Services
Security and compliance services
Find a test, a standard or a regulation. Each page says what it asks of you, what we do and where our role ends.
/
41 services
Offensive security
Penetration tests and assessments that simulate the attack vectors you actually face.
- Penetration TestingTestPenetration testing by Black Fox Security: black, grey and white box tests against an agreed scope, business and technical reports, and a retest of your fixes.pentestpen testpenetration test
- Mobile App Security TestingTestMobile app security testing by Black Fox Security: your iOS and Android apps and the APIs behind them, tested in an agreed scope, with reports and a retest.mobile pentestmobile app pentestiOS security testing
- IoT Security TestingTestIoT security testing by Black Fox Security: device, firmware, companion app, cloud backend and update process, tested as one product, with reports and a retest.IoT security testingIoT pentestembedded security
- RF and Wireless TestingTestRF and wireless testing by Black Fox Security: your Wi-Fi, Bluetooth, sub-GHz links and access cards, assessed under written authorisation and radio rules.wireless pentestWi-Fi securityWLAN
- Physical Security TestingTestPhysical security testing by Black Fox Security: an authorised on-site review of access control, reception, staff awareness, clean desk and server rooms.physical securityphysical penetration teston-site assessment
Compliance and certification
Readiness for the standards, attestations and regulations your clients and regulators ask about. Be prepared for the official auditors.
- ISO/IEC 27001Standard / ISO/IEC 27001:2022ISO/IEC 27001 support from Black Fox Security: ISMS scoping, risk assessment, Statement of Applicability, internal audit and certification audit preparation.ISO 27001ISO27001ISMS
- ISO/IEC 27701StandardISO/IEC 27701 support from Black Fox Security: PIMS scoping, controller and processor roles, privacy risk, records of processing and certification preparation.ISO 27701ISO27701PIMS
- ISO 22301Standard / ISO 22301:2019ISO 22301 support from Black Fox Security: BCMS scoping, business impact analysis, continuity strategies, plans, exercises and certification audit preparation.ISO 22301BCMSbusiness continuity
- ISO/IEC 42001Standard / ISO/IEC 42001:2023ISO/IEC 42001 support from Black Fox Security: AIMS scoping, AI risk and impact assessment, Annex A controls, internal audit and certification audit preparation.ISO 42001ISO42001AIMS
- ISO/IEC 27017 and 27018StandardISO/IEC 27017 and 27018 support from Black Fox Security: cloud control gap assessment, shared responsibility, PII processor controls and audit preparation.ISO 27017ISO 27018cloud security
- SOC 2AttestationSOC 2 readiness from Black Fox Security: Trust Services Criteria scoping, gap assessment, control design and evidence preparation for your CPA firm's examination.SOC 2SOC2SOC 2 Type 1
- SOC 1AttestationSOC 1 readiness from Black Fox Security: control objectives, IT general controls, gap assessment, control design and evidence preparation for your CPA firm.SOC 1SOC1SOC 1 Type 1
- PCI DSSStandardPCI DSS support from Black Fox Security: scoping and segmentation, gap assessment, SAQ support, penetration and segmentation testing, and evidence for your assessor.PCI DSSPCIPCI compliance
- TISAXStandardTISAX preparation from Black Fox Security: assessment objectives, VDA ISA self-assessment, gap closure, prototype protection and support during the assessment.TISAXVDA ISAENX
- Cyber EssentialsStandardCyber Essentials and Cyber Essentials Plus preparation from Black Fox Security: scoping, the five technical controls, gap closure and readiness for the assessor.Cyber EssentialsCyber Essentials PlusCE+
- BSI IT-GrundschutzFrameworkBSI IT-Grundschutz support from Black Fox Security: structure analysis, protection needs, modelling, IT-Grundschutz check, gap closure and certification preparation.IT-GrundschutzBSIBSI standards
- NIS2Regulation / Directive (EU) 2022/2555NIS2 support from Black Fox Security: applicability check, gap assessment against the risk-management measures, incident reporting, supply chain and training.NIS2NIS 2NIS2 Directive
- DORARegulation / Regulation (EU) 2022/2554DORA support from Black Fox Security: ICT risk management gap assessment, incident reporting, digital operational resilience testing and ICT third-party risk.DORADigital Operational Resilience ActRegulation (EU) 2022/2554
- GDPRRegulation / Regulation (EU) 2016/679GDPR support from Black Fox Security: records of processing, DPIAs, security of processing, processor agreements, breach handling and data subject requests.GDPRGeneral Data Protection RegulationRegulation (EU) 2016/679
- EU Cyber Resilience ActRegulation / Regulation (EU) 2024/2847Cyber Resilience Act support from Black Fox Security: essential requirements gap assessment, product security testing, vulnerability handling and documentation.Cyber Resilience ActCRARegulation (EU) 2024/2847
- EU AI ActRegulation / Regulation (EU) 2024/1689EU AI Act support from Black Fox Security: AI system inventory, risk classification, governance and documentation for high-risk systems, and security testing.EU AI ActAI ActArtificial Intelligence Act
- HIPAARegulationHIPAA support from Black Fox Security: Security Rule risk analysis, administrative, physical and technical safeguards, business associates and testing.HIPAAHIPAA Security RuleePHI
Governance and risk
Audits, risk assessments, frameworks and policies that show where you stand and what to do next.
