Don't just say you're secure. Prove it.
Independent testing, certification and governance from CRIBB Cyber Security, the assurance arm of the Clipeum group and a UK government-backed Certification Body since 2016. We find the weaknesses, help you fix them, then verify and certify the result so customers, insurers and regulators can see it.
Delivered by CRIBB Cyber Security, the assurance arm of the Clipeum group
Assess. Remediate. Verify. Certify.
Assess
Penetration tests, vulnerability scans and gap analysis against the standard you need to meet.
Remediate
A prioritised fix list, actioned by your own IT team, by our engineers, or both.
Verify
Retesting and technical verification so the fixes are proven, not promised.
Certify
Cyber Essentials, Cyber Essentials Plus, IASME Cyber Assurance and DCC, assessed by our own Certification Body.
What's in cyber assurance
Penetration testing
Authorised attacks by qualified testers, with a fix list you can act on.
Vulnerability scanning
Regular, rated scans of systems, websites and cloud, with a rescan to prove the fix.
Certification
Cyber Essentials, Plus, IASME, DCC, PCI DSS and ISO 27001, from an accredited Certification Body.
Defence and DCC
DCC certification and cyber assurance for the defence supply chain.
Data protection and DPO
DPO as a Service, GDPR reviews and information governance.
Incident response and forensics
Expert-led response and digital forensics, included for SOC customers.
Why organisations choose CRIBB
An accredited Certification Body
Cyber Essentials, Cyber Essentials Plus and IASME Cyber Assurance certification issued by us on behalf of IASME, plus DCC Level 0.
Testers, not just assessors
Qualified penetration testers who think like attackers, backed by the 24/7 SOC and engineers of the wider group.
A 100% record
Every client CRIBB has guided through certification has achieved it.
Governance and data protection
Certified data protection officers, GDPR reviews and information governance, not just technical controls.
Public sector proof
Trusted by government suppliers, emergency services, healthcare, education and the defence supply chain.
Run, protect and prove in one group
The only local partner that can run your IT, defend it around the clock and independently certify it.
One annual programme: Cyber Security Ready
Most organisations don't need a one-off test. They need to be provably secure every year, with someone keeping the evidence in order. Our Cyber Security Ready programme wraps it up: an annual external penetration test and vulnerability scan, quarterly reviews with a named data protection officer, an evaluation of your policies and processes, Cyber Essentials certification and renewal, and help with ICO registration.
You get regular reports, a living action plan and one team to call. Ask us about it and we'll shape it around your size and risk.
Cloud security verification
Most breaches in the cloud come from configuration, not clever attacks. Our cloud security verification reviews your AWS, Azure, Google Cloud, Oracle or Alibaba environment against recognised best practice benchmarks: identity, network exposure, storage permissions, logging and encryption.
You receive a clear report of what's exposed, what's non-compliant and what to change first.
Cyber assurance questions
What's the difference between cyber security and cyber assurance?
Can you certify us if you also run our IT?
How often should we be tested?
Do you work with our existing IT provider?
They fully understood our security requirements and were able to deliver their solution, which met the needs of our customer security requirements. We have been extremely pleased with their cheerful help desk support and their dedication to helping us in our IT projects.
Talk to a person who knows IT, not a script.
Tell us what's frustrating you about your IT or security. We'll give you an honest view of what we'd change, whether or not you work with us.