Frameworks · LakeHouse Intelligence

Built for you

Your group standard

The standard you set for your own group, built from your platform company and the frameworks you need.

Who needs itEvery buy-and-build group.

Before you buy

What we check in the target

Each target scored against it
The gap to your platform company, in numbers
What it would take to bring the company in line

After you buy

What we fix

Fixes that bring the company onto the standard
Moved onto the group's systems where it makes sense

Every month

What we keep an eye on

Each company's progress on the group dashboard
Drift flagged as soon as it appears

Readiness

SOC 2

The US standard for how a service company protects its customers' data, assessed against five trust criteria.

Who needs itSoftware and service companies selling to US customers.

Before you buy

What we check in the target

Access reviews, MFA and leavers
How code changes are approved
Suppliers, logging and incident response
Evidence gaps against the criteria

After you buy

What we fix

Missing controls and policies put in place
Evidence collected automatically
Ready for the auditor's first report

Every month

What we keep an eye on

Controls re-tested
Evidence kept current for the auditor

Readiness

ISO 27001

The international standard for running information security as a managed system, with 93 controls in the 2022 version.

Who needs itCompanies selling to large customers or the public sector.

Before you buy

What we check in the target

Scope and risk register
Controls mapped against what is in the systems
Asset list and supplier security

After you buy

What we fix

Statement of applicability and policies
Controls in place, internal audit done
Ready for the certification audit

Every month

What we keep an eye on

Controls checked
Risk register kept current for surveillance audits

and Plus

Cyber Essentials

The UK government scheme covering five technical controls: firewalls, secure settings, user access, malware protection and patching.

Who needs itUK companies bidding for public work, and a baseline for any UK business.

Before you buy

What we check in the target

Unpatched devices and unsupported software
Admin rights and MFA on cloud services
Firewall and device settings

After you buy

What we fix

Gaps closed
Ready for the assessment and the Plus test

Every month

What we keep an eye on

Patch levels and devices checked
New gaps flagged before renewal

Data protection

UK and EU GDPR

The rules for holding personal data about people in the UK and the EU.

Who needs itAny company that holds personal data.

Before you buy

What we check in the target

Where personal data sits and who can reach it
Files shared by public link
Records of processing and supplier contracts
Data kept longer than it should be

After you buy

What we fix

Access tightened and old data deleted
Records and contracts in place

Every month

What we keep an eye on

New exposure flagged
Retention rules enforced

Version 8

CIS Controls

Eighteen prioritised security safeguards, often used by insurers as a practical baseline.

Who needs itAny company that wants a clear, practical baseline.

Before you buy

What we check in the target

Hardware and software inventory
Account management
Backups and data recovery

After you buy

What we fix

The first group of safeguards in place
Backups tested

Every month

What we keep an eye on

Inventories and backups checked

Version 2.0

NIST CSF

A US framework that rates security across six functions: govern, identify, protect, detect, respond and recover.

Who needs itUS-facing companies, and groups that want one common language across companies.

Before you buy

What we check in the target

Maturity in each function
The gaps to your target level

After you buy

What we fix

A roadmap to the target level
The first gaps closed

Every month

What we keep an eye on

Each company's level tracked across the group

ISO 42001

The international standard for managing AI responsibly.

Who needs itCompanies that build AI into their product or rely on it.

Before you buy

What we check in the target

Where AI is used and on what data
How AI risk is assessed and overseen

After you buy

What we fix

AI policy and an inventory of AI use
Impact assessments in place

Every month

What we keep an eye on

New AI use flagged

Version 4.0

PCI DSS

The card industry's security standard for anyone who takes or stores card payments.

Who needs itCompanies that take card payments.

Before you buy

What we check in the target

Where card data flows
How payments are set up with the provider
Who can reach card data

After you buy

What we fix

Scope reduced
Self-assessment ready

Every month

What we keep an eye on

Scope creep flagged

NIS2

The EU directive on security for essential and important companies, including many digital providers.

Who needs itMid-size and larger companies in covered sectors operating in the EU.

Before you buy

What we check in the target

Whether the company is in scope
Risk management and supply chain security
Readiness to report an incident within 24 hours

After you buy

What we fix

Measures and the reporting process in place
Management responsibilities set out

Every month

What we keep an eye on

Controls and reporting readiness checked

EU finance

DORA

The EU act on digital resilience for financial companies and their key technology suppliers.

Who needs itFintech, financial services and the technology companies that serve them.

Before you buy

What we check in the target

The ICT risk framework
Incident classification and reporting
The register of technology suppliers

After you buy

What we fix

Supplier register and incident process in place
A resilience testing plan

Every month

What we keep an eye on

Know where a company stands on every framework before you buy.

Before you buy

After you buy

Every month

Before you buy

After you buy

Every month

Before you buy

After you buy

Every month

Before you buy

After you buy

Every month

Before you buy

After you buy

Every month

Before you buy

After you buy

Every month

Before you buy

After you buy

Every month

Before you buy

After you buy

Every month

Before you buy

After you buy

Every month

Before you buy

After you buy

Every month

Before you buy

After you buy

Every month

See it on one of your own deals.