Your first framework builds the foundations for the rest. Controls are cross-mapped, so evidence you add once counts everywhere it applies.
The Data Security and Protection Toolkit every NHS supplier publishes against each year. Naq keeps the standards met between submissions.
The assessment criteria for any digital product entering the NHS. Version 2 went live in February 2026; Naq holds the current form complete.
The clinical safety standard for health IT manufacturers. Hazard log and safety case in one record, flagged for CSO sign-off on every change.
The information security standard enterprise procurement asks for first. Ready for every surveillance audit, not just the first one.
Quality management, built on the controls you already hold for 27001. Shared clauses count once.
The NCSC baseline for UK public-sector contracts. Renewed before it expires, with Plus when the buyer asks.
A living Article 30 record, DPIAs drafted from it, and a DSAR register your Assistant can answer from.
The security report US enterprise buyers ask for. Naq keeps the controls running and the evidence ready for the CPA firm that signs it.
The US rules for protecting patient health data, binding on suppliers to American providers and insurers. Naq keeps your safeguards documented and evidenced.
The MOD's cyber certification for defence suppliers, run by IASME. Naq builds on your Cyber Essentials to reach the level your contract asks for.
The first international standard for managing AI responsibly. Naq runs your AI governance on the ISO 27001 controls you already hold.
In fifteen minutes we will show you the work Naq would take on this week.
