Security that stands up when customers, insurers and auditors check.
GW Consult is an independent UK consultancy. We lead your security, get you through Cyber Essentials and ISO/IEC 27001, test what you already have, and source the kit you need.
- Head of IT Security experienceSenior judgement on your side, without a senior salary.
- Independent adviceNo vendor quotas to meet. We recommend what fits you.
- Plain EnglishFrom the first call to the final report.
Standards and platforms we work with
- Cyber Essentials
- Cyber Essentials Plus
- ISO/IEC 27001
- NCSC CAF
- NCSC 10 Steps
- UK GDPR
- Microsoft 365
Five services, from a one-off review to an ongoing security lead.
Each one reduces real risk and stands up when a customer, insurer or auditor asks.
Fractional security lead
An experienced Head of IT Security on your side, for as much time as you need: strategy, roadmap, board reporting and a steady hand when it matters.
- A security strategy and 12-month roadmap tied to your business risks
- Board and management reporting your directors can act on
- Ownership of policies, the risk register and supplier assurance
- A named person your customers and insurers can talk to
Compliance readiness
Cyber Essentials, Cyber Essentials Plus and ISO/IEC 27001, plus the security questions in customer due diligence, without drowning in paperwork.
Assessments and testing
Independent security and Microsoft 365 reviews, vulnerability management, and penetration tests scoped, managed and followed through.
Policy, awareness and incidents
Policies people read, awareness and phishing programmes that change behaviour, and incident plans tested before you need them.
Sourcing and supply
Tell us what you need and we source and supply the hardware, software and licensing, chosen with security in mind.
Removable storage control for Windows
Closed by default.
Open on purpose.
Portcullis blocks USB storage on every Microsoft Windows endpoint you manage, opens it for one device, one person and a set time when there is a reason, and keeps a record nobody can quietly change.
BlockedBlock every port
The work still needs sticks: the auditor's files, the engineer's firmware, the board pack for the offsite. People find a way round, and the way round is not recorded.
OpenAllow every port
Nothing stops a client list leaving in a pocket. When a stick goes, there is nothing to show where it was used, or whether anything could have been copied to it.
PortcullisClose it, then decide
Closed by default. Opened for one device, one person and a set time when there is a reason. Every connection and every decision on the record.
A short call, a priced plan, then the work.
No long discovery phase and no report that sits in a drawer. You can see progress at each step.
- 1
Understand
A short call and a look at where you are now: your risks, your obligations, and what your customers are asking for.
- 2
Prioritise
A clear plan, in order, with costs. The few things that matter most come first.
- 3
Deliver
Hands-on work, or support for your own team, until it is done and you can show it.
Guides on compliance, device control and email security.
All insightsCompliance
Cyber Essentials: what it covers and how to pass first time
The five technical controls, what changed in the current requirements, the questions that catch people out, and how to prepare without a scramble.
Device control
Why USB device control still matters
Removable media is still one of the easiest ways for data to leave and malware to arrive. What to control, and how.
Email security
SPF, DKIM and DMARC: check your email security in 15 minutes
Three DNS records decide whether criminals can send email as you. How to check yours, and what good looks like.
Tell us what is worrying you, and we will suggest a first step.
A short call is usually enough. No obligation and no sales script.