More than passing an audit
Compliance isn't optional, and getting it wrong is expensive. We combine technical expertise, advisory support and proven frameworks to make it manageable.
From the first gap assessment to audit day, we design your information security management system (ISMS), put the controls in place and keep the evidence up to date.
What we focus on
- Understanding your risks before recommending anything
- Aligning IT, people and processes with the frameworks that apply to you
- Less audit stress through ongoing monitoring and reporting
- Staying ahead of changes in compliance and data protection law
Support for every stage of compliance
Data protection & GDPR
GDPR alignment, data handling policies and monitoring.
ISO standards & certification
ISO 27001, ISO 22301 and other standards, from readiness through to ongoing maintenance.
Cyber Essentials & Plus
Support to achieve the government-backed Cyber Essentials and Cyber Essentials Plus schemes.
Risk & governance advisory
Guidance on aligning governance, processes and infrastructure with industry standards.
ISMS, controls & evidence
Gap assessments, ISMS design, control implementation and the evidence trail auditors need.
Continuous monitoring
Health checks, automated reporting and proactive updates, so you stay compliant between audits.
We hold ourselves to the same standard
Certified ourselves
Nostra has been ISO 27001 certified since 2021, now to the 2022 standard.
Security-first
Compliance built on real security controls, not paperwork alone.
Specialist consultants
Consultants with hands-on audit and certification experience.
Win more tenders
We've helped clients win tenders by achieving the certifications buyers ask for.
Compliance with Nostra, in plain English
Our compliance service takes you from the first gap assessment to audit day and beyond: we design your information security management system (ISMS), put the controls in place, and keep the evidence auditors ask for up to date — monitored by Cloud Shield 365 so you stay compliant between audits, not just on the day.
The frameworks we cover
NIS2, DORA, ISO 27001, ISO 22301, GDPR, and the government-backed Cyber Essentials and Cyber Essentials Plus schemes. That spans data protection and GDPR alignment, ISO readiness through to ongoing maintenance, risk and governance advisory, and continuous monitoring with automated reporting.
Compliance built on real security
We hold ourselves to the same standard: Nostra has been ISO 27001 certified since 2021, now to the 2022 standard. Our consultants have hands-on audit and certification experience, and the controls we implement are real security controls, not paperwork alone. We understand your risks before recommending anything.
Why it pays for itself
Getting compliance wrong is expensive — and getting it right wins business. We've helped clients win tenders by achieving the certifications buyers ask for.
Compliance questions
What is an ISMS?
An information security management system: the policies, controls and evidence that show how your organisation manages information security. We run the gap assessment, design the ISMS, implement the controls and maintain the evidence trail auditors need.
What is NIS2 and does it apply to us?
NIS2 is the EU's updated network and information security directive, and whether it applies depends on your sector and size. We start with a gap assessment that tells you where you stand and what, if anything, you need to do.
How long does ISO 27001 certification take?
It depends on your starting point, which is why we begin with a gap assessment. From there we support every stage — readiness, ISMS design, control implementation and the audit itself — through to ongoing maintenance after you're certified.
What is Cyber Essentials?
A government-backed certification scheme that demonstrates baseline cyber security. We support organisations through both Cyber Essentials and Cyber Essentials Plus.
Is Nostra itself certified?
Yes. Nostra has been ISO 27001 certified since 2021, now to the 2022 standard, so the advice you get comes from a team that maintains the same certification it implements for clients.
Can compliance help us win business?
Yes. Buyers increasingly ask for certifications in tenders, and we've helped clients win tenders by achieving them. Take the three-minute compliance readiness assessment to see where you stand.
Related services
Free compliance readiness assessment
Could you show an auditor you're compliant tomorrow? Ten questions, three minutes, and a score with your three biggest gaps.
Not sure where to start?
Book a free 30-minute IT health check. We'll tell you what's working, what's at risk and what we'd fix first. No obligation.