Information security
Programme charter, information security policy and acceptable use
Trust & procurement
Easy to buy from. Safe to work with.
A security adviser should hold itself to the standard it sets for you. Here is what your security, legal and procurement teams can expect, and what we can share to make onboarding quick.
Our own security programme
A documented programme, adopted and signed.
JT Cyber Group runs on the same kind of programme we build for clients: written policies, plans and procedures, mapped to the major frameworks. They are available to review under NDA.
Incident response
Incident response policy, plan and playbooks
Data protection
Data governance and classification, privacy and data protection, data-subject rights procedure
Identity and access
Identity and access management policy
Third-party risk
Supplier onboarding and third-party risk management
Resilience
Business continuity and disaster recovery, vulnerability and patch management
Security operations
Security operations policy and SOC operating procedures
AI governance
AI governance policy and impact assessment template
For your procurement team
What we can provide.
Ask for any of these and we will turn them around quickly, so vendor onboarding does not hold up the work.
Mutual NDA, or yours
We sign your NDA, or send our mutual NDA for e-signature, before anything sensitive is shared.
Your security questionnaire
SIG, CAIQ or your own vendor-risk questionnaire, answered promptly and backed by our policies.
Contracts that fit your process
Our master services agreement and statements of work, or your paper if you prefer.
Supplier set-up
W-9 and supplier onboarding details on request.
Framework mapping
A crosswalk showing how our controls map to NIST CSF 2.0, ISO/IEC 27001, SOC 2, HIPAA and GDPR.
Capability statement
A one-page summary of services, experience and certifications for your shortlist.
During an engagement
How we handle your data.
- Least-privilege access to your systems and evidence, granted for the engagement and removed at the end.
- Evidence exchanged over encrypted channels you approve, never by ordinary email attachment.
- Client information is classified and handled under our data governance policy, and returned or destroyed when the engagement ends.
- No client data goes into AI tools without your written approval, under our AI governance policy.
- Specialists from our vetted bench work under the same confidentiality terms and the founder’s direction.
This website is held to the same standard: strict security headers, no tracking cookies, and a published security.txt for vulnerability reports.
Next step
Tell us what your process needs.
Send your NDA, questionnaire or supplier forms, or ask for our trust pack. If you would rather talk first, the free call is a good place to agree how we will work together.
- Founder-led
- ISACA CISM
- US & EU
- Reply within one business day