The ground is shifting. The obligations follow you.
Three instruments are reshaping how UK and EU organisations evidence cyber posture, report incidents and account for the suppliers they depend on. None of them is optional once you're in scope.
UK / IN PARLIAMENT
Cyber Security and Resilience Bill
Expands incident reporting and supplier oversight beyond the NIS Regulations. Touches managed service providers and the supply chain that supports essential services.
Scope: essential services, MSPsEU / IN FORCE
Cyber Resilience Act
Imposes lifecycle security obligations on products with digital elements placed on the EU market. Vendors carry the burden; buyers assess for it during procurement.
Scope: manufacturers, importersEU / IN FORCE
DORA, the Digital Operational Resilience Act
Sets ICT risk, incident reporting and third-party oversight requirements for financial entities operating in the EU. The supervisory teeth are real.
Scope: financial entities, ICT providers
Who we are
The team that assesses your exposure is the team that responds to it.
We sit at the intersection of advisory and operations. No outsourced delivery, no junior bench, no rotating client managers. The analyst who briefs your board is the analyst on the keyboard at three in the morning.
One client team. The faces don't change.
Plain reports. No theatre, no inflated severity.
Operational continuity. We stay after the engagement closes.
Representative engagements
A few situations we are asked to work in.
Representative scenarios. Composite descriptions written for clarity, not citation.
FR / SCEN / 01
Pre-transaction due diligence
Map the cyber posture and historical exposure of an acquisition target before terms are committed. Findings sit alongside the financial diligence pack.
FR / SCEN / 02
Executive digital exposure audit
Quietly identify and remove the open-source data that makes a principal and their household targetable. Then keep it removed.
FR / SCEN / 03
Ransomware, first 72 hours
Containment, communications posture, evidence preservation, restoration. We take the operational decisions you should not be making while the building is on fire.
FR / SCEN / 04
Attack surface mapping before market entry
Understand what attackers will see the day a deal, listing or campaign is announced. Close the gaps before the announcement, not after.
Who we serve
A short list. The work is the same.
Boards and leadership teams 01
Law firms and professional advisers 02
Family offices and people with a profile to protect 03
Healthcare and critical operations 04
NGOs and international operations 05
Medical & Cyber Logistics
The fault-logging platform that built the firm.
FaultReady's operational logging tool keeps equipment faults, assets and response workflows visible from ward to estates. Built inside NHS estates; now one capability among ten.
