AI-native startups
- ISO 27001usuallyusually
- ISO 42001usuallyusually
- SOC 2sometimessometimes
- Cyber Essentials and Plussometimessometimes
SECTORS
Six sectors. One question in each: who is asking, and for what?
Every sector Goldline works in has a gate: a customer questionnaire, a procurement framework, an investor's diligence list or a defence contract clause. The page below says what each gate usually asks for, and the fixed-price step that answers it.
Which gate is in front of you?
SaaS and software scaleups
- ISO 27001usuallyusually
- ISO 42001sometimessometimes
- SOC 2usuallyusually
- Cyber Essentials and Plussometimessometimes
Public sector suppliers
- ISO 27001usuallyusually
- Cyber Essentials and Plususuallyusually
Defence supply chain
- ISO 27001usuallyusually
- Cyber Essentials and Plususuallyusually
- DCCusuallyusually
Health and care technology
- ISO 27001usuallyusually
- ISO 42001sometimessometimes
- Cyber Essentials and Plususuallyusually
Financial services suppliers
- ISO 27001usuallyusually
- ISO 42001sometimessometimes
- SOC 2usuallyusually
- Cyber Essentials and Plussometimessometimes
Which standard a given buyer asks for is set by that buyer. The diagnostic reads the actual clause, questionnaire or listing before anything is scoped.
Six sectors, six starting points
For AI companies
AI-native startups
Companies under 50 people shipping a product built on AI, selling to enterprise or public sector buyers.
What they are asked for
- An AI governance answer in the security questionnaire
- ISO 27001 as the baseline and ISO 42001 as the AI half
- Evidence of who approves and who can override a model decision
SaaS and software scaleups
UK software companies at the point where enterprise procurement starts asking.
What they are asked for
- ISO 27001 for UK and EU buyers
- SOC 2 for US buyers
- A completed questionnaire before the contract moves
Public sector suppliers
Suppliers listing on G-Cloud and other frameworks, and suppliers to local authorities and central government.
What they are asked for
- Cyber Essentials or Cyber Essentials Plus on the listing
- ISO 27001 for larger lots and for information handling
- A security questionnaire from the buying authority
Defence supply chain
Tier 2 and Tier 3 suppliers to UK primes and the MoD.
What they are asked for
- JOSCAR and prime contractor flow-downs
- Defence Cyber Certification, which the MoD has asked suppliers to hold at Level 0 by 31 December 2026
- ISO 27001 where the contract requires it
Goldline prepares; an independent DCC certification body assesses.
Health and care technology
Suppliers to the NHS and to care providers, including AI-assisted products.
What they are asked for
- The Data Security and Protection Toolkit
- ISO 27001 for data handling
- ISO 42001 where the product makes or supports clinical or operational decisions
Start here
ISO 27001 Sprint £7,000Financial services suppliers
Fintech and the firms that supply regulated financial institutions.
What they are asked for
- SOC 2 and ISO 27001 in supplier due diligence
- Evidence of operational resilience from the firms they sell to
- A questionnaire before onboarding
What is the same in every sector.
The person who scopes it delivers it
A boundary agreed in writing before anything is built
Fixed prices, published, confirmed after scoping
An independent body certifies. Goldline never audits a system it built.
Trusted by
Bring the questionnaire, the clause or the listing.
45 minutes with the practitioner. A one-page roadmap, yours either way.
Based in Leicestershire? Start here.