Frequently Asked Questions
Cyber assurance isn't simply about achieving certification. The right approach can help you protect your organisation, satisfy customer and procurement requirements, plan investment more effectively and create greater confidence in your business.
These are some of the questions we help organisations answer.
Start with your business rather than a particular certification.
The right level of cyber protection and assurance depends on your organisation, the information you hold, your risks, your customers, the markets you operate in and where the business is heading.
You may need Cyber Essentials to meet an immediate requirement, Cyber Essentials Plus to provide greater independent assurance, or a more developed governance framework through ICA or ISO 27001. Equally, investing in an accreditation before there is a business need for it may consume resources that could be better used elsewhere.
Fortnet's Cyber Consulting & Strategic Guidance helps you establish what matters. We assess your current position, understand your commercial ambitions and identify the risks, requirements and opportunities that should influence your cyber strategy.
You get clear guidance on what you need, why you need it and when you are likely to need it - allowing you to make better decisions and invest with greater confidence.
Cyber security increasingly affects much more than technology.
Customers, procurement teams, supply-chain partners, regulators and investors may all want confidence that your organisation can be trusted with information and manages cyber risk appropriately.
The right cyber strategy can therefore support customer retention, entry into new markets, tender opportunities, supplier approval and the ability to work with larger organisations.
Fortnet's approach starts by understanding these commercial objectives. Your cyber priorities, investment and accreditation strategy can then be aligned with what the business is trying to achieve.
Cyber investment becomes part of your business strategy rather than simply a response to technical risk.
First establish exactly what is being requested and why.
A customer may specify ISO 27001, Cyber Essentials Plus or another recognised standard. Alternatively, they may simply require greater evidence of your governance, controls or security maturity.
Before committing to a certification project, Fortnet helps you understand the requirement, your current position and any gap between the two.
Where a structured programme is required, your Commercial Cyber Protection Roadmap creates a clear route forward - identifying milestones, dependencies, resources, investment and the assurance you need to demonstrate along the way.
This allows you to respond to the commercial requirement with a plan rather than reacting with an isolated compliance project.
Explore: Cyber Consulting & Strategic Guidance / Commercial Cyber Protection Roadmap
Not necessarily.
ISO 27001 can provide valuable recognised assurance, but your organisation should achieve the level of protection and accreditation appropriate to its current risks, customers and commercial objectives.
Fortnet's Commercial Cyber Protection Roadmap allows you to understand the whole journey without requiring you to complete every stage immediately.
You may progress through Cyber Essentials, Cyber Essentials Plus and ICA before ISO 27001, or pause when you've achieved the protection and assurance your business currently requires.
If a new customer, market or commercial opportunity subsequently requires greater accreditation, the foundations for your next stage are already in place.
You progress at the pace your business needs.
Explore: Commercial Cyber Protection Roadmap
They provide different levels and types of assurance, but they don't have to be treated as completely separate projects.
Fortnet's Accumulative Certification™ methodology creates a structured progression.
Cyber Essentials establishes important technical foundations. Cyber Essentials Plus independently validates those controls. IASME Cyber Assurance (ICA) develops broader governance and risk management, while the documentation, controls and evidence developed throughout can be aligned towards ISO 27001.
The important difference is how the journey is planned.
Rather than repeatedly completing one project and starting another, Fortnet develops each stage with the next in mind.
Build Once. Benefit Again.
Explore: Commercial Cyber Protection Roadmap
Yes - when it is planned that way.
This is the principle behind Fortnet's Accumulative Certification™ methodology.
Policies, controls, governance, evidence and working practices developed today should not become redundant simply because your organisation subsequently requires a higher level of assurance.
Fortnet considers future requirements when designing your programme so that today's investment can continue contributing towards tomorrow's ambitions.
That reduces unnecessary duplication, protects internal resources and helps prevent your organisation repeatedly paying to solve the same problem.
Explore: Commercial Cyber Protection Roadmap / Fortnet Methodology
Knowing what you need to achieve is only part of the challenge. Delivering it requires people, technology, governance, processes and evidence to move together.
Fortnet's Success Through Compliance Programme turns your Commercial Cyber Protection Roadmap into a managed programme of measurable action.
We work alongside your leadership, IT, operations and compliance teams, coordinating responsibilities, milestones, deliverables and evidence as your organisation progresses towards the required level of assurance.
Regular reviews maintain momentum and keep resources, timescales and investment aligned with your objectives.
You don't simply prepare for an assessment. You progressively build a stronger, more mature organisation.
Explore: Success Through Compliance Programme
Cyber assurance isn't simply an IT responsibility.
Technology is important, but successful cyber assurance also requires leadership commitment, appropriate governance, clear processes, defined responsibilities and evidence that controls operate effectively.
Depending on your organisation and objectives, that can involve leadership, IT, operations, compliance and other business functions.
The Fortnet Methodology creates one team and one direction. Ownership, responsibilities, milestones and success criteria are established from the outset so everyone understands what needs to happen, why it matters and their role in making it happen.
That creates alignment, accountability and momentum rather than leaving cyber compliance sitting with one individual or department.
Explore: The Fortnet Methodology
There isn't a standard figure that's right for every organisation - and spending more doesn't automatically mean becoming more secure.
Your investment should reflect your risks, business objectives, customer requirements, current security maturity and the level of assurance you need.
Fortnet's Cyber Consulting & Strategic Guidance helps establish what matters and where investment should be prioritised.
Your Commercial Cyber Protection Roadmap then provides greater visibility of milestones, dependencies, resource requirements and expected investment.
