Managed security and cybersecurity,
run as one discipline

The controls, operated: identity and access, endpoint detection and response, patch and vulnerability management, email and perimeter, logging and incident response. And the cybersecurity programme above them: risk, governance, compliance readiness and board reporting.

AtomicNorth is a managed service provider rather than a certifying body. We run controls and respond to incidents. The framework you are measured against belongs to you and your assessor.

Get in touch The cybersecurity programme

PositionProvider, not auditor

We operate controls and respond to incidents. We do not certify you, and we do not audit our own work.

StartAn assessment, not a tool

The first engagement measures the estate against a recognised control framework before anything is bought.

FrameworksCIS, NIST CSF, ISO 27001

Named standards clients are measured against, so a finding is comparable rather than our opinion of good practice.

CadenceRunning, never finished

Patching, access review, alert tuning and response rehearsal are recurring work with owners and dates against them.

What is included

Six control areas, run as one service

This is the operated layer. The risk register, policy, compliance readiness and board reporting that decide which controls you need are the cybersecurity programme further down this page, run by the same team on the same queue. It leans on the rest of the Managed IT family too. Identity, patching and monitoring are already part of running an estate properly. This is the discipline that makes them defensible.

Identity and access

Single sign-on, conditional access, multi-factor enforcement, privileged access control, service account hygiene, and joiner, mover and leaver processing with an audit trail.

Access reviews produce evidence with names and dates against them. Identity is where most incidents begin, and the leaver list is the thing nobody audits until they have to.

Access that can be evidenced on the day it is questioned.

Endpoint detection and response

Agent deployment with coverage reported across servers, laptops and mobile devices, detection policy tuned to your estate, and isolation available to the shift that is watching.

Coverage is reported as a gap list rather than assumed from a licence count. The device nobody manages is the one that matters.

An endpoint that can be isolated by the people watching it.

Patch and vulnerability management

Patch cycles by ring, out-of-band handling for urgent releases, authenticated vulnerability scanning, and remediation tracked to closure rather than to a report.

Every deferral is recorded as accepted risk with a named owner and a review date, so exposure is a stated position rather than a silence.

A patch and vulnerability position you can state on any given day.

Email and perimeter controls

Mail filtering, sender authentication records, attachment and link handling, firewall rule lifecycle, segmentation, and the review cycle that stops a rule base growing forever.

Rules and exceptions carry owners and review dates. Temporary exceptions are the ones that become permanent by default.

A rule base and a mail policy you can explain to an assessor.

Logging and monitoring

Log sources identified and forwarded, retention set against your obligations, detection content maintained, and alerts routed to a staffed shift rather than into a shared mailbox.

Log coverage is audited as a list of sources that should be reporting and are not, because a detection rule over a missing log is theatre.

Alerts that reach a person who can act on them.

Incident response

A documented response process with roles, contact trees, containment authority agreed in advance, and rehearsals against scenarios drawn from your own estate.

The decisions that waste time in a real incident are the ones about authority: who can disconnect a site, who calls the insurer, who speaks to customers. They are settled in writing beforehand.

A response that opens with action rather than with a call about who decides.

Cybersecurity programme

The programme around the controls

Most organisations can list the security tools they own. Far fewer can say which risks those tools address, which they do not, who accepted the gap, and what would happen on the day it is used. That second list is the security programme, and it decides which of the controls above you actually need.

Risk and posture assessment

Your systems, data and suppliers mapped, the threats that apply to them stated plainly, and each risk scored by likelihood and consequence against your own business rather than a generic list.

The output is a risk register with owners, not a severity chart. A risk with no owner is a risk nobody will fund.

A ranked statement of what could go wrong, and who answers for it.

Governance and policy

Information security policy, acceptable use, access, data classification and retention written to fit how the business actually works, then reviewed on a cycle rather than filed.

A fractional security lead can sit on your risk committee and own the programme where there is no CISO, with a defined handover once you appoint one.

Policies people can follow, and a named owner for the programme.

Compliance readiness

Gap assessment against the standard you are being measured on, a remediation plan, and the evidence pack an auditor asks for, built up as the controls run rather than assembled in the month before.

We prepare you for certification. The certificate itself comes from an accredited body after its own audit, and we will not suggest otherwise.

An audit that opens with evidence already on the table.

Security architecture

Identity as the perimeter, network segmentation, cloud configuration baselines, privileged access paths and backup isolation, reviewed against how an attacker would move through the estate.

Zero trust is treated as a direction of travel with a sequence, not a product. Most of the gain is in identity and segmentation that already exist and are not configured.

An estate where one compromised account is not the whole company.

Supplier and third-party risk

Suppliers with access to your systems or data identified, tiered by what they can reach, assessed proportionately, and reviewed at renewal with contractual security terms that can be enforced.

A growing share of breaches arrive through a supplier. The questionnaire matters less than knowing which suppliers hold a key.

A supplier list ranked by the access each one holds.

