Risk and Compliance Services

Consulting and implementation services across a range of international standards and compliance frameworks to help organisations in Bristol and South West build robust, secure, and compliant operations.

Why Compliance Matters More Than Ever

24% increase in ransomware attacks in Q2 2024, predominantly affecting UK businesses
£3.53 million, average data breach cost in the UK in 2024
50% of UK businesses experienced cyber security breaches in the last 12 months
£21 billion per year estimated cyber crime cost for UK businesses
Most targeted industries include healthcare, finance, retail, education, energy, government, and manufacturing - key sectors throughout Bristol and the South West.

How Compliance Benefits Your Business

Protects Your Business: Strengthen your security posture and reduce operational risks. Meeting industry standards like GDPR, ISO 27001, or Cyber Essentials helps you identify vulnerabilities before they become costly breaches.
Builds Customer Trust: Demonstrating a commitment to compliance builds trust with customers and stakeholders, improving your brand reputation.
Increase Operational Efficiency: Adhering to compliance standards offers benefits in terms of operational efficiency through streamlined processes, risk reduction and optimised resource allocation.
Reduces Cybersecurity Insurance Premiums: With cyber insurance costs rising, a documented compliance program demonstrates your commitment to security. Insurance providers can easily audit your processes, potentially reducing your premiums significantly.

Our Compliance Team

With over 30 years of combined experience in information security, governance, and regulatory frameworks, our compliance team helps businesses navigate complex requirements with confidence.

Amanda Anderson

Amanda has over 15 years’ experience in compliance, specialising in GDPR, information security, business governance, and legal standards. She has a proven ability to design, implement, and manage compliance programmes that align regulatory obligations with business strategy. Her expertise lies in embedding compliance into organisational culture, enabling teams to meet their responsibilities confidently while supporting operational resilience and sustainable growth. Amanda holds an LLB qualification.

Scott Anderson

Scott is a Compliance Officer with extensive experience in operations, resource management, and strategic business development. He leads initiatives that align organisational performance with industry standards, ensuring compliance across all departments and processes. He specialises in implementing ISO frameworks and streamlining cross-functional operations. Combining technical expertise with an understanding of regulatory obligations, Scott helps build resilient systems that enhance audit readiness, operational efficiency, and growth.

David Reed

David is a Senior Manager with 15+ years’ experience in Estates, Health & Safety, and Environmental Management. A NEBOSH Diploma holder and IOSH/IEMA member, he leads ISO9001 and 27001 certifications and risk management frameworks. He’s worked on major capital projects, including a healthcare Wi-Fi rollout across critical healthcare estates, coordinating subcontractors and safeguarding life-critical systems. He provides strategic direction on fire safety, environmental auditing, and planned preventive maintenance.

Key Compliance Standards We Support

ISO 27001 – Information Security Management System (ISMS)

Protect your data and strengthen your security posture with a certified Information Security Management System (ISMS).

Our services include:

Gap Analysis & Risk Assessment: Identifying weaknesses and non-conformities against ISO 27001, by assessing existing policies, controls and procedures.
ISMS Design & Implementation: Building a tailored ISMS aligned with your size, industry, and risk.
Policy & Procedure Development: Drafting and refining documentation for audit, compliance and certification.
Internal Audit & Readiness Review: An independent review of your ISMS before external certification.
Ongoing Compliance Management: Continuous support to maintain and improve your ISMS. Ongoing support to help stay compliant.

GDPR Compliance – General Data Protection Regulation

Ensure your business handles personal data lawfully, transparently, and securely under the GDPR.

Our services include:

Data Mapping & Data Protection Impact Assessments (DPIAs): Identifying and documenting how personal data flows through the company, who collects it, where it’s stored, who accesses it, and how it’s processed.
Privacy Policies & Consent Frameworks: Assisting with the development of compliant and user-friendly privacy notices and consent models.
Subject Access Request (SAR) Handling: Efficiently manage subject access requests within legal timelines.
GDPR Awareness Training: Training for employees tailored by role on the principles and practical implications of GDPR.
Ongoing DPO-as-a-Service: Outsourced DPO support to meet regulatory requirements and manage risk.

Cyber Essentials & Cyber Essentials Plus

Achieve government-backed certification to help protect against common cyber threats.

Our services include:

Pre-assessment Review: Evaluation of your controls against certification criteria.
Gap Analysis & Action Plan: Identifying gaps in systems and creating a clear, practical remediation plan.
Implementation Guidance: Support in configuring Firewalls & Internet Gateways, secure configuration of systems, User Access Control, Malware Protection, Patch Management & Software updates.
Self-Assessment Support: Assistance in completing the Cyber Essentials questionnaire and providing evidence where needed.

