# Clipeum IT, full site text Canonical site: https://www.clipeumit.com. See /llms.txt for the summary. ## Clipeum IT | Managed IT and cyber security for UK businesses URL: https://www.clipeumit.com/ It's 19:35 in the UK. Offices closed. Our SOC is still watching. ## Managed IT and cyber security, run properly. MonitoringAn out-of-hours incident, illustrated 24/7Watching sign-ins, endpoints and email 02:14 Suspicious sign-in flagged on a finance mailbox 02:15 Session revoked and account locked 02:21 Analyst confirms credential phishing 02:38 Password reset, MFA re-enrolled, report sent We look after the technology behind UK businesses from 10 to 500 people. Named engineers who know your setup, our own 24/7 security operations centre watching it, our own Certification Body to prove it, and a plan for where it goes next. Book a callTake the 5-minute health check Clipeum IT, in numbers 30specialists across the group 3Offices across Norfolk, Suffolk and Hertfordshire 24/7our own security operations centre, watching around the clock Certified, accredited and recognised A quick test ### Questions your IT provider should already have answered. If any of these made you pause, you're not alone. Most businesses we meet have a provider who fixes things when they break, and not much else. You deserve more than that. Check your IT in 5 minutes When did they last sit down with you for a strategic business review?TAM and vCIO Would your backups actually bring you back? How fast?Continuity Have they built your risk register with you, cyber risks included?Cyber security Has anything they've done made your business measurably faster?Automation What we do ### Run it. Protect it. Prove it. Managed IT, 24/7 cyber security, business automation and independent cyber assurance under one roof, from one group. No finger-pointing between suppliers, and no need to hire a separate firm to certify you. Cyber security #### Protection that's watching when you aren't. 24/7 managed detection and response from our in-house UK SOC, layered defences across identity, devices, email and data, and the certifications your customers ask for. How we protect you 24/7 SOC and MDR Layered security Cyber Essentials Data security 01 Managed IT #### Support that prevents, not just fixes. Proactive monitoring and maintenance, UK engineers who pick up the phone, and a technical alignment manager and vCIO planning your roadmap every quarter. How managed IT works AISP, our all-in-one plan Delivery models Backups and continuity TAM and vCIO 02 Business automation #### Less admin. More business. Power Platform apps, Copilot and document workflows that take repetitive work off your team's plate, built secure because we run your security too. What automation can do AI and Copilot Process automation Documents 03 Cyber assurance #### Don't just say you're secure. Prove it. Penetration testing, vulnerability scanning, Cyber Essentials, IASME and DCC certification, data protection and incident response from CRIBB, our own accredited Certification Body. How assurance works Penetration testing Certification Data protection and DPO Incident response 04 AISP, our all-in-one plan ### Stop paying 4 suppliers to blame each other. AISP puts support, monitoring, 24/7 security operations, backup, Microsoft 365 and quarterly strategy into a single plan with one price per person. One team, one number to call, nothing important left as an add-on. See what's in the planHave your own IT team? Co-managed works too Everything in the plan Helpdesk, monitoring and patching 24/7 SOC and managed detection and response Backup, recovery and continuity Microsoft 365 managed and secured Quarterly TAM and vCIO reviews Security awareness training Cyber Essentials certification, assessed by our own Certification Body Out of hours ### When your office goes quiet, we don't. Attackers favour evenings and weekends, when fewer people are watching. Our security operations centre monitors your endpoints, email, identities and cloud around the clock, with real analysts making the calls. 19:35UK time, right now. Offices closed, SOC still watching. 50% Rise in “highly significant” cyber attacksNational Cyber Security Centre, 2025 £195k Potential cost of a significant attack to a UK businessKPMG estimate 24/7 In-house UK SOC, monitoring and respondingClipeum IT #### Detect Unusual behaviour flagged across devices, identities, email and cloud. #### Contain The device or account isolated straight away. #### Investigate An analyst confirms what happened and what it touched. #### Recover Access restored, credentials reset, gaps closed. #### Report A clear write-up of what happened and what changed. See how our SOC works Defence Cyber Certification 91 days until 31 December 2026, the date the MOD has signalled for Level 0. ### Built for the defence supply chain. Much of our work is with defence manufacturers and the businesses that supply them. We're an accredited DCC Level 0 Certification Body, and we help organisations get Cyber Essentials, Cyber Essentials Plus and DCC in place before their contracts demand it. L03 controls, plus CEWe certify this level L1101 controls, plus CE L2139 controls, plus CE Plus L3144 controls, plus CE Plus Defence and DCCRead the announcement Customers ### Customers who've stayed for a decade tend to mean it. Read a case study ATB GroupEngineeringMonk Plant HirePlant hireAge UK NorfolkCharitySowerbysEstate agency They fully understood our security requirements and were able to deliver their solution, which met the needs of our customer security requirements. We have been extremely pleased with their cheerful help desk support and their dedication to helping us in our IT projects.ATB Group, engineering Free dark web exposure report ### See what's already out there about your business. Stolen passwords, leaked mailboxes and exposed logins for your domain, pulled from criminal marketplaces and breach dumps. We'll send you a plain-English report of what we find, and what to do about it. Your company domainEnter your company's web domain. Work emailEnter a valid work email address. I'm happy for Clipeum IT to run the check on this domain and send me the results. We never share your details. Send me the report The group ### 3 respected firms. One team. Clipeum IT brings together Onyx IT, REACT Computer Partnership and CRIBB Cyber Security: deep regional roots across Norfolk, Suffolk and Hertfordshire, supporting customers nationwide. Meet the people behind it #### Onyx IT Norwich, Norfolk Strategic IT and business cyber defence, trusted by Norfolk businesses since 1989. About Onyx #### REACT Computer Partnership