Getting the basics right

Build the right security foundations for your business

Security Foundations helps you put the basic protections, policies and responsibilities in place so your business is harder to disrupt and easier to trust. You get a clear, practical plan for what to fix now and what can wait.

See pricing & packages ➜

WHEN YOU NEED THIS

Is Secure Foundations right for you?

If one or more of these apply to your situation, our Secure Foundations service is worth a closer look:

  • You don't have any written security policies, and a customer or investor has just asked for them
  • You're hiring your first employees and need basic rules for access, devices and data in place
  • Security so far has been informal and ad hoc, and you want a proper, prioritised starting point instead of guessing
  • A customer, partner or investor has asked what security controls you have
  • You know security matters but aren't sure what's actually worth doing at your stage

HOW IT WORKS

From scoping call to delivered roadmap

1

Discovery call

30-minute call to learn about your business, product and stage, and agree which package fits your immediate priorities.

2

Assess

We review the security basics across your business, cloud and digital products against your chosen package.

3

Prioritise

You get a prioritised roadmap plus the core policies and incident-readiness guidance for your package.

4

Deliver

We walk through the deliverables with you, so you know exactly what to do next, and in what order.

TYPICAL OUTCOMES

What you walk away with

  • A prioritised security roadmap you can act on immediately
  • Core policies and incident-readiness guidance scaled to your business
  • Clear answers on access, devices, data and supplier security
  • A foundation you can point to when a customer or investor asks what security you have in place

SERVICE PACKAGES & PRICING

Secure Foundations Packages

Essentials

£1,000-£1,500
1.5-2.5 days
Best for

Small businesses and beginning startups needing a minimum viable security foundation.

Cyber Essentials-aligned controls across users, devices, accounts and cloud services.
What you get
  • Cyber Essentials-aligned review
  • User and access controls
  • Device security and patching
  • Account security
  • Cloud service configuration
Get started with Essentials ➜

Advanced

£7,500-£10,000+
6-8+ days
Best for

Startups handling regulated, high-risk or commercially sensitive data.

Standard plus regulatory mapping, data classification, governance, business continuity and higher-level review of cloud, product and AI risk areas.
What you get
  • Everything in Standard
  • Regulatory mapping
  • Data classification
  • Governance structure
  • Business continuity plan
  • Higher-level review of cloud, product and AI risk areas
Get started with Advanced ➜

← Back to all services

SCOPE

What's not included

  • Hands-on control implementation — We identify and recommend improvements, but your team or IT provider implements them.
  • Penetration testing or vulnerability scanning — These must be commissioned separately where needed.
  • Formal certification or audit — Cyber Essentials, ISO 27001 or other certification fees and assessor activities are separate.
  • Legal or regulatory advice — We can identify relevant security obligations, but we do not provide legal opinions.
  • 24/7 monitoring or managed security operations — Ongoing SOC/MDR services are outside the package.
  • Major remediation projects — Complex cloud redesigns, IAM migrations or tooling deployments are scoped separately.

NEXT STEP

Related services

Security Coach

If you want to build the skills to manage security yourselves as you grow

Commercial Readiness

Once a customer, investor or partner sends you a security questionnaire or due-diligence request

Product & AI Security

Once you're building or shipping a product and need a deeper technical review

Security Leadership

If you'd rather hand ongoing ownership of security to someone experienced

KEEP READING

Related insights

FOUNDERS ASK US

Secure Foundations FAQs

Can you help with Cyber Essentials or ISO 27001?

Yes. Secure Foundations builds the Cyber Essentials-aligned technical controls into your business directly, and Commercial Readiness prepares you for the formal audit itself, gap assessment, evidence and all. We do not carry out the certification ourselves, that is done by an accredited body, so our assessment of your gap stays honest.


Our developers already handle security. Isn't that enough?

Your development team keeping the product running and your business being able to demonstrate, with evidence, that it can be trusted at scale are two different things. Investors, enterprise clients, and regulators ask about the second one. That is usually the gap we get called in to close.


How long does Secure Foundations take, start to finish?

Typically 2-4 weeks. Essentials is usually 1.5-2.5 days of effort, Standard 4-5 days, and Advanced 6-8+ days, spread across scoping, review and roadmap delivery rather than one continuous block.


Is Secure Foundations enough on its own, or do I need something else too?

For most early-stage startups, yes, it covers the basics properly. If you want ongoing support to work through the roadmap yourselves, Cyber Security Coaching is a natural next step. If a customer or investor is already asking security questions, Commercial Readiness picks up from there.


Which package should we start with?

It depends on your stage. Essentials suits small businesses and beginning startups who need the Cyber Essentials-aligned basics in place. Standard fits a live product with employees, customers or upcoming commercial scrutiny. Advanced is for startups handling regulated, high-risk or commercially sensitive data. If you are not sure, a short scoping call is enough to identify the right starting point.


← Back to all services

Book a Discovery Call.

30 minutes, no obligation. We will talk through where you are, what is coming up, and what would actually help at your stage.

Book a discovery call