Aligned with the standards your clients and regulators expect.

Guardian is built around recognised standards, so the fundamentals are covered consistently and you have the evidence to show it.

See Guardian plans

Standards

Three frameworks, one service.

CIS Controls

The Center for Internet Security describes Implementation Group 1 as “essential cyber hygiene” for organisations with limited IT and security expertise. Guardian is aligned with it.

Cyber Essentials

Guardian’s approach is shaped by the five Cyber Essentials controls, and we can take you through certification with an independent assessor.

ISO/IEC 27001:2022

If you hold or are working towards ISO 27001, Guardian provides operating controls and monthly evidence your information security management system can use.

Guernsey licensees

The GFSC Cyber Security Rules, supported.

The Cyber Security Rules and Guidance 2021 apply to all licensees under the Regulatory Laws. Here is how Guardian supports each rule.

Rule 1.1: board responsibility and evidenceThe board is responsible and must be able to evidence compliance to the Commission.

Your monthly Guardian report gives the board a regular, dated record, including the measures the guidance suggests boards see: patching, phishing test results and incidents.

Rule 2.1: identify assets and risksIdentify material assets and assess the significant cyber risks to them.

We keep track of the accounts and devices we protect. The external footprint scan, and exposure management where needed, show where you are exposed.

Rule 3.1: protectAppropriate security software, timely IT updates, and employee training and awareness.

Email security and device protection, update status in every report, and regular training with phishing simulations, which the guidance says should be carried out regularly.

Rule 4.1: detectMechanisms to identify the occurrence of a cyber security event.

Microsoft 365 accounts are monitored on every plan, and devices 24/7 on Pro and Ultimate, with analysts investigating what is flagged.

Rule 5.1: respond, including outsourced providersA plan to mitigate disruption; where IT is outsourced, awareness of the provider’s plan.

We walk you through how we respond to incidents, so your own plan can reflect it.

Rule 6.1: recoverKnow how to restore business capability after an event.

Independent Microsoft 365 backup (Basic and above) so email and files can be restored.

Rule 7.1: notify the CommissionNotify the Commission as soon as reasonably practicable after certain events.

Our incident reports give you the facts you need to notify promptly.

Using a managed service doesn’t transfer responsibility. The Rules make the board responsible, and the guidance expects boards to keep oversight of outsourced providers. Guardian gives you the controls and the evidence; your board stays in charge.

Jersey

For JFSC-regulated firms.

The JFSC describes Cyber Essentials as likely to be a core resource for most registered persons, especially smaller and medium-sized firms.

Its Outsourcing Policy lists security operations centre and incident response services as cyber security services that need an outsourcing notification. Check with your compliance team before you start, and we’ll provide what they need.

Data protection

72 hours to report a breach.

In Guernsey and in Jersey, controllers must usually notify the data protection authority of a personal data breach within 72 hours of becoming aware of it. Fast detection and clear incident reports from us help you meet that deadline.

Sources: CIS Controls IG1; GFSC Cyber Security Rules and Guidance 2021; JFSC Outsourcing Policy; ODPA; JOIC. This page is a summary, not legal advice.

Need to show your board or regulator where you stand?

Book a short call. We’ll look at how you work today and recommend the Guardian plan that fits.