Service · Evidence-based, dated
A report you can hand to a customer, an insurer or your board
An independent assessment is an evidence-based review against a defined set of thirty-six controls, producing a dated report that says where you stand, what was tested, what was not, and what to fix first. It is not an accredited certification and we say so on the front page. It is what you need when a customer, an insurer or a regulator asks for more than your own word — and when you want to know the answer before they do.
£3,200–£4,800
plus VAT is the typical range; the exact figure is fixed in writing before we startPriced on scope
36 controls
across governance, people, technology, suppliers, AI and incident response, published in fullThe control set
4–6 weeks
from first conversation to the walkthrough of findingsTypical elapsed time
Never
sold to an organisation we have advised. If we helped you fix it, someone else assesses itThe rule
Who this is for
Organisations that need to show a third party — a large customer running supplier due diligence, an insurer at renewal, a regulator, a funder, an acquirer — that their security and privacy controls have been looked at by someone with no stake in the answer. It suits organisations that do not yet want the cost of ISO 27001 but need something more than a self-assessment questionnaire, and organisations that hold a certificate and want to know whether the controls behind it still work.
It is also the honest starting point for a board that suspects it does not know where the organisation stands. The report answers that in one page, with the detail behind it for the people who have to act.
What we actually do
Each control is tested against what can be produced, not what is described.
- Documents dated and read, not listed
- Configurations and reports seen, sampled where the population is large
- People asked to show us, not tell us
- Where evidence could not be obtained, the report says so rather than assuming
Thirty-six controls, published, mapped to the things people ask you about.
- Cyber Essentials and ISO 27001:2022 Annex A, so the findings carry across
- UK GDPR and the Data (Use and Access) Act 2025, including automated decisions
- The NCSC Cyber Assessment Framework outcomes, for organisations facing the DSPT or NIS
- AI deployment and supplier oversight, which the older frameworks miss
Three documents, all dated.
- The full report: each control, the evidence seen, the rating, and the finding
- A one-page board report: position, the three decisions the board must take, what to fix first
- A statement of scope and limitations you can hand to a third party without editing
- A re-check of the priority findings within six months, included
What this is not
It is not Cyber Essentials, ISO 27001 or SOC 2, and it does not produce a certificate or a mark. We are not a certification body and we do not pretend to be one. If you need a recognised mark — because a contract names it — we tell you which one, get you ready for it, and introduce a body that has never advised you. We do not take a referral fee for the introduction.
It is also not a penetration test. We look at whether controls exist and operate; a penetration test looks at whether they can be beaten. The two answer different questions and many organisations do both. Penetration testing is available through our accredited partner.
What it costs
All thirty-six controls, one legal entity, one main site, up to roughly two hundred and fifty people. The figure in the scoping letter is the figure you pay.
Typically £3,200–£4,800 + VATPriced on scope
Larger organisations, multiple sites or entities, and groups with an island or overseas subsidiary are priced on scope. Where a customer's questionnaire or an insurer's form defines the scope, we assess against that and say so in the report.
The free self-assessment takes fifteen minutes and gives you a first position against the same controls, with a recommendation for each gap.
FreeNo account, no email address
Where do you stand? → · Read a sample one-page board report to see what you would receive.
What actually happens, and when
First conversation
No charge. Who is asking, what they are asking for, and whether we have advised you before — if we have, we tell you now and introduce someone else.
Within a week
A scoping letter with the fixed fee, the entities and sites in scope, and the evidence request: a list of what we will ask to see, so nothing is a surprise.
Your effort
Allow one to two days of your team's time across the engagement: gathering evidence, one on-site or online day with us, and the walkthrough.
Two to three weeks
We test each control against the evidence produced and the things we are shown. Anything serious is reported the same day.
Walkthrough
An hour with the people who will act on the findings, and twenty minutes with the board or its chair if wanted. All three documents are issued that day.
Afterwards
The findings are yours. We do not fix them. Within six months we re-test the priority findings and issue a dated update, included in the fee.
Questions we are usually asked
Will a customer accept this instead of ISO 27001?
Often, for organisations of this size — a dated independent report with a clear statement of scope answers most supplier due-diligence questionnaires. Where a contract names a specific certification, nothing else will do, and we will tell you that in the first conversation rather than after you have paid.
Can we choose which controls you assess?
You can narrow the scope to what a customer or insurer has asked about, and the report will state that scope plainly. You cannot remove controls because you expect to fail them; the point of the report is that a third party can trust what it leaves out.
What if we fail badly?
Then you will know, privately, before a customer or an insurer does, with a fix list in priority order. The report is yours and goes nowhere unless you send it. Most organisations that ask this question are in better shape than they fear and worse shape in one specific area they had not thought about.
You have advised us before. Can you still assess us?
No. If we have designed your controls, written your policies or held a retained role, we will not assess you, and we will introduce an assessor who has never worked with you. This costs us work. We think that is the point.
Does it cover our subsidiary in Jersey, Guernsey or the Isle of Man?
Yes, on scope. The Crown Dependencies have their own data protection and cyber law and their own regulators, and the report assesses the island entity against them rather than against UK law that does not apply there. Read about the island regimes.
There is no charge for the first conversation and no obligation at the end of it. If a recognised certification is what you actually need, we will say so and point you to it.