What your Scottish customers work to

Seven instruments worth knowing by name

• Scottish Public Sector Cyber Resilience Framework v2.0 (December 2024). The standard Scottish public bodies measure themselves against. When they ask about your controls, this is usually the lens.
• Cyber security: guidance for public sector suppliers (December 2023). A consistent, risk-based approach to supplier cyber security across the Scottish public sector. Expect proportionate questions, and more of them where your contract carries more risk.
• Cyber Resilient Scotland 2025 to 2030 (strategic framework November 2025; action plan February 2026). The national direction of travel, and a useful frame for a board paper.
• Scottish Cyber Coordination Centre (SC3). Coordinates the response to cyber incidents affecting Scotland’s public sector. If you run a service for a public body, your incident plan should say how you would work with your customer when SC3 is involved.
• Freedom of Information (Scotland) Act 2002. Scottish public authorities answer to the Scottish Information Commissioner for FOI, not the ICO. What you tell them, including security answers, may be requested, so mark what is commercially sensitive and say why.
• Procurement Reform (Scotland) Act 2014. Scottish public bodies buy under Scottish procurement law; the Procurement Act 2023 regime used in England does not apply to devolved Scottish authorities.
• Scottish Languages Act 2025 (in force 30 November 2025). Gives Gaelic and Scots official status in Scotland. Its duties fall on public bodies rather than private suppliers, but public-sector customers increasingly ask what language provision you can support.

Who we work with

Organisations that have started being asked questions

• Financial services and fintech in Edinburgh and Glasgow: operational resilience, third-party risk and AI use that will stand up to a regulator or a bank’s due diligence.
• Energy and its supply chain: the engineering, OT and services firms around operators, where a supplier’s weakness becomes the operator’s incident.
• Universities, colleges and research groups: research data, open networks, and staff adopting AI tools faster than policy can follow.
• Suppliers to the Scottish public sector: software, managed service and professional services firms answering supplier cyber questions in tenders.
• Growing businesses whose customer, insurer or investor has started asking questions nobody inside can answer.

What this looks like in practice

Four Scottish scenarios

These are illustrative scenarios, not client stories. We do not publish client work.

A Glasgow software supplier and a council tender. A 40-person firm is shortlisted for a council contract and receives a supplier cyber questionnaire it has never seen before. We assess it against our published control set, show which answers it can evidence today, and help it answer the two it cannot honestly, with a dated plan. “Not yet, by March” scores better than a claim that falls apart at contract award.

An Aberdeen engineering services firm. An operator asks its OT maintenance contractor for evidence of remote-access controls after an industry incident. A focused independent assessment of remote access, supplier accounts and incident escalation produces a one-page report the operator’s security team can accept.

An Edinburgh fintech rolling out AI. Staff are already using AI assistants on customer correspondence. The board would rather approve a short list than ban everything. Our AI deployment review gives it the list, the data rules and a record of the decision.

A university research group. A team holds participant interview data and wants to use AI transcription. We set out what the ethics approval, the data protection impact assessment and the tool’s terms each need to say, and where they currently contradict one another.

How we help

The same services, with Scottish context built in

• Independent assessment against our 36-control set, reported on one page, like our sample board report.
• Board and executive sessions on cyber and AI accountability.
• Tabletop exercises built around a realistic Scottish incident, including the call to your public-sector customer.
• AI deployment review and Microsoft 365 Copilot readiness.
• Virtual CISO and DPO support for organisations without a full-time security or privacy lead.

We work remotely across Scotland, and on site where the work needs it.

Sgrìobhainnean Gàidhlig

Sgrìobhainnean ann an Gàidhlig do luchd-obrach agus don phoball

Faodaidh sinn na sgrìobhainnean a leughas an luchd-obrach agaibh agus am poball a chur air dòigh ann an Gàidhlig. Bho 30 Samhain 2025, tha inbhe oifigeil aig a’ Ghàidhlig ann an Alba fo Achd nan Cànan Albannach 2025, agus tha buidhnean poblach a’ faighneachd barrachd mu sholarachadh cànain bho na solaraichean aca.

• Stiùireadh do luchd-obrach: mar a dh’innseas iad mu thachartas
• Fios prìobhaideachd
• Litir gu daoine air a bheil briseadh dàta a’ toirt buaidh (Artaigil 34, UK GDPR)
• Poileasaidh cleachdaidh iomchaidh do luchd-obrach
• Geàrr-chunntas don bhòrd

Tha sinn a’ moladh tòiseachadh le aon sgrìobhainn, mar as trice an stiùireadh air tachartasan, agus barrachd a chur ris dìreach ma thèid a chleachdadh.

Tha na comhairlichean againn ag obair ann am Beurla. Tha sgrìobhainnean Gàidhlig air an eadar-theangachadh le eadar-theangair proifeasanta daonna. Chan eil sinn a’ cleachdadh eadar-theangachadh inneil airson sgrìobhainnean riaghlaidh. Tha fàilte oirbh sgrìobhadh thugainn ann an Gàidhlig; thoiribh beagan a bharrachd ùine dhuinn airson freagairt.

Bruidhinn rinn mu sgrìobhainnean Gàidhlig

In English: we can arrange Scottish Gaelic versions of the documents staff and the public read, translated by a qualified human translator. Start with one, usually incident-reporting instructions, and add more only if it is used.

Honesty about language

What we do, and what we do not claim

• Our advisers work in English. Gaelic documents are drafted by us in English and translated by a qualified human translator commissioned for the work, subject to availability. We will confirm the translator and timescale before you commit.
• We do not use machine translation for regulatory documents. Where a document quotes legislation, the authoritative English text sits alongside the Gaelic.
• Gaelic and Scots are different languages. If your audience reads Scots, tell us and we will say plainly whether we can support it.