Stop failing the security questions your clients and Cyber Essentials assessor ask.
Practices hold bank details, tax records and ID for hundreds of clients, and more of them are being asked to prove that data is safe: by Cyber Essentials assessors, by insurers and by larger clients. We find the gaps, fix them, and give you the evidence.
- Tested and fixed before your Cyber Essentials renewal, not during it
- Your IT provider stays your IT provider
- Reports written for partners, not just IT
Three things that usually prompt the call.
A renewal after the busy season
Cyber Essentials comes round just after year-end or January, when nobody has had time to check that laptops are patched and admin rights are tidy.
Leavers and seasonal staff
Temporary staff and leavers keep access to the practice system, email and client folders long after their last day, because switching them off is nobody's job.
Emails that look like yours
Clients receive fake invoices or "updated bank details" that appear to come from the practice, because the email protections were never finished.
What we look at in a practice like yours.
Everything is checked against how a practice actually works: client data in, documents out, and lots of people needing access to the same files.
Accounts and sign-in
Microsoft 365 or Google Workspace, multi-factor sign-in on every account including shared mailboxes, and who has admin rights.
Email that can't be faked
SPF, DKIM and DMARC set up and enforced, so nobody else can send email from your practice's address.
Leavers and access
Every active account listed, leavers closed, and access to practice software and client folders limited to who needs it.
Laptops and patching
Every device on software that still gets security updates, the gap assessors flag most often.
What faces the internet
Remote access, old servers and client portals reachable from outside, mapped and locked down.
Backups that survive
At least one copy of client records that ransomware on your network couldn't also reach.
From first call to a closed report, with nothing technical asked of you.
Every stage is a fixed price, agreed before it starts. See what each stage costs.
Scoping call
Thirty minutes on your firm, your systems and what's driving the test. You get the fixed price for the test at the end of it.
Test, report, walkthrough
We run the assessment on agreed dates, then go through the ranked report with you: what's serious, what isn't, and what we'd fix first.
Fix, re-test, evidence
If you want the findings closed, we do the work with your IT provider, re-test every fix and hand over the evidence pack.
Regional practice, 40 staff, renewal in three weeks
The test found an unpatched remote-access gateway and shared admin accounts on the practice server. Fixed and re-tested in nine days, and the practice passed Cyber Essentials Plus first time.
Illustrative engagement showing the shape of the work, not a named client.
What firms like yours usually ask first.
We already have an IT provider. Why would we need you?
Your IT provider keeps things running day to day. We test what they've set up from the outside, independently, and then fix the gaps alongside them. Assessors, insurers and clients increasingly want that independent view.
When should we test before our Cyber Essentials renewal?
Two to three months before. That leaves time to fix what the test finds without rushing, and to go into the assessment with the evidence ready.
Will testing get in the way of busy season?
No. Dates are agreed with you, anything that could affect a live system runs out of hours, and we avoid January unless you ask for it.
Do you look at our client files?
No. We look at how your systems are configured and what is exposed, not at client data. Nothing is tested without written authorisation, and access is removed when we finish.