The honest gap list.
Costed in engineer-days.

The best fit for this service anywhere. SOC 2 is a binary sales gate, 15,000–20,000 reports are issued a year, and California's CPPA cybersecurity audit and risk-assessment regulations took effect 1 January 2026 — with pre-2026 risk assessments due 31 December 2027 and the first audit certifications 1 April 2028.

The CPPA regime carries the same independence structure as SOC 2: the auditor cannot perform the remediation. NYDFS Part 500 fully phased in November 2025.

ISO 27001:2022 is the usual target, and the 2013 certificates expired on 31 October 2025 — which has pushed a re-certification wave through 2026. Cyber Essentials readiness is a separate service, because the Danzell question set is a different scope.

We are not an IASME-licensed certification body and cannot issue a Cyber Essentials certificate. We do not take UK public-sector work: it requires contractual UK data residency, SC clearance and CE Plus under G-Cloud 15, none of which offshore delivery can satisfy.

NIS2 has no certification and no accredited auditor, so ISO 27001 is the de facto evidence artefact — and there is no independence barrier on any of the work.

Twenty-seven national regimes, fragmented: the Commission referred Ireland, Spain, France and the Netherlands to the CJEU on 8 July 2026 for failure to transpose. We deliver in English only, and NIS2 buying often happens in German, French, Italian, Dutch or Spanish.

Full scope on the mainland. NESA / UAE IA runs to 188 controls — 60 management, 128 technical — and DESC ISR v3 adds thirteen domains on top of ISO 27001:2022.

Where the client is a DIFC or ADGM entity, the free zones are as strict as the EU on transfers and neither lists India as adequate. Saudi Arabia we take only as pull-through from a UAE client, under the UAE contract — NCA ECC-2 effectively requires an in-Kingdom presence.

No, and we legally cannot be. Only a licensed CPA firm can attest SOC 2, and only a UKAS- or ANAB-accredited body can certify ISO 27001 — and that body is barred from certifying anyone it consulted. That independence wall is precisely why the readiness and implementation work is available to us at all.

No. We receive no fee, commission, rebate or other consideration from any auditor or certification body we refer you to, and we confirm that in writing to both you and them. You contract with them directly.

That is the fair objection, and the answer is built into the terms: the assessment fee is credited in full against any remediation work, and the findings register is yours in machine-readable form to take to any provider, including your incumbent. We'll hand it over and brief them at no charge.

Vanta tells you a control is failing and generates guidance. It does not tell you what it costs to fix, in what order, or which findings actually block your audit. If your dashboard is red and nobody on your team knows what to do about it, that gap is what this closes.

Not yet. We are working toward ISO 27001 certification of withRemote itself, and we publish the scope statement, certification body and stage dates as they land. You will find it here before you find it in a vendor questionnaire.

It is not an audit, an attestation, a certificate or an assurance opinion, and those words appear nowhere in the deliverable. We design and hand over controls; we do not operate them, sign them off, or accept the residual risk. Penetration testing, where an auditor expects one, is referred to a named CREST-accredited partner and disclosed as a subcontract.