Service 02
Security Improvement Programme
A report on its own does not make a business safer. The Security Improvement Programme is where the important changes are made, tested and embedded.
We prioritise the measures that reduce the most risk for the money spent, and we work with your existing IT provider rather than replacing them.
Who it is for
- Businesses that have completed a Business Protection Review (or an equivalent assessment)
- Directors who want vulnerabilities fixed without managing a technical project themselves
- Businesses needing to meet a customer, insurer or supply-chain requirement by a deadline
What it covers
Areas we look at
Access control improvements
Tidying up accounts, permissions and administrator rights so people only have the access they need.
MFA implementation
Rolling out multi-factor authentication across email, remote access and key systems with minimal friction.
Email security improvements
Configuring protections that make it much harder to impersonate your business or your suppliers.
Vulnerability remediation
Addressing the technical weaknesses identified, in order of risk.
Backup and recovery improvements
Making sure backups are separated, protected and tested, with a realistic recovery time.
Security policies
Short, usable policies that reflect how your business actually works.
Staff training
Practical sessions on phishing, payment fraud and reporting, tailored to your workforce.
Incident response planning
A clear plan for who does what, who to call and how to keep trading if something goes wrong.
How it works
A clear process from start to finish.
- 1
Plan
We confirm priorities, scope and a fixed price based on your review findings.
- 2
Implement
We make changes directly or coordinate them with your IT provider.
- 3
Test
We check that controls work in practice, including a test restore of your backups.
- 4
Embed
Policies, training and an incident plan so improvements stick.
What you can expect
- A clear project plan with milestones and named responsibilities
- Changes coordinated with your IT provider and scheduled around operations
- Regular progress updates in business language
- A closing summary showing what has improved and what remains
FAQs
Security Improvement Programme: common questions
Do we have to have a Business Protection Review first?
It is the best starting point, because it tells us what to prioritise. If you have had a recent, credible assessment elsewhere, we can work from that instead.
Will you work with our existing IT provider?
Yes. We coordinate with them, agree who does what, and make sure changes are scheduled to avoid disrupting the business.
Will MFA and other changes annoy our staff?
Done well, they shouldn't. We plan roll-outs carefully, explain the reasons to staff and choose options that suit how people actually work, including on the shop floor, in the yard or on site.
How do we know the changes have worked?
We test them, including a real restore from backup, and finish with a written summary showing what has improved and what risk remains.
Other services
Related ways we can help
Business Protection Review
An independent review of your cybersecurity, financial controls and operational resilience.
From £1,495
03Ongoing Protection Partner
Independent, senior oversight of your cyber, fraud and resilience risks, without a full-time hire.
£500 – £750 per month
ISO 27001 consultancy
Practical ISMS implementation and certification readiness for customer and tender requirements.
Next step
Start with a conversation about your business.
An introductory conversation costs nothing. We will listen to where your business is heading, talk through what is holding it back and tell you honestly whether and how we can help.
30 to 45 minutes, by video or in person
At a time that suits you.
A conversation, not a sales pitch
We want to understand your business first.
A clear proposal
If we can help, you will know what we suggest and what it will cost.