Explore our services.

LockedStack provides QSA-led PCI DSS assessments, with reporting appropriate to the agreed scope and validation route. We support Reports on Compliance (ROC), Attestations of Compliance (AOC), Self-Assessment Questionnaires (SAQs), gap analyses and targeted risk analyses. Scope, evidence requirements and deliverables are agreed at the start of the engagement.

LockedStack offers PCI 3DS as a dedicated formal assessment service. We agree the environment, applicable requirements and reporting route before assessing the relevant controls and evidence. This is a formal assessment offering, distinct from general 3-D Secure implementation advice or readiness consulting.

We assess your organisation against the NCSC’s ten areas of cybersecurity, from risk management to supply-chain security, and provide a practical roadmap for improvement.

We assess maturity against the prioritised CIS Critical Security Controls and develop a practical remediation plan. This service is separate from the NIST Cybersecurity Framework assessment.

Our readiness service covers firewalls, secure configuration, user access control, malware protection and patching. We help identify gaps and practical actions to prepare for assessment.

We assess cybersecurity maturity across Govern, Identify, Protect, Detect, Respond and Recover. Stakeholder discussions and evidence review inform current and target profiles, a structured findings report and prioritised recommendations.

We carry out risk assessments following the NIST SP 800-30 structured method, helping organisations understand risk and make informed treatment decisions.

LockedStack supports ISMS implementation, readiness and internal audit by Lead Auditors, with ISO 27002 control guidance. We help assess gaps, develop policies and improve the management system. This service supports preparation for certification; it does not offer certification by LockedStack.

We help establish risk assessment and treatment methodology aligned to ISO 27005, feeding directly into the ISO 27001 risk process.

We provide operational resilience advisory for financial entities and their critical ICT providers. Work covers ICT risk management, incident reporting and the third-party register, with findings and practical improvement actions tailored to the agreed scope.

We assess scope and applicability for products with digital elements, identify gaps against the essential requirements and support reporting readiness.

We test IT general controls over financial reporting ahead of external audit, supporting your organisation’s work relating to Sarbanes-Oxley sections 302 and 404.

We review US financial institutions’ security programmes against the GLBA Safeguards Rule, identifying gaps and practical improvements across the agreed assessment scope.

We assess US healthcare data safeguards against the HIPAA Security and Privacy Rules. Our work reviews the agreed safeguards and evidence, documenting gaps and practical recommendations.

LockedStack offers NIS2 assessment and advisory support. The applicable organisational scope, assessment criteria and deliverables are agreed with you before the engagement begins.

Virtual DPO is a separate governance service, rather than an automatic inclusion in a privacy assessment. Responsibilities, availability, reporting and engagement terms are scoped with your organisation.

Virtual CISO is a separate governance service. We agree the responsibilities, priorities, availability and reporting arrangements needed by your organisation before work begins.

We assess practices against the intent of EU GDPR, including records of processing, data protection impact assessments and data subject rights. The engagement produces an audit report against the agreed scope. Virtual DPO support is available as a separately scoped governance service.

We provide assessment and advisory work on UK data protection obligations alongside UK GDPR, including gap assessments and DPIAs. Findings are documented in an audit report against the agreed scope.

We provide assessment and guidance on the UK GDPR and PECR regime. Scope and assessment criteria are agreed before work begins, with findings and recommendations documented in an audit report.

LockedStack’s dedicated team of qualified and experienced technical security professionals performs testing of internet-facing systems. Simulated attacks identify exploitable weaknesses, with findings and remediation recommendations provided for the agreed scope.

Our dedicated technical security team tests from the perspective of an insider or compromised device. The agreed scope covers lateral movement, privilege escalation and Active Directory, with findings and remediation recommendations.

Our technical security team combines manual and automated testing of web applications and APIs, covering OWASP Top 10 issues and business-logic flaws within the agreed scope.

We validate that segmentation controls isolate the cardholder data environment and other sensitive zones. Testing scope, evidence and reporting are agreed for the environment and its assessment requirements.

LockedStack manages the scanning engagement, with quarterly external vulnerability scans performed by a PCI SSC Approved Scanning Vendor and attestation reports provided. This offering is distinct from internal vulnerability scanning and SOC monitoring.

Our technical security team provides internal vulnerability scanning across the agreed environment. Scan coverage, frequency and reporting are defined for the engagement. Continuous SOC monitoring and logging are separate managed security services.

We provide managed security awareness programmes with role-based training and phishing simulations. Reporting evidences participation and supports awareness requirements in PCI DSS, ISO 27001 and HIPAA within the agreed programme.

SOC monitoring and logging is a separately scoped managed security offering, available on enquiry. Coverage hours, log sources, response responsibilities, retention and service levels must be agreed before delivery. It is not included in ASV or internal vulnerability scanning.