Digital, physical and resilience, from one independent consultancy. Every piece of work is scoped in writing first and ends in a written deliverable.
An independent look at your organisation's security: physical, digital or both. Findings and priorities in writing, so you know what to fix first.
On-site visits are quoted with travel.
Your domain, email, accounts and devices, seen the way an outsider sees them, then put right.
What an outsider can see of your organisation online: domain and DNS, email authentication, certificates, exposed services and credentials in known breaches. Your organisation's own footprint, never individuals.
You getA written report with a severity table, a fix list in priority order and a call to walk through it. If it finds nothing worth fixing, there is no charge.
SPF, DKIM and DMARC taken to enforcement, so no one else can send as you. Registrar, DNS and certificates locked down.
You getA written review of your domain and mail set-up, the exact records to publish, and a check once they are in.
The settings that matter: sign-in and multi-factor authentication, admin roles, sharing, forwarding rules, audit logs and recovery. Done with read-only access you grant.
You getA written report of each setting against a sound baseline, with the change to make and who makes it.
Working through the fix list with you or your IT provider: multi-factor authentication, email authentication, tested backups, a device baseline and safer remote access. Help preparing the Cyber Essentials self-assessment; the certificate is issued by a certification body, not by Northwatch.
You getA written record of each change and how it was checked.
A re-review each quarter against the previous report, so drift and new exposure are caught early.
You getA short written report each quarter, with what changed since the last one.
| Area | What is checked |
|---|---|
| Domain and DNS | Registrar, nameservers, every record, subdomains in certificate logs, forgotten hosts |
| Email authentication | SPF, DKIM and DMARC: present, strict, and whether anyone can send as your domain |
| TLS | Certificates, expiry and protocol versions |
| Web security headers | What your website sends |
| Exposed services | What answers on your public addresses |
| Credentials in known breaches | Addresses on your domain in published breach data |
Everything from outside, within a written scope, with written authorisation from someone entitled to give it. No exploitation, no social engineering, nothing inside your network. Breach findings list the address and the source breach, never a password. The report follows within five working days of the agreed dates.
Your premises, your staff and your events. We assess and advise; we don't install equipment or supply staff, so the advice has nothing to sell.
A walk-round of your site, after dark too if it matters: perimeter, entrances, doors and locks, access control, alarms, CCTV coverage, lighting, reception and how visitors are handled.
You getA written report with annotated photographs, and a fix list in priority order saying what each fix involves.
What you need, where it goes and how it should be run, including the data protection side of CCTV. We sell and install nothing, so the advice is independent.
You getA written specification to give installers, and a review of their quotes if you want one.
For staff who work alone, visit clients at home, or open and lock up: a practical plan and a check-in routine that people will actually use.
You getA written plan and procedure, and a short briefing for the staff it covers.
Before staff travel for work: the risks at the destination, what to do about them, and who to call if something goes wrong.
You getA written briefing for the trip and a one-page card for each traveller.
For events and venues: risks, layout, entry arrangements, crowd and emergency plans, and what licensed staff you need, if any. Including helping you prepare for the Terrorism (Protection of Premises) Act 2025 (Martyn's Law), which the Security Industry Authority regulates.
You getA written event security plan to share with your venue, organisers and any security contractor.
We advise; we don't supply officers. Guarding, door supervision, close protection, key holding and public-space CCTV monitoring need staff licensed by the Security Industry Authority: we advise on what you need and can recommend licensed providers.
The written plans and habits that keep an organisation steady when something goes wrong.
Why it matters: security is continuity.
A short, usable set written for how you actually work: information security, acceptable use, access, visitors, clear desk and reporting.
You getThe written policies and procedures, ready to adopt, with an owner named for each.
What happens when an account is taken over, a laptop goes missing, the office is out of use or the systems are down.
You getA written incident response plan and a continuity plan, tested with your staff in a tabletop exercise.
Sessions for your staff, in person or online: phishing and payment fraud, passwords and multi-factor authentication, tailgating, visitors and personal safety.
You getThe session, written notes for everyone who attended, and a one-page guide to keep.
Ask about an assessment Book a 20-minute call
The call button opens an email asking for three times that suit you. Or use the contact form, or email hello@northwatchgroup.com.