People and incident readiness

Role-based awareness training, phishing simulation reported as a trend rather than a league table, and tabletop exercises in which leadership walks through a ransomware or data loss scenario drawn from your own estate.

The decisions that waste the first hours of a real incident are about authority and communication. They are rehearsed here, before they are needed.

A leadership team that has made the hard calls once already.

How a security engagement runs

StepOneAssess

The estate measured against a recognised control framework: identity, patch position, endpoint coverage, log coverage, perimeter rules and the response process as it currently exists.

No tooling is recommended at this stage. The common findings are unpatched systems, excessive access, unmanaged devices and logs nobody collects, and none of those is fixed by another console.

You receive:

A ranked gap list

Each gap stated against the named control, with impact, remediation effort and an owner, ordered by what it costs on the day it is exploited.

This is diagnostic work and the report is yours whatever happens next.

StepTwoRemediate

The exposures worth fixing first: dormant accounts and standing privilege, the patch backlog, the devices with no agent, and the firewall rules nobody owns.

Remediation comes before instrumentation. Detecting an attack against a control you already know is missing is an expensive way to learn something you were told in the assessment.

You receive:

A closed set of findings

Findings closed with evidence, and anything deferred recorded as accepted risk with a named owner and a review date.

Nothing is quietly dropped. A gap you decide to live with is documented as a decision.

StepThreeInstrument

Endpoint agents to full coverage, log sources forwarded and verified, detection content tuned to your estate, alert routing to a staffed shift, and the response process written down.

Then a period of deliberate noise reduction, because a detection set nobody trusts is worse than a smaller one that is read every time it fires.

You receive:

Working detection and a response plan

Coverage confirmed source by source and device by device, alert routing documented with names, and a response process with authority and contact trees agreed.

Each suppression recorded with a reason and a review date.

StepFourOperate

Steady state: patch cycles to plan, scanning on schedule, access reviews with evidence, detection content maintained, and response rehearsed rather than described.

Security decays without a cadence. Accounts accumulate, agents fall off devices, log sources stop reporting after a migration, and none of it announces itself.

You receive:

A monthly service review

Patch and vulnerability position, endpoint and log coverage, access review evidence, alert quality, incidents with causes, and the plan for anything deferred.

Written so your assessor can read it without translation.

Coverage

Control area, cadence and evidence produced

The column that separates a real security service from a nominal one is the last. A control nobody can evidence is a control nobody can rely on.

Managed Security Services coverage
Control area	Scope	Cadence	Evidence produced
Identity	Sign-on, conditional access, privileged access, service accounts	Reviewed quarterly	Access review record with names, dates and removals
Endpoint	Agent coverage, detection policy, isolation, mobile devices	Continuous	Coverage gap list and detection tuning record
Patching	Operating systems, applications, firmware where in scope	Monthly by ring, out of band as needed	Patch position statement and deferral register
Vulnerability	Authenticated scanning, ranking, remediation tracking	Scheduled scan cycle	Ranked findings with owners and closure evidence
Email and perimeter	Filtering, sender authentication, firewall rules, segmentation	Continuous, rules reviewed on cycle	Rule and exception register with owners
Logging	Source coverage, retention, detection content, routing	Continuous, reviewed monthly	Source coverage report and alert quality review
Response	Process, authority, contact trees, rehearsal	Scheduled rehearsal	Rehearsal report naming the decisions that were slow

Frameworks

The standard you are held to, and what readiness means

The assessment measures against whichever of these applies to you. Most organisations are held to more than one, and the overlap between them is large enough to plan once and evidence many times.

Cybersecurity frameworks: who asks for it, what it covers, what readiness work involves, who certifies
Framework	Usually asked for by	Readiness work	Outcome decided by
ISO/IEC 27001	Enterprise customers, tenders, international buyers	Scope, risk assessment, Statement of Applicability, management system, internal audit	Accredited certification body
SOC 2	North American customers of service providers	Control design against the trust services criteria, evidence over the audit period	Independent CPA firm
NIST CSF	Boards, insurers, regulated sectors	Current and target profile, maturity by function, improvement plan	Self-assessed, often externally reviewed
CIS Controls	IT leadership wanting a practical baseline	Implementation group selected, safeguards measured and prioritised	Self-assessed
Cyber Essentials	UK public sector and supply chains	Five technical controls checked across the in-scope estate	Accredited certification body
Data protection law	Regulators and data subjects: DPDP Act in India, PIPEDA in Canada, UK GDPR	Data mapping, lawful basis, retention, breach notification process, processor terms	The regulator, if it is ever tested

We prepare organisations for these assessments and operate the controls they test. We are not a certification body, an auditor or a law firm, and where a question is legal rather than technical we will say so and expect your counsel to answer it.

Assessment

The first engagement is an assessment, not a tool rollout

Most security proposals open with a product, because a product is easy to quote and easy to install. It is also the quickest way to spend a budget without changing your exposure, since the findings in most estates are unpatched systems, excessive access, unmanaged devices and logs nobody is collecting, and no console fixes any of those.

