Cyber Essentials or ISO 27001: where should you start?
Two very different certifications. Here's how to decide which one delivers the most value first.
Independent information security consultancy
Practical security.
Tangible results.
Helping organisations build stronger, more resilient futures, from Cyber Essentials Plus and ISO 27001 to virtual CISO leadership and incident readiness.
- Secure
- Comply
- Progress
Get certified
ISO 27001 and Cyber Essentials Plus, from first gap analysis through to a successful audit.
Certification services
Senior security leadership
A virtual CISO to set strategy, own risk and report to your board, without a full-time hire.
Virtual CISO
Be incident-ready
Response plans, playbooks and tabletop exercises, so your team knows exactly what to do.
Incident readiness
Free Cyber Essentials checklist
Check your organisation against all five controls before you apply for certification.
Get the checklistStandards and frameworks I work with
- ISO/IEC 27001:2022
- Cyber Essentials
- Cyber Essentials Plus
- NIST CSF 2.0
- NCSC CAF
- UK GDPR
Services
Everything you need to secure, comply and progress
From your first gap analysis to certification and beyond: practical, independent advice tailored to your organisation.
Secure
Lead & govern
Senior security leadership, clear policy and risk decisions you can defend.
Virtual CISO
Strategic security leadership without the cost of a full-time Chief Information Security Officer.
Learn more
Security Policy & Governance
Clear, practical policies, standards and procedures that people can actually follow.
Learn more
Risk Management
Make informed security decisions with risk assessments, registers and treatment plans.
Learn moreComply
Certify & comply
Achieve and maintain the standards your customers, insurers and regulators expect.
ISO 27001 Consultancy
Implement, certify and maintain an ISMS that works for your business, not just for the auditor.
Learn more
Cyber Essentials & Cyber Essentials Plus
Demonstrate your security fundamentals with readiness reviews and hands-on support through certification.
Learn more
Gap Analysis
Understand exactly where you stand against a standard or framework, and what to fix first.
Learn more
NCSC Cyber Assessment Framework
Assess and build resilience against the NCSC CAF's four objectives and fourteen principles.
Learn moreProgress
Mature & respond
Measure and grow your security maturity, plan for the worst, rehearse your response and build a security-aware culture.
NIST Cybersecurity Framework
Align and mature your security programme with NIST CSF 2.0's six core functions.
Learn moreIncident Response Planning
Be ready before the incident happens, with clear plans, playbooks and communication.
Learn more
Tabletop Exercises
Test your response before it matters, with realistic scenarios for technical teams and executives.
Learn more
Security Awareness Training
Build a security-aware culture with engaging training for staff, executives and boards.
Learn moreYour security journey
A clear path to greater resilience
Whatever standard you're working towards, the route to the top follows the same five steps. Each one builds on the last, so your investment compounds instead of starting over.
-
Step 1
Gap Analysis
Understand where you stand today and where the real risks are.
-
Step 2
Plan & Prioritise
Agree a practical, risk-based roadmap with clear owners and timescales.
-
Step 3
Implement
Put the right policies, controls and processes in place.
-
Step 4
Test & Validate
Prove it works through audits, testing and tabletop exercises.
-
Step 5
Improve & Sustain
Keep improving with ongoing leadership, reviews and reporting.
Assess Plan Implement Test Improve
Why McArthur Infosec
People. Process. Technology.
Security succeeds when everything works together. I look at the whole picture, not just the technology, so the improvements you make actually last.
People
Skilled, aware and empowered teams, from the board to the front line.
Process
Clear, consistent and effective policies, risk management and governance.
Technology
Secure, resilient and well-managed systems, aligned to recognised standards.
- Independent adviceRecommendations based on your risk, not a sales target.
- Tailored solutionsRight-sized for your organisation, budget and goals.
- Lasting impactCapability that stays with you after the engagement ends.
Insights
Practical guidance, no jargon
What does a virtual CISO actually do?
Senior security leadership without a full-time hire. What to expect, and when it makes sense.
Why every organisation should run a tabletop exercise
The cheapest way to find out whether your incident response plan really works.
Free resource
Cyber Essentials readiness checklist
A practical checklist covering all five Cyber Essentials control themes. Find your gaps before the assessor does.
- Firewalls, secure configuration & patching
- User access control & malware protection
- Scoping tips for cloud and home working
Where should we start?
Usually with a short discovery call, followed by a gap analysis. This shows where you stand today and which standard or service will give you the most value first.
What is the difference between Cyber Essentials and Cyber Essentials Plus?
Cyber Essentials is a verified self-assessment of five technical controls. Cyber Essentials Plus covers the same controls but adds a hands-on technical audit by an independent assessor.
How long does ISO 27001 certification take?
Typically 6–12 months from gap analysis to certification, depending on the scope and how mature your existing security practices are.
Do you carry out the certification audit?
No, and that is deliberate. Certification is carried out by independent certification bodies. I prepare you and support you through the audit, so the advice you receive stays independent.
What does a virtual CISO do?
A virtual CISO provides senior security leadership on a part-time basis: setting strategy, owning risk, guiding your IT team or provider, and reporting to the board.
Do you work remotely or on-site?
Both. Most work can be delivered remotely, with on-site workshops, audits and tabletop exercises where they add value.
Let's talk
Start your journey to a more secure tomorrow.
A free, no-obligation 30-minute discovery call to understand your goals and suggest the most practical next step.