IT Security & Compliance
Find out where you actually stand.
Most businesses have a rough idea that their security is "probably alright". A review replaces that with something you can act on — and show to an insurer.
This is for you if…
- An insurer or a customer has asked a question you couldn't confidently answer
- You've inherited responsibility for IT and don't know what you've inherited
- Something nearly went wrong and you'd rather not wait for the next one
- You're considering Cyber Essentials and want to know how far off you are
- Nobody has looked properly in years, and you'd rather find out than be told
What the review covers
Your Microsoft 365 tenant, against best practice. Accounts and two-step sign-in, administrator rights, conditional access, sharing settings, and how your setup compares with how Microsoft recommends it be configured. Most tenants were set up once and never revisited.
A Cyber Essentials-based assessment. The review is structured around the Cyber Essentials controls, because they are a recognised, sensible baseline rather than somebody's opinion. That also means you finish knowing exactly how far you are from certification, whether or not you want it.
A high-level look at the IT estate. What devices exist, what they're running, what's past end of support, and where the obvious gaps are.
Backups. Whether they're running, what they actually cover, and whether anyone has tested a restore.
Perimeter security. Firewalls and the boundary between your network and everything else.
Going deeper — optional detailed audit
The review above works from what can be seen at tenant and network level. It's enough for most businesses, and it doesn't require anything installed.
If you want device-level detail — patch status machine by machine, known vulnerabilities, encryption, what's genuinely in use versus forgotten in a drawer — I deploy monitoring software to your computers and audit for a month.
£4.50 per machine, for the month
A twenty-machine business is £90.
A month rather than a snapshot, because a single scan tells you what was true on Tuesday. A month tells you what's actually happening.
What you get
A written report: what's working, what isn't, what it would cost you if it went wrong, and what to do first — in priority order, in plain English.
Something you can hand to your board, your insurer or a customer asking awkward questions.
What this is not
It isn't a penetration test. Those are useful and I'll tell you if you need one, but they answer a different question — whether a specific system can be broken into, rather than whether your business is being run securely.
A review looks at the whole picture: accounts, devices, data, suppliers, backups, and what happens when something goes wrong.
What it costs
Every business is different, so I scope each review and quote a fixed price before anything starts. You'll know exactly what it costs and exactly what you're getting, with no obligation to go ahead.
It's usually less than people expect.
How this differs from the other two
| Service | The question it answers |
|---|---|
| Security Review | "I don't know where we stand." One-off, broad, discovery. |
| Cyber Essentials | "Someone requires a certificate." A defined standard, usually with a deadline. |
| Security Monitoring | "I want to know it stays right." Ongoing, checked nightly, reported monthly. |
They're a sequence more than a choice. The review finds out. Remediation fixes. Cyber Essentials certifies. Monitoring keeps it that way.