That allows leadership teams to plan expenditure rather than responding to unexpected requirements, avoid unnecessary technology purchases and understand how today's investment contributes towards future objectives.
Explore: Cyber Consulting & Strategic Guidance / Commercial Cyber Protection Roadmap
There is no single timescale.
It depends on your starting position, existing governance and controls, the scope of certification, available internal resources and the work required to build and evidence an effective information security management system.
Fortnet assesses your current position and develops a structured roadmap with realistic milestones, responsibilities and measures of progress.
Through the Fortnet Methodology, activities can run concurrently where appropriate, while regular reviews keep delivery aligned with your resources, investment and commercial objectives.
The priority isn't simply achieving certification as quickly as possible. It is creating an effective programme that provides credible assurance and can be sustained once certification has been achieved.
Explore: Commercial Cyber Protection Roadmap / Success Through Compliance Programme
The time required depends on how closely your organisation already meets the scheme's technical requirements and how quickly any gaps can be addressed.
Fortnet establishes your current position and identifies the actions required to become assessment-ready.
However, we also consider what may come next.
If Cyber Essentials is the first stage of a longer assurance journey, your programme can be developed so the work completed now supports Cyber Essentials Plus and contributes towards the governance and assurance you may require later.
You achieve what the business needs today without losing sight of what it may need tomorrow.
Explore: Commercial Cyber Protection Roadmap
Accreditation is important, but customers increasingly want more than a certificate.
They may want confidence that appropriate controls operate in practice, risks are actively managed, responsibilities are understood and your organisation can provide credible evidence of its security maturity.
Evidence is therefore built throughout the Fortnet Methodology, rather than assembled at the end of a project.
Through the Success Through Compliance Programme, policies, controls, risk assessments, governance and operational evidence are progressively brought together, with your managed ISMS providing visibility of progress and documentation.
You get assurance you can demonstrate - not simply claims you can make.
Explore: Success Through Compliance Programme / Fortnet Methodology
Yes.
Security questionnaires and supplier due diligence can consume considerable time when information, policies and evidence have to be assembled each time a customer asks for them.
Recognised accreditation, structured governance and accessible evidence make it easier to demonstrate your security position.
Through the Success Through Compliance Programme, Fortnet helps build and maintain the controls, risk assessments, documentation and evidence behind your cyber assurance.
This can reduce the burden of lengthy customer diligence, help satisfy enterprise procurement requirements and make your organisation easier for customers to assess and ultimately easier to do business with.
Explore: Success Through Compliance Programme
It can help remove barriers that might otherwise prevent you from competing.
Recognised accreditation provides independent evidence of your approach to information security and can influence supplier selection, procurement, tender requirements and customer confidence.
For some opportunities, a particular accreditation may be mandatory. In others, stronger cyber assurance can differentiate your organisation and reduce the perceived risk of working with you.
Fortnet therefore treats accreditation as more than a certificate.
Through the Success Through Compliance Programme, your cyber maturity becomes something you can demonstrate to customers, prospects, partners and stakeholders - helping your organisation protect existing relationships and compete for new opportunities.
The commercial objective is clear: make your organisation easier to trust and easier to buy from.
Explore: Success Through Compliance Programme
Fortnet doesn't treat cyber assurance as a series of disconnected certification projects.
The Fortnet Methodology connects strategy, technical controls, governance, people, evidence, certification and renewal around the commercial objectives of your organisation.
You get expert guidance to determine what matters, a Commercial Cyber Protection Roadmap to define the journey, the Success Through Compliance Programme to manage delivery and Renewal Assurance to protect what you've built.
Throughout that journey, Accumulative Certification™ ensures each stage is developed with the next in mind.
That means clearer decisions, more predictable investment, aligned resources, evidence from day one and a cyber programme that can develop as your organisation develops.
You get more than cyber expertise. You get a commercially focused partner with a defined methodology for turning cyber assurance into lasting business value.
Explore: The Fortnet Methodology
Certification is an important milestone, but it shouldn't be the end of your cyber programme.
Your organisation, technology, people, risks and customer requirements will continue to change. Your governance, controls, documentation and evidence therefore need to develop with them.
Fortnet's Renewal Assurance Programme provides the ongoing structure and expertise needed to maintain your protection, safeguard your certifications and demonstrate continual improvement.
Rather than revisiting compliance a few weeks before renewal, you remain prepared throughout the year.
Your cyber maturity continues developing with your organisation.
Explore: Renewal Assurance Programme
The most effective approach is to treat assurance as an ongoing business activity rather than an annual certification exercise.
Unexpected compliance work creates pressure on internal teams and can lead to unexpected costs when renewal deadlines approach.
Through the Renewal Assurance Programme, Fortnet helps keep governance, documentation, controls and evidence aligned throughout the year. Future requirements can be anticipated, activities planned and investment understood earlier.
You remain ready rather than having to become ready.
That creates more predictable renewals, better use of internal resources and greater confidence that the standards your customers expect continue to be maintained.
Explore: Renewal Assurance Programme
Cyber protection and assurance should develop with your organisation.
The controls, policies, evidence and governance you've already invested in shouldn't be discarded whenever requirements change or another accreditation becomes necessary.
Fortnet's Accumulative Certification™ methodology protects that investment throughout the assurance journey, while the Renewal Assurance Programme continues the same principle after certification.
As requirements evolve, existing foundations are updated and developed rather than repeatedly replaced.
The result is continuing protection, more predictable investment and cyber credentials that remain relevant to customers and commercial opportunities.
Build Once. Continue Benefiting.
Explore: Renewal Assurance Programme / The Fortnet Methodology