Cyber Essentials Plus services include:

Technical Audit Preparation: Simulate the CE+ audit to identify and fix vulnerabilities before the test.
Remediation Support: Fix identified weaknesses in firewalls, patching, access, and anti-malware.
Audit Coordination & Management: Manage the official CE+ audit with a certification body, including: external vulnerability scans, internal vulnerability assessments, testing of anti-malware, user access, and configuration controls.
Documentation & Evidence Pack: Provide an audit-ready evidence folder to support successful certification.

ISO 22301 – Business Continuity Management System (BCMS)

Keep your business running during disruptions with a robust Business Continuity Management System (BCMS).

Our services include:

Gap Analysis & Risk Assessment: Assessment of current continuity capabilities against ISO 22301. We will assess your existing policies, controls, and procedures against the standard to highlight areas of non-compliance.
BCMS Design & Implementation: We help build a scalable, industry-aligned continuity plan, tailored to the business size, industry, and regulatory environment.
Policy & Documentation Development: The drafting, reviewing, or refining of policies, procedures, and supporting documentation required for compliance and certification.
Audit Readiness Checks: An independent review of your ISMS to verify it’s operating effectively and is ready for external certification.
Ongoing Compliance Management: Once certified, the ISO 22301 will need to be maintained and continuously improved. We can provide ongoing support to help clients stay compliant and effective.

ISO 42001:2023 AI Management System (AIMS)

Adopt ethical, transparent, and secure AI practices aligned with the new ISO standard.

Our services include:

Gap Analysis & Risk Assessment: Benchmarking your AI systems against ISO 42001 requirements, assessing your AI governance framework, controls, and processes.
AIMS Design & Implementation: Assistance in building a fully compliant Artificial Intelligence Management System (AIMS) tailored to the business’s size, sector, and AI maturity level.
AI Policy & Procedure Development: Developing and refining policies and procedures that support the ethical, legal, and secure use of AI technologies in line with ISO 42001.
Internal Audit & Certification Readiness: An independent review of the AI Management System to ensure it is operating effectively and is prepared for external certification.
Ongoing Compliance Management: Post-certification, ISO 42001 requires continuous monitoring, review, and adaptation of the AIMS. We provide long-term support to help clients maintain and improve their AI governance practices

Simplify compliance. Reduce risk. Stay audit-ready.

Impact IT Solutions’ end-to-end Compliance as a Service (CaaS) helps your business meet and maintain regulatory and certification requirements across data protection, information security, business continuity, AI governance, and cybersecurity standards.

Whether you’re seeking certification, preparing for an audit, or managing ongoing compliance, we provide the tools, expertise, and support to keep you on track.

Ongoing Compliance, Built-In

Most providers help you pass an audit. We go further.

Our CaaS offering ensures your business remains compliant all year round with automated monitoring, policy upkeep, risk reporting, and hands-on expert support. It’s compliance as a service, not a one-time checklist.

Contact us to learn how we can help reduce your risk, save time, and achieve certification with confidence.

How We Work

With decades of experience in IT, security and transformation, Impact IT Solutions is your partner for your entire compliance & IT journey.

Discover & Assess

We take time to thoroughly understand your business, review your existing policies and identify compliance gaps against UK and global standards.

Evaluate & Prioritise

We rank risks by impact and likelihood, focusing on the actions that will protect your operations first.

Plan & Implement

We create a practical, step-by-step compliance roadmap with timelines, responsibilities, and tailored solutions — then put it into action.

Monitor & Improve

We track progress, report results, and provide clear recommendations for ongoing compliance and future regulatory updates.

What's Included

Gap Assessment and Onboarding

Initial review of current controls, risks, and regulatory requirements
Tailored compliance roadmap

Policy and Process Management

Ready to use templates (GDPR, security policies and more)
Ongoing review and update service

Real Time Monitoring and Alerts

Compliance dashboard
Risk scoring and control status tracking

Audit-Readiness and Reporting

Document pack generation
Support with external audits or client due diligence

Continuous Improvement

Quarterly reviews
New regulation alerts and adaptation support

Our Design & Development Process

We take a strategic, people-first approach, combining insight, creativity, and technology to deliver websites that drive real results. Here’s how we bring your vision to life:

Gap Assessment and Onboarding

Initial review of current controls, risks, and regulatory requirements
Tailored compliance roadmap

Policy and Process Management

Ready to use templates (GDPR, security policies and more)
Ongoing review and update service

Real Time Monitoring and Alerts

Compliance dashboard
Risk scoring and control status tracking

Audit-Readiness and Reporting

Document pack generation
Support with external audits or client due diligence

Continuous Improvement

Quarterly reviews
New regulation alerts and adaptation support

Ready to Get Started?

Take the stress out of compliance. Book a discovery call today to explore how we can help you simplify your operations and keep you one step ahead of regulators, auditors, and clients.