The honest gap list.
Costed in engineer-days.

The best fit for this service anywhere. SOC 2 is a binary sales gate, 15,000–20,000 reports are issued a year, and California's CPPA cybersecurity audit and risk-assessment regulations took effect 1 January 2026 — with pre-2026 risk assessments due 31 December 2027 and the first audit certifications 1 April 2028.

The CPPA regime carries the same independence structure as SOC 2: the auditor cannot perform the remediation. NYDFS Part 500 fully phased in November 2025.

ISO 27001:2022 is the usual target, and the 2013 certificates expired on 31 October 2025 — which has pushed a re-certification wave through 2026. Cyber Essentials readiness is a separate service, because the Danzell question set is a different scope.

We are not an IASME-licensed certification body and cannot issue a Cyber Essentials certificate. We do not take UK public-sector work: it requires contractual UK data residency, SC clearance and CE Plus under G-Cloud 15, none of which offshore delivery can satisfy.

NIS2 has no certification and no accredited auditor, so ISO 27001 is the de facto evidence artefact — and there is no independence barrier on any of the work. That makes a NIS2 conversation convert cleanly into a readiness engagement.

Twenty-seven national regimes, fragmented: the Commission referred Ireland, Spain, France and the Netherlands to the CJEU on 8 July 2026 for failure to transpose. We deliver in English only, and NIS2 buying often happens in German, French, Italian, Dutch or Spanish.

Strong fit. The National Cyber Security Strategy moved the UAE from voluntary guidance to mandatory resilience, and NESA / UAE IA's 188 controls plus DESC ISR v3 create real assessment demand that local supply has not caught up with. UAE and South Africa account for roughly 45% of all Middle East and Africa ISO certifications.

Where the client is a DIFC or ADGM entity, the free zones are as strict as the EU on transfers and neither lists India as adequate. Saudi Arabia we take only as pull-through from a UAE client, under the UAE contract — NCA ECC-2 effectively requires an in-Kingdom presence.

No, and we legally cannot be. Only a licensed CPA firm can attest SOC 2, and only a UKAS- or ANAB-accredited body can certify ISO 27001 — and that body is barred from certifying anyone it consulted. That independence wall is precisely why the readiness and implementation work is available to us at all.

No. We receive no fee, commission, rebate or other consideration from any auditor or certification body we refer you to, and we confirm that in writing to both you and them. You contract with them directly.

That's the fair objection, so we built the answer in: the assessment fee is credited in full against any remediation work, and the findings register is yours in machine-readable form to take to any provider, including your incumbent. We'll hand it over and brief them at no charge.

Vanta tells you a control is failing and generates guidance. It does not tell you what it costs to fix, in what order, or which findings actually block your audit. If your dashboard is red and nobody on your team knows what to do about it, that gap is what this closes.

We are working toward ISO 27001 certification of withRemote itself and publish the scope statement, certification body and stage dates as they land. We would rather tell you that plainly than let you find it in a vendor questionnaire.

It is not an audit, an attestation, a certificate or an assurance opinion, and those words appear nowhere in the deliverable. We design and hand over controls; we do not operate them, sign them off, or accept the residual risk. Penetration testing, where an auditor expects one, is referred to a named CREST-accredited partner and disclosed as a subcontract.