Frameworks
Frameworks we advise on, and what we do not claim.
Regulated, newly regulated or about to be. These are the rulebooks we help you read and meet. They are not badges we hold.
What advising means here
A framework is a way of reading a risk, not a destination. We start from your business, then show how the framework you are held to reads against it, so the evidence exists because the work happened. If a framework is not required of you, we will say so.
ISO 27001
The information security management standard. Our founder sits on the two British Standards committees that maintain it. We advise on it; Outside The Box Consulting does not currently hold ISO 27001 certification.
Cyber Essentials
The UK baseline of technical controls, and the step beyond it. We advise on it; Outside The Box Consulting does not currently hold Cyber Essentials certification.
SABSA
Security architecture traced from business need to control. Our founder is a Chartered Security Architect through SABSA, and it is the method behind our security architecture work.
What we do not claim
This site shows no certification or scheme badge for the firm, because we have none to show. If a tender needs a certified supplier, we will say so in the first conversation.
With their own page
Digital operational resilience for financial entities, in force since January 2025.
NIS2The wider cyber baseline for essential and important entities, with board accountability.
Operational resilienceFCA and PRA: important business services, impact tolerances, and the evidence you held them.
NCSC CAFThe outcome-based framework behind NIS regulation and GovAssure.
What we solveThe problems we get called about, set against the rules behind them.