- Information security auditServiceIndependent information security audits from Black Fox Security against ISO/IEC 27001, 27002, GDPR, PCI DSS, your own policies or a client's questionnaire.security auditIT auditISO 27001 internal audit
- Security risk assessmentServiceInfrastructure, network and application risk assessment by Black Fox Security: probability versus severity, a risk register your owners use and treatment options.risk assessmentIT risk assessmentrisk register
- NIST Cybersecurity FrameworkFramework / NIST CSF 2.0NIST CSF 2.0 support from Black Fox Security: current and target profiles across Govern, Identify, Protect, Detect, Respond and Recover, and a plan to close the gap.NIST CSFNIST Cybersecurity FrameworkCSF 2.0
- CIS ControlsFrameworkCIS Controls assessment and implementation by Black Fox Security: pick your implementation group, measure each safeguard and fix the ones that matter first.CIS ControlsCIS Critical Security ControlsCIS 18
- COBITFrameworkCOBIT support from Black Fox Security: a governance system for enterprise IT, governance and management objectives, capability assessment and ISO and NIST mapping.COBITCOBIT 2019ISACA
- Policies and proceduresServiceBlack Fox Security writes and reviews your security policies: acceptable use, access control, incident response, suppliers, backup and more, in plain language.security policyinformation security policyacceptable use policy
- Third-party risk managementServiceSupplier risk management from Black Fox Security: inventory, tiering, questionnaires, evidence review and contract clauses, aligned with NIS2 and DORA expectations.TPRMthird-party riskvendor risk management
- Business continuity and disaster recoveryServiceBCP and DRP from Black Fox Security: business impact analysis, continuity and recovery plans, backup and restore testing and tabletop exercises that test the plan.BCPDRPBCDR
Managed security
Recurring work that keeps your security and compliance from decaying between audits.
- Vulnerability managementServiceRecurring vulnerability reviews from Black Fox Security: scanning, triage, prioritisation by exploitability and exposure, fix tracking and trend reporting.vulnerability managementvulnerability scanningvulnerability assessment
- Security hardeningServiceSecurity hardening by Black Fox Security: endpoint, server and network hardening, secure configuration baselines, monitoring setup and personal security.security hardeningsystem hardeningserver hardening
- Access reviewsServicePeriodic access reviews by Black Fox Security: user and privileged access across directories, cloud and key applications, joiners and leavers, audit evidence.access reviewuser access reviewUAR
- Continuous complianceServiceContinuous compliance from Black Fox Security: evidence calendar, internal audits, control testing, policy reviews and surveillance audit support.continuous compliancecompliance managementsurveillance audit
Advisory and response
A security lead when you need one, answers when something has happened, and training for the people who keep you safe.
- Virtual CISOServiceA virtual CISO from Black Fox Security: security strategy and roadmap, board reporting, policy ownership, audits and customer security questionnaires.virtual CISOvCISOfractional CISO
- Digital forensics and incident responseServiceDFIR from Black Fox Security: incident post-mortems, network and storage forensics, reverse engineering, data recovery, response plans and tabletop exercises.DFIRdigital forensicsincident response
- Security awareness trainingServiceTraining from Black Fox Security: security and social engineering awareness, incident response and DevSecOps, for staff, developers and management.security awareness trainingcybersecurity trainingphishing awareness
- Cyber hygiene trainingServicePractical cyber hygiene training from Black Fox Security: passwords, MFA, phishing, updates, data handling and remote work, tailored to your tools.cyber hygiene trainingsecurity basics trainingpassword manager training
- Secure coding trainingServiceSecure coding training from Black Fox Security: OWASP Top 10 vulnerability classes, secure design and code review, and security tests, in your team's stack.secure coding trainingsecure development trainingOWASP Top 10 training
- DevSecOps trainingServiceHands-on DevSecOps training from Black Fox Security: CI/CD security, infrastructure as code, containers, cloud, supply chain, secrets and threat modelling.DevSecOps trainingCI/CD security traininginfrastructure as code security
- DevSecOps and secure developmentServiceDevSecOps from Black Fox Security: secure SDLC, threat modelling, code review, security in CI/CD, dependency and secret scanning, and developer training.DevSecOpssecure SDLCSSDLC
Not on the list?
We work with many frameworks and can adapt to a custom one. Tell us what you need to meet.