Assessment and hardening
Where you actually stand across identity, endpoints, network and cloud, then the work to close it.
M3CA://CYBEROnlinePosture: MonitoredFramework: ISO 27001Response: 24/7 on-call
Demo
04Sector dossier
Security you can show an auditor, at eleven on a Sunday night.
M3CA Cyber runs assessment, hardening, monitoring and the evidence work that follows.
- 01We do not sell fear.
- 02We map your estate, close what is open, and leave you with a control set someone else can maintain.
19
Days to certification readiness
100%
Findings closed or accepted in writing
12m
Median containment time
The control cycle we build against
Assessment is the start of the work, not the deliverable.
Select a stage to read what we build there.
Asset, identity and data-flow inventory across the whole estate
Nothing undocumented
Assurance ledger
The paperwork is part of the product.
The frameworks we work to and what we actually hand over under each one.
- ISO 27001
- Statement of applicability, risk register and internal audit programme
- Cyber Essentials Plus
- Gap analysis, remediation and assessor liaison through to pass
- NIS2 / DORA
- Scoping, supplier assessment and incident-reporting playbooks
- Testing
- CREST-aligned penetration testing with free retest of every fix
- Incident response
- Documented runbook, tabletop exercise twice a year, on-call rota
- Continuity
- Backup restore tested quarterly, RTO and RPO agreed and evidenced
What we deliver
Four outcomes, not four paragraphs.
Monitoring and response
Detection tuned to your environment, with a named response path when something fires at 3am.
Compliance evidence
Policies, controls and artefacts assembled so an audit is a retrieval exercise rather than a scramble.
People, not just tooling
Phishing simulation and training, because the control that fails most often is a person under pressure.
Products in this sector
All products
Featured work
What Cyber & Compliance has actually shipped.
02 projects
On M3CA TV
What we refuse
Three things we will not do.
- 01
Reports with no remediation attached. A PDF of findings is half a job.
- 02
Compliance theatre. If a control exists only for the certificate, we will say so.
- 03
Silent risk acceptance. Anything left open is signed for by a named person.
Disciplines
Switch sector
01AIApplied intelligence, not demos02HealthcareClinical-grade software and the media around it03EducationLearning that people finish05MediaA working studio, not a stock library06Managed ITThe layer everything else stands on07Sous ChefFor the evenings that earn the candle08OpportunityThe UK's media and IT opportunity engine09MarketingLower customer acquisition cost, higher ROAS10TalentThe crew, verified and on the clock
Start
Bring us the thing that keeps you awake.
An audit date, a failed pen test, an estate nobody has mapped. We will start with what is open and work down.