So the first piece of work measures the estate against a recognised control framework, whether that is the CIS Controls, NIST CSF, ISO 27001 or Cyber Essentials, depending on what you are actually held to. The output is a ranked gap list with effort and owners against it, and it is yours whether or not the engagement continues. Tooling is bought afterwards, for the gaps that need it.

Ask for a security assessment

Framework namedThe assessment states which control set it measures against, so findings are comparable and nothing rests on our own opinion of good practice.
Ranked by consequenceGaps ordered by what they cost on the day they are exploited, with effort attached, rather than by how easily a product can be sold against them.
Acceptance on recordAnything you choose not to fix is recorded as accepted risk with a named owner and a review date. Silence is not a decision.

Indicative approach. Scope and control set are agreed with you before the assessment starts.

Questions we get asked

Before a security or cybersecurity engagement

Does using you make us compliant with ISO 27001 or Cyber Essentials?

No. We are a managed service provider, not a certifying body or an assessor, and no provider can grant you a certificate by being your supplier. What we can do is operate controls against the framework you are measured on and produce the evidence your assessor asks for, which is usually the part that stalls a certification. The certificate itself comes from an accredited body after their own assessment.

Do we need a security platform or a SIEM?

Eventually, for log retention and detection at any scale, but not on day one and not before the assessment. Buying a platform over an estate with patch gaps and unmanaged devices produces expensive visibility of problems you already knew about. Where native tooling in your existing licences covers a control adequately, we will say so rather than quote a product on top of it.

Can you take over security without taking over the rest of the estate?

Yes, and the assessment is deliberately bounded that way. Running the controls is harder when someone else owns patching and identity, because the fix for most findings sits with them. It still works, provided the boundary is written down and there is one queue rather than two, and we will tell you which findings we cannot close from where we sit.

Do you carry out penetration testing?

Risk and vulnerability assessment and penetration testing sit inside this service, scoped and scheduled with you. One caveat we raise ourselves: a test run by the same team that configured the control is worth less than an independent one. Where independence matters for an assessor or a board, we say so and arrange it that way.

What actually happens when there is an incident?

The process runs from the plan agreed in advance: an owner is assigned, containment is executed under the authority already documented, the contact tree is used, and evidence is preserved rather than overwritten by well-meant cleanup. Afterwards there is a written review with cause, timeline and remediation. We will not put a detection or containment figure in a contract before we have seen your estate, because any number offered at that stage is a sales number.

We do not have a CISO. Can you fill that role?

A fractional security lead can own the programme, sit on your risk committee and report to the board, for a defined number of days a month. It works well up to a point. Once security decisions are needed weekly, or regulation requires a named executive, you need your own CISO, and we would rather help you hire one than stretch the arrangement.

Will this get us ISO 27001 or SOC 2?

It gets you ready for the audit: scope, risk assessment, controls in place and evidence filed. The certificate or report comes from an accredited certification body or an independent CPA firm after their own assessment. Nobody can promise the outcome of someone else's audit, and anyone who does is selling the promise.

Do you cover data protection law?

We cover the technical and process side: data mapping, retention, access, breach detection and the notification process. Questions of legal interpretation under the DPDP Act, PIPEDA or UK GDPR belong with your counsel, and we work alongside them rather than in their place.

Run it,then evidence it.

Start with an assessment against the control framework you are measured on. It needs read access rather than a contract, and it produces a ranked gap list you keep either way.

Get in touch Book a scoping call

AI Solutions

Oracle Services

Salesforce

Microsoft Enterprise Services

Application Management

Managed IT Services

Managed Business Services

Managed security and cybersecurity,
run as one discipline

Six control areas, run as one service

Identity and access

Endpoint detection and response

Patch and vulnerability management

Email and perimeter controls

Logging and monitoring

Incident response

The programme around the controls

Risk and posture assessment

Governance and policy

Compliance readiness

Security architecture

Supplier and third-party risk

People and incident readiness

StepOneAssess

A ranked gap list

StepTwoRemediate

A closed set of findings

StepThreeInstrument

Working detection and a response plan

StepFourOperate

A monthly service review

Control area, cadence and evidence produced

The standard you are held to, and what readiness means

The first engagement is an assessment, not a tool rollout

Before a security or cybersecurity engagement

Run it,then evidence it.

Managed security and cybersecurity,run as one discipline

Six control areas, run as one service

Identity and access

Endpoint detection and response

Patch and vulnerability management

Email and perimeter controls

Logging and monitoring

Incident response

The programme around the controls

Risk and posture assessment

Governance and policy

Compliance readiness

Security architecture

Supplier and third-party risk

People and incident readiness

StepOneAssess

A ranked gap list

StepTwoRemediate

A closed set of findings

StepThreeInstrument

Working detection and a response plan

StepFourOperate

A monthly service review

Control area, cadence and evidence produced

The standard you are held to, and what readiness means

The first engagement is an assessment, not a tool rollout

Before a security or cybersecurity engagement

Run it,then evidence it.

Managed security and cybersecurity,
run as one discipline