Sector knowledge is the difference between a finding and a fix.
A control that works in a SaaS company can be unworkable in a hospital or a substation. We start from each sector’s regulation and the way it actually operates.
Eight sectors. One standard.
Each page sets out what is at stake, the rules that apply and how we respond.
-
01Banking & Financial ServicesCritical services must stay within impact tolerance through severe but plausible scenarios.Explore
-
02FinTech & PaymentsVolume growth turns a self-assessment into a full Report on Compliance.Explore
-
03Technology & SaaSBuyers expect a current SOC 2 Type II report and recent testing before they sign.Explore
-
04Cloud & AI CompaniesCustomers rely on your SOC reports and responsibility matrices.Explore
-
05Healthcare & Life SciencesRansomware that takes down records or imaging diverts patients.Explore
-
06Government & Public SectorSystems need formal authorization, then continuous monitoring.Explore
-
07Retail & E-CommerceClient-side skimming captures card data inside the shopper’s browser.Explore
-
08Critical Infrastructure & EnergyIn OT, testing must never disturb physical processes.Explore
Four shifts we see everywhere.
The specifics differ by industry. These patterns recur in almost every engagement.
- 01
Third parties are the perimeter
Supervisors now ask for dependency maps and exit plans, not vendor questionnaires.
- 02
AI arrives before its governance
Models and agents are deployed faster than inventories and testing can follow.
- 03
Regulation converges without getting simpler
DORA, NIS2, NYDFS and CIRCIA share themes but differ in scope and detail.
- 04
Resilience is measured in recovery
Boards have stopped asking “can we prevent it?” They now ask “can we restore within tolerance?”
Where our core services apply.
A starting point for each sector. Most clients combine several.
| Industry | PCI DSS | DORA / NIS2 | SOC 1 / 2 | ISO 27001 | ISO 42001 | FedRAMP | HITRUST | Pen testing |
|---|---|---|---|---|---|---|---|---|
| Banking & Financial Services | Frequently requested | Frequently requested | Sometimes requested | Frequently requested | Sometimes requested | Rarely | Rarely | Frequently requested |
| FinTech & Payments | Frequently requested | Frequently requested | Frequently requested | Sometimes requested | Sometimes requested | Rarely | Rarely | Frequently requested |
| Technology & SaaS | Sometimes requested | Sometimes requested | Frequently requested | Frequently requested | Sometimes requested | Sometimes requested | Sometimes requested | Frequently requested |
| Cloud & AI Companies | Sometimes requested | Frequently requested | Frequently requested | Frequently requested | Frequently requested | Frequently requested | Sometimes requested | Frequently requested |
| Healthcare & Life Sciences | Sometimes requested | Sometimes requested | Frequently requested | Sometimes requested | Sometimes requested | Rarely | Frequently requested | Frequently requested |
| Government & Public Sector | Rarely | Sometimes requested | Sometimes requested | Sometimes requested | Sometimes requested | Frequently requested | Rarely | Frequently requested |
| Retail & E-Commerce | Frequently requested | Sometimes requested | Sometimes requested | Sometimes requested | Rarely | Rarely | Rarely | Frequently requested |
| Critical Infrastructure & Energy | Rarely | Frequently requested | Rarely | Frequently requested | Rarely | Rarely | Rarely | Frequently requested |
Frequently requested Sometimes requested
Your sector has its own hard questions.
Tell us your industry, your regulators and your deadline. A senior practitioner will set out exactly how we would approach it.




