Compliance & standards
Two things on this page: the standards we hold our own work to, and how we help clients meet theirs. No certificates we don't hold, no acronyms without an explanation of what they do for you.
The standards we work to
Our engineering practice is built around four frameworks. To be straight with you: alignment means we work to these standards as everyday practice — it is not a claim to hold the certifications themselves, and we won't blur that line.
Cyber Essentials
The UK government's baseline security scheme, built on five technical controls. Our internal setup and the configurations we deploy for clients follow those controls as standard practice.
ISO 27001
The international standard for information security management. We align how we handle access, incidents and client data with its practices — documented processes rather than tribal knowledge.
NCSC guidance
The National Cyber Security Centre publishes practical guidance for exactly the kind of businesses we support. When it updates, our build standards update with it.
UK GDPR & data protection
Client data is handled in line with UK GDPR and the Data Protection Act. Our data protection page sets out the specifics of what we hold and why.
How we handle your data specifically — what we collect, why, and for how long — is set out on our data protection page.
Recognition we didn't write ourselves
Two external checks on our work sit alongside those frameworks. We're a Microsoft Solutions Partner for Modern Work — Microsoft's own assessment of our capability across Microsoft 365, the platform most of our clients run on.
And we're recognised in the Channel Futures MSP 501, an industry ranking of managed service providers. Neither replaces doing the work well, but both are judged by someone other than us — which is rather the point.
How we help clients with their compliance
Most of our clients don't need a compliance department — they need their IT run so that when a customer, insurer or auditor asks the awkward questions, the honest answers are good ones. That evidence comes out of our cyber security service as a matter of routine.
Microsoft 365 hardening, mapped to Cyber Essentials
We harden Microsoft 365 and Azure tenancies against the scheme's five controls — firewalls, secure configuration, user access control, malware protection and security update management — so the technical answers to a Cyber Essentials questionnaire are already true before you fill it in.
Patching on an agreed schedule
Vulnerability and patch management runs to patching SLAs agreed in your service contract, not whenever someone remembers. Missed updates are the finding auditors love most, and the easiest one to remove.
Audit-ready reporting
24/7 monitoring produces a record as a by-product: what's on the network, what's patched, what happened and when. When an auditor, insurer or enterprise customer asks for evidence, it's a report, not an archaeology project.
Phishing training with records
Our phishing simulations and security training produce completion records per person. Most frameworks ask you to prove staff were trained — with us, the proof accumulates on its own.
For businesses with heavier obligations — regulated sectors, enterprise customers with long security questionnaires — the Enterprise plan at £599 per month includes Compliance Management as a contractual feature, alongside a 99.9% uptime SLA and a Dedicated Account Manager. Our service level commitments page explains how those tiers differ.
If you're not sure where you stand today, a free security assessment gives you the gap list before anyone with a clipboard does.
Get compliance-ready before you're asked
Start with a free security assessment from the team at Paul Street. You'll get a plain-English view of where you stand against Cyber Essentials and what it would take to close the gaps — no obligation attached.