Expert support, built around your organisation.

From ISO 27001 implementation to data protection reviews and cyber risk management — Principle Defence delivers consultancy that goes beyond a report and drives real, lasting change.

0 +

Years of combined expertise across the team

0 %

of UK businesses lack basic cyber skills (DCMS)

of companies struggle to fill technical and compliance privacy roles (ISACA)

Most organisations know they need better security. Few know where to start.

The pressure to demonstrate security and privacy compliance has never been greater — from regulators, clients, insurers, and supply chains. But most consultancy either produces paperwork that doesn’t reflect operational reality, or recommends products rather than solving the underlying problem.

Principle Defence was founded to do something different. We provide risk-based, justifiable guidance that fits your organisation — not a generic framework applied without thought. Our team has backgrounds in the British Army, Big 4 consultancies, boutique firms, and in-house security roles. We’ve worked across central and local government, legal, logistics, oil and gas, media, financial services, software development, and telecoms.

When security and privacy are done properly, they decrease costs, enable opportunity, and build trust. That’s what we help you achieve.

What Good Looks Like

Risk-based, not checkbox-driven
Proportionate to your size and sector
Grounded in operational reality
Aligned to your business objectives
Independently verified credentials
Delivered by practitioners, not account managers
Ongoing support, not one-and-done reports

Our Consultancy Services

We offer a comprehensive range of services across information security, data protection, cyber risk, and leadership. Every engagement is tailored — we don’t apply generic frameworks.

Information Security

ISO 27001 & Security Frameworks

Supporting organisations through ISO 27001:2022 gap analysis, ISMS design, implementation, and audit preparation. We work with first-time applicants and those maintaining existing certification.

ISO 27001:2022 gap analysis & readiness reviews
ISMS design and implementation
Internal audit support
Governance, Risk & Compliance (GRC)
IT audit and supplier security
Security engineering support

Data Protection

Privacy & GDPR Compliance

Our privacy experts have delivered engagements across government, telecoms, third sector, and legal. We help you build compliance that’s genuine, not performative — including privacy by design from the ground up.

GDPR compliance reviews & gap analysis
Data Protection Impact Assessments (DPIAs)
Privacy by Design & Privacy by Default
Records of Processing Activities (RoPA)
Privacy engineering & audit
Subprocessor and third-party reviews

Cyber Security

Cyber Essentials, IASME & Risk

As a Cyber Essentials Certification Body and IASME Cyber Assurance assessor, we support organisations through certification and help them maintain it. We also provide broader cyber risk assessments and incident response planning.

Cyber Essentials & CE Plus certification
IASME Cyber Assurance (Level 1 & 2)
Cyber risk assessments
Threat intelligence
Open Source Intelligence (OSINT)
Incident response planning

Leadership Services

Virtual CISO & Virtual DPO

For organisations that need experienced security or privacy leadership without the overhead of a full-time hire. Our vCISO and vDPO services provide expert-level strategic guidance at a fraction of the cost — with full accountability.

Virtual Chief Information Security Officer (vCISO)
Virtual Data Protection Officer (vDPO)
Security strategy development
Privacy strategy & competitive advantage
Board-level reporting and advisory
Helping win new business through security

Flexible engagement, on your terms.

We don’t operate on fixed retainers that don’t suit your needs. Our model is built around sliding-scale engagement — from a discrete project through to ongoing embedded support.

01 Discovery

We start by understanding your organisation — its size, sector, risk appetite, existing controls, and compliance obligations. No assumptions. No generic frameworks applied blindly.

02 Recommendation

We produce a clear, prioritised view of what needs to happen, why, and in what order — with honest guidance on effort, cost, and realistic timescales.

03 Delivery

We get to work alongside your team, taking as much or as little ownership as you need. We don’t hand over a report and disappear.

We recently worked with Principle Defence on our ISO 27001 audit, and the experience was outstanding from start to finish. Jim and the team demonstrated deep knowledge of the standard, guiding us through each stage with clarity and professionalism. Their practical approach made the audit feel like a genuine opportunity for improvement rather than just a compliance exercise.

Beyond Governance

ISO 27001 Audit Client

We hold the certifications we help you achieve.

Principle Defence is a Cyber Essentials Certification Body, an IASME Cyber Assurance assessor, and holds ISO 27001 and ISO 9001 certification. We’re a Crown Commercial Supplier and a member of the Eastern Cyber Resilience Centre network.

We've worked across your industry.

Our team has delivered engagements across central and local government, new space, legal, logistics, oil and gas, media, financial services, software development, telecoms, critical national infrastructure, and more.

Legal
Technology
Financial Services
Education
Critical National Infrastructure
Healthcare
Farming & Agriculture
Charity
Start-Ups & Scale-Ups

Let's talk about what you need.

Whether you’re starting from scratch, preparing for certification, or looking for ongoing security leadership — we’re ready to help.