Public sector procurement wants the NCSC Cyber Assessment Framework (CAF). Enterprise clients want ISO 27001. Your insurer wants a documented security baseline that won't let them deny a claim. It shouldn't take three separate compliance projects to answer all three.
CAF, ISO 27001 and Cyber Insurance aren't the same thing, and we don't play the same part in each one. A quick overview of what each actually involves, and an honest breakdown of what we deliver versus what stays with you or your IT/MSP.
The international standard for an Information Security Management System (ISMS), certified by an independent, UKAS-accredited body through a formal audit.
The UK government's framework for assessing cyber resilience against 14 principles across four objectives, the standard reference for public sector and critical national infrastructure.
Not a certification, a set of evidence insurers expect to see before they'll underwrite you, and rely on to decide whether a claim gets paid.
The overwhelming majority of what CAF, ISO 27001 and Cyber Insurance actually require is the same set of real security policies, evidenced the same way. Historically, meeting all three meant three separate compliance projects, three separate price tags, and three folders of paperwork that all say roughly the same thing in different language.
The Cyber Assurance Policy Pack gives you that full policy set once, then presents it back to you through whichever lens you need, your CAF Contributing Outcomes, your ISO 27001 Statement of Applicability, or your insurer's evidence trail, without paying for the same paperwork three times over.
Bidding for public sector or local authority work? Procurement teams are increasingly disqualifying bids that can't demonstrate CAF alignment before a human ever reviews them.
Chasing enterprise clients? Their risk team's first question is almost always "are you ISO 27001 certified?"
Renewing your cyber insurance? Brokers are tightening underwriting and will deny a claim outright if your real-world practices don't match the policies on file.
A complete security policy set covering CAF, ISO 27001 and Cyber Insurance requirements in one pack.
A live SoA, mapped to the real ISO/IEC 27001:2022 control set, not a static, one-time export.
A TIP tracking what's still outstanding against CAF's Contributing Outcomes.
Test your incident response before you need it for real.
Documentation your cyber insurance broker, and insurer, if you ever need to claim, can actually rely on.
Update an answer and we automatically flag every document it affects. For real-world changes we wouldn't otherwise know about, a new supplier, a dropped control, tell us via your quarterly Narrative Check, so nothing here quietly goes stale between audits.
Generic downloaded templates fail audits and procurement checks for the same reason every time, they don't reflect how your business actually operates, and they carry none of the version control an assessor expects.
Pasting your company details into a public AI tool is worse: it's an immediate data exposure risk in its own right. Everything here runs inside our private, 100% UK data-sovereign platform.
Complete our secure core assessment about how your organisation actually operates, and the platform builds your full policy set, your live Statement of Applicability, your CAF-aligned Targeted Improvement Plan, and your Cyber Insurance evidence trail, built from those answers plus the framework-specific sections (data processing, incident response, business continuity, insurance and ISO audit tracking) that apply to your package. Update an answer and every document it affects is automatically flagged for review, backed by a quarterly Narrative Check to catch anything else that's changed.
One pack. CAF, ISO 27001, and Cyber Insurance, answered together.