Working together · Foundation
Automation with a name on the door
Your baseline controls monitored continuously, Cyber Essentials kept current year after year, and a named practice accountable for the result. Automation does the routine checking; a person you can call stands behind it.
Who it is for
Is this you?
- Firms that need Cyber Essentials for contracts, insurers or clients, and want it kept current rather than rushed each year
- Firms whose IT is run by a small team or an outside provider, with no one checking the baseline independently
- Firms that want evidence for auditors and clients without building a compliance function
- Firms that may need advisory support later and want the foundations in place first
Available through Foundation
What you get
What is included
Continuous baseline monitoring
An automated compliance platform checks your core controls against an agreed baseline, so drift is caught when it happens rather than at renewal.
Cyber Essentials, kept current
Preparation for your Cyber Essentials assessment and help staying compliant between renewals. Certificates last 12 months, so we plan for each renewal from the start.
Independent assessment
We prepare you; an independent certification body assesses you. We are not a certification body ourselves, so our advice is never tied to whether you pass.
A named practice behind the results
When the dashboard shows a problem, or an auditor asks a question, you speak to the person accountable for the service, not an anonymous support desk.
Evidence on request
Reports you can share with clients, insurers and auditors that show what is in place and when it was last checked.
How it works
From first conversation to results
Baseline
We agree the controls that matter for your firm and connect the monitoring platform to your environment.
Fix the gaps
We give your IT team or provider a prioritised list of what to fix before assessment, with clear instructions.
Assess
Your firm is assessed for Cyber Essentials by an independent certification body.
Stay current
Monitoring continues all year; we review what it finds with you and prepare early for the next renewal.
What this is not
- Foundation is not a managed service. Your IT team or provider makes the changes; we monitor, advise and stand behind the results.
- We do not certify you. Assessment is carried out by an independent certification body.
- Foundation covers the baseline. Board reporting, a risk register and security leadership sit in Advisory.
Related thinking
Read more
Don't be the easiest door on the street
Interactive guide for small and medium-sized firms: what a passing attacker sees, and how to look less inviting.
Reference · Regulatory complianceSecurity Standards, Compliance Frameworks and Governance Bodies
Cross-jurisdictional reference catalogue for the UK, EU, USA and Canada, with the international standards beneath them.
Article · Regulatory complianceUnderstanding GDPR: A Guide to Data Protection in the UK
Overview of UK GDPR, the Data Protection Act 2018, individual rights and post-Brexit data transfers.
Questions
Common questions
Is Cyber Essentials enough on its own?
It is a sound baseline against the most common attacks, and many contracts require it. It does not cover governance, suppliers or board ownership; that is what Advisory adds.
What if we already have Cyber Essentials?
We start from where you are, check that the controls are still in place, and take over the monitoring and renewal from there.
Does the platform need access to our systems?
It needs read access to the settings it checks. We agree exactly what it can see before it is connected, and record that in writing.
Start with a conversation
Tell us about your organisation, your regulators and what is worrying you. We will say plainly whether we can help, and how.
Book a conversation