Cybersecurity

They bind government bodies, their companies and operators of critical national infrastructure, and the National Cybersecurity Authority encourages everyone else to apply them. Government clients often require them of their suppliers too, so we help you get ready.

We follow the Authority's rules for cybersecurity service providers. Services that need a licence, such as managed security operations centres, come through licensed partners, and we never claim a licence we don't hold.

Technical and organisational safeguards that match how sensitive the data is, such as access control, encryption and logging, plus reporting personal data breaches within the deadline the regulations set. We help with the technical safeguards; the legal assessment stays with your legal adviser.

A review of accounts and permissions, email, domains, servers, devices and backups, ending in a written report and a prioritised list of fixes. It isn't a penetration test; it's usually the step before one.

We arrange penetration tests with specialised partners once you approve the scope in writing, then fix what they find and verify the fixes. We also run regular vulnerability scans ourselves on the systems we build or host.

Round-the-clock security monitoring is the work of a security operations centre and needs a National Cybersecurity Authority licence. So we set up essential alerts that reach your team and connect you with a licensed centre when you need one. Our technical support itself is available 24/7.

With a known checklist: multi-factor sign-in for every user, separate admin accounts, clear sharing rules, phishing protection, conditional access and alerts on suspicious activity. It is usually done within days.

Only if they're isolated from your main systems, so they can't be encrypted too, and restores have actually been tested. So we set recovery targets with you and test them regularly.

The certificate industry is shortening certificate lifetimes in steps: a maximum of 200 days since March 2026, falling to 47 days by 2029. That's why we renew them automatically and watch expiry dates, so your site doesn't go down.

A DV certificate suits most sites; the encryption is the same in all three. OV and EV also verify your company's identity, which some clients may require, though browsers no longer show the difference in the address bar.

A wildcard covers every subdomain of one domain; a multi-domain certificate puts different domains in one certificate. We pick based on how many domains you have and how you manage them.

We set up SPF and DKIM, then tighten DMARC in steps until spoofed mail is rejected, so your real mail arrives and your domain can't be spoofed. Google and Microsoft now require these records from bulk senders.

Yes, if you distribute Windows software: signing shows your company as the publisher and reduces warnings. The keys now live in secure hardware or a remote signing service, and we help you set that up.

Isolate the affected systems, keep the logs and evidence, change important passwords and report it where required. If the system is hosted with us, we handle isolation, restoring from a clean copy and closing the gap, and bring in a specialised partner when forensic analysis is needed.

Nobody can honestly guarantee that. What we commit to is lowering both the chance and the impact: protected accounts, up-to-date systems, tested backups and a clear plan if something happens.

Usually a fixed fee for the review and the first round of hardening, then a monthly plan for upkeep and renewals, based on users or systems. Your quote spells out what's included and what isn't.