Cyber Essentials
The UK baseline we certify, and often the right first framework.
Full details →Practical direction on risk, frameworks and policy for East Midlands organisations that need senior security advice without a full-time hire.
Not every organisation needs a full-time security team. Many need a trusted person who can look at the business, say which risks matter, and help you put a sensible set of controls in place. That is the consultancy Cyber Root provides from Leicester to clients across the East Midlands.
We help you measure and manage cyber risk, choose a framework that fits your size, and turn it into policies and actions people will follow. The advice is aligned to recognised practice, including the NCSC’s Cyber Assessment Framework thinking and widely used training standards such as SANS, then scaled to a business of your size rather than copied from a bank.
Whether Cyber Essentials, ISO 27001, or a lighter internal standard is the right next step, and what you can ignore for now.
A clear view of what you must protect, what you can tolerate, and who owns each decision.
Acceptable use, access, incident, backup and supplier rules written in language staff will actually read.
Ongoing access to a senior advisor for board papers, customer questionnaires and supplier reviews.
Answers for RFIs, public-sector supply chains and the security schedules larger customers send you.
Help implementing the controls, not only recommending them, working with your existing IT provider.
We start by understanding how you work: what you sell, which systems keep you operating, and which customers set security conditions. From that we recommend a small number of moves, in order. Typical outputs are a short risk register, a prioritised improvement plan, and the policies or board summary you need for the decision in front of you. Consultancy sits naturally alongside the rest of our work. A risk review often leads to penetration testing, vulnerability management or Cyber Essentials. You do not have to buy those to get advice, and we will say when a control is unnecessary.
Owners and directors of growing firms, internal IT managers who have been handed security as a second job, and leadership teams preparing for investment, a new contract or a group security review. If you are unsure where to start, that is a reasonable reason to call.
Most East Midlands clients combine more than one of these. Start with the gap that matters most.
The UK baseline we certify, and often the right first framework.
Full details →The plan a risk assessment usually shows is missing.
Full details →Independent evidence when a customer wants more than a policy.
Full details →If you have a specific decision, such as a tender or a new office, a fixed review is enough. If security questions arrive every month, a retained advisor is usually cheaper than assembling an answer from scratch each time.
Only if a customer or a market requires it. Many East Midlands SMEs get further, faster, with Cyber Essentials and a short list of extra controls. We will say which.
Yes. We help you answer them accurately and spot the gaps the questions are really pointing at, so you are not guessing in a portal at 6pm.
Both. Strategy without implementation is how policies end up unused. We will work with your IT provider on the practical steps, and we deliver testing, monitoring and certification ourselves when you want one team.
Your IT company runs the technology. Consultancy decides which risks the business is willing to carry, and whether the technology choices match that decision.