoming part of the contract
If you’re doing business — or want to be — with other organisations, you’re increasingly expected to prove that your cyber security holds up. Your next contract may depend on it. More mid-size and large organisations are now building evidence of solid security practices into their supplier contracts, purely to protect their own risk exposure.
For a supplier, this shows up in familiar ways:
- Long security questionnaires. Hundreds of questions, from every new customer, each asking for slightly different evidence.
- Contract clauses. Minimum security controls, incident notification duties, and the right to ask you for proof at any time.
- Certification requirements. Tenders and framework agreements that name ISO 27001, or ask you to show alignment with a recognised framework such as the NIST Cybersecurity Framework.
- Delays and lost deals. A sale stalls in procurement because you cannot produce the evidence quickly, or at all.
Why your clients are asking
There’s good reason for that shift. Attackers look for easier ways in than the front door, and a smaller supplier with weaker controls can be the easiest route into a larger organisation. Your customers know that if you are compromised, they may be too.
A 2024 Checkmarx survey of large enterprises found that 63% had fallen victim to a software supply chain attack in the previous two years. Cybersecurity Ventures estimates the global cost of software supply chain attacks at $60 billion in 2025, and projects that it will climb to $138 billion by 2031. Verizon’s 2025 Data Breach Investigations Report found that third-party involvement in breaches had doubled to 30%.
The consequence for suppliers is simple. Buyers can no longer take “we take security seriously” on trust. They want evidence, and increasingly they want it from someone independent.
What your clients actually want to see
Different clients ask for different proof, and it helps to know which is which. Two frameworks account for most requests:
| Framework | What it is | What you can show | Where it is commonly requested |
| ISO/IEC 27001 | The international standard for an information security management system. It is certified by accredited, independent certification bodies. | An independent certificate, valid for a set period, that your customers can verify. | Enterprise and multinational procurement, financial services, and tenders that require independent proof. |
| NIST Cybersecurity Framework (CSF) 2.0 | A voluntary framework of security outcomes organised around six functions: Govern, Identify, Protect, Detect, Respond and Recover. It is not certified. | A documented, evidence-backed alignment, with a current profile and a target profile. | US-linked customers and supply chains, and clients who want a common language for security risk. |
Many clients will accept either, some ask for both, and some send their own questionnaire regardless. Getting the underlying controls right means you can answer all of them from the same evidence.
From compliance headache to competitive advantage
Handled reactively, each request is a burden. Handled properly, the same effort becomes an asset. Once your controls are established and evidenced, you answer questionnaires from a body of evidence you already have, shorten your sales cycle, and enter a tender with proof that competitors who cannot produce it will struggle to match.
How We Can Help
We help you establish the baseline controls your clients are asking for, get you certification-ready, and turn what could be a compliance headache into a genuine competitive advantage — evidence of good security governance that sets you apart from competitors who can’t produce the same proof.
Our primary services are certification preparation for ISO/IEC 27001, including a pre-audit, and the implementation of the NIST Cybersecurity Framework 2.0. You can take either route on its own, or both together from a single set of controls and evidence.
Step 1: Start with what your clients are asking for
Before choosing a route, we look at what your clients and prospects actually require, so you invest in the right proof for the right reasons.
You receive
- A requirements matrix drawn from your clients’ contracts, questionnaires and tenders, showing what is asked for, how often, and by whom
- A certification decision brief recommending ISO/IEC 27001, NIST CSF alignment or both, with scope options, expected effort and a realistic timeline
- A baseline control set covering what almost every client asks for, such as access control, MFA, patching, backup, incident response and supplier management
Route A —
ISO/IEC 27001 certification preparation
We take you from where you are today to a working ISMS that meets ISO/IEC 27001:2022, ending with a pre-audit so that you know how you stand before an independent certification body assesses you.
A1. Gap analysis against the standard
You receive
- A gap analysis against the management system requirements and the Annex A controls
- A view of what you already do well, so nothing sound is rebuilt
- A prioritised remediation plan with owners and effort
A2. Build the ISMS to the standard
You receive
- A scope statement and context of the organisation, agreed with leadership
- An information security policy and objectives, kept short and written in plain language
- A risk assessment method, a risk register and a risk treatment plan
- A Statement of Applicability, with justification for each control included or excluded
- Defined roles, responsibilities and a lean set of documented procedures, only where the standard or your risks require them
A3. Implement and evidence the controls
You receive
- Implementation support for the Annex A controls that apply to you, covering people, organisational, physical and technological controls
- Supplier security requirements and a supplier register, so your own supply chain is covered
- An evidence log showing each control in operation, not just on paper
A4. Internal review and management review
The standard requires you to review your own ISMS and to have leadership review it before certification. We set this up so it is proportionate and useful.
You receive
- An internal review of the ISMS against the standard, with a findings report
- A management review pack and agenda for leadership
- A corrective action log, and an operating calendar that keeps risk reviews and control checks running
A5. Pre-audit and certification body selection
The pre-audit is a full rehearsal of the certification process, carried out by us so that you find and fix issues before an independent body assesses you.
You receive
- A pre-audit report, with findings graded in the same way a certification body grades them (major, minor, observation)
- A short fix list and a go or no-go recommendation on timing
- Guidance on choosing an accredited certification body, requesting quotes and scheduling
Certification itself is awarded by the independent certification body. We do not certify you, which is what gives the certificate its value to your clients.
Route B —
NIST Cybersecurity Framework (CSF) 2.0 implementation
NIST CSF is not certified, but a documented, evidence-backed alignment that gives customers what they are really asking for: confidence that your security is structured, current and improving. It is also a practical way for smaller organisations to raise their security in stages.
B1. Set your current and target profile
You receive
- A current profile showing where you stand across Govern, Identify, Protect, Detect, Respond and Recover
- A target profile that reflects your business, your risk and what your clients expect
- A target implementation tier, agreed with leadership
B2. Assess and prioritise
You receive
- A scorecard by function and category, with a heat map of your strengths and gaps
- Gaps ranked by business impact, not by how they compare with a generic standard
B3. Implement
You receive
- A phased implementation roadmap, with owners, effort and dependencies
- Policies, procedures and control improvements for the highest-priority gaps, including governance and cyber supply chain risk management
- Implementation support if you want it: we can do the work with your team
B4. Document your alignment
You receive
- A client-ready alignment statement, backed by an evidence-based mapping of your controls to the framework
- A repeatable process for updating the profile as you improve, so the proof stays current
Doing both from one set of controls
If your clients ask for both, you should not run two programmes. We build one control set and one body of evidence, then map it to both frameworks.
You receive
- A crosswalk between ISO/IEC 27001 and NIST CSF 2.0 covering your controls
- A single evidence library that serves both routes
Turn the proof into a competitive advantage + audit and cyber insurance readiness
Being certified or aligned is only half the benefit. The other half is making the proof easy for clients/auditors/insurers to see and use.
You receive
- A client/audit/insurance trust pack: a concise security overview, a summary of your certification or alignment, and a plain-language description of your key controls
- A questionnaire response bank, with reviewed answers to the questions clients/auditors/insurers ask most often, so replies take hours instead of weeks
- Guidance on how to present your security position in tenders, proposals and sales conversations
Not sure which proof your clients/auditors/insurers really need?
Start with a no obligation conversation. We’ll help you work out what to invest in first.