Woodbridge, Suffolk Measurably better IT support since 1997, and home to much of our Power Platform expertise. About REACT #### CRIBB Cyber Security Hertfordshire Our cyber assurance arm: penetration testing, certification and data protection, and a UK government-backed Certification Body since 2016. About CRIBB Insights ### Worth a read. Practical guidance on security, IT and AI for businesses without a security department. Cyber security #### Cyber Essentials or Cyber Essentials Plus: which one do you actually need? The 2 certifications share the same 5 controls. The difference is who checks, and who's asking you for it. An assessor's view.Cyber security #### What actually happens in a penetration test Hoodies and green text are for films. Here's what a real, authorised test of your business looks like, step by step.Company news #### Clipeum IT is now a Defence Cyber Certification Level 0 Certification Body We're now accredited to assess organisations for DCC Level 0, the new baseline for the UK defence supply chain. All insights Know a business that deserves better IT? When they join, you both receive a credit equal to one month's support fees, up to £1,000.How referrals work ### ## Cyber security | Clipeum IT URL: https://www.clipeumit.com/cyber-security/ Home/Cyber security ## Stop worrying about cyber threats. Get back to growing. Security that's built around your business, not bolted on. We find the gaps, close them, and watch your systems around the clock from our own UK security operations centre. Book a callSend us a message ### Antivirus and a firewall aren't a security strategy Threats change every week. That's why we don't install a product and walk away. We help you build a security-first business: finding risks early, locking down weak points, and putting simple processes in place so your people and your data stay protected. Everything is sized to you. A 15-person firm and a 400-person manufacturer need different things, and we'll tell you honestly what you need and what you don't. ### 4 things we never compromise on #### Prevention Hardening, patching and configuration that stops most attacks before they start. #### 24/7 monitoring Our in-house SOC watches endpoints, identities, email and cloud, day and night. #### Training Regular phishing simulations and short training so your team spots the scam. #### Compliance Cyber Essentials, Cyber Essentials Plus, DCC and GDPR, handled with you, not handed to you. ### Explore cyber security #### Managed detection and response 24/7 detection and response from our in-house UK SOC. #### Layered cyber security Overlapping defences so no single failure lets an attacker in. #### Crucial safeguards Cyber Essentials controls and the basics every business needs. #### Data security Find, label, protect and back up the data that matters. ### What sits inside your protection Every customer gets a plan built from these controls. Which ones, and how deep, depends on your risk. #### Compliance support Guidance through GDPR, Cyber Essentials and Defence Cyber Certification. #### Next-gen threat detection Behaviour-based endpoint detection that's smarter than traditional antivirus. #### Data encryption Sensitive information locked down, whether it's stored or sent. #### Round-the-clock monitoring So you can switch off while we keep watch. #### Security audits Full reviews that find the gaps and prioritise the fixes. #### User training Monthly phishing simulations and bite-sized awareness training. #### Multi-factor authentication Strong sign-in protection without making life harder. #### Email security Phishing, spam and malicious links stopped before they reach inboxes. #### Firewall and network Always-on protection tuned to how your business works. #### Backup and recovery Tested plans so you never lose what matters. #### Patch management Updates applied automatically, without disrupting your day. #### Access controls People reach the tools and data they need, and nothing more. ### Questions you might be askingCould someone inside the business do serious damage? Insider risk is real, whether it's malicious or an honest mistake. We put role-based access and activity monitoring in place so people only reach what they need, and unusual behaviour gets noticed quickly.What happens if ransomware hits us? Our detection is designed to stop ransomware before it encrypts anything, by spotting the behaviour rather than waiting for a known signature. If an attacker does get a foothold, the affected device is isolated, our analysts investigate, and your tested backups mean recovery is planned, not improvised.Are home workers opening the door to attackers? Remote work adds routes in that many businesses never think about. We secure the devices, protect sign-ins with strong authentication, filter risky web traffic wherever people are, and train the users themselves.How long could we survive if everything went down tomorrow? It's worth knowing the answer before you need it. We build disaster recovery plans with agreed recovery times, then test them regularly, so you know exactly how long restoration takes and what gets restored first. ### ## Managed detection and response | Clipeum IT URL: https://www.clipeumit.com/cyber-security/mdr/ Home/Cyber security/Managed detection and response ## Managed detection and response, backed by our own 24/7 SOC Most attacks land out of hours, when fewer people are watching. Our in-house UK security operations centre monitors and responds around the clock, so a threat at 2am gets dealt with at 2am. Book a callSend us a message ### The threat is growing, and it's expensive 50% Rise in “highly significant” cyber attacksNational Cyber Security Centre, 2025£195k Potential cost of a significant attack to a UK businessKPMG estimate£1bn to £8.5bn Lost to intellectual property theftAlma Economics, 2024 ### What MDR actually means MDR combines technology with human judgement. It has 2 jobs: detection, which means watching your endpoints, networks, email and cloud 24/7, and response, which means containing and neutralising a threat the moment it's confirmed. Automation does the first pass, filtering huge volumes of activity at speed using machine learning. Then real analysts take over, working out what a threat is and dealing with it properly. The enemy is dwell time: how long an attacker sits in your systems before anyone notices. Alert fatigue makes it worse, because people stop reacting to constant noise. MDR cuts through it. ### What happens when something fires #### Detect Automated tooling flags unusual behaviour across devices, identities, email and cloud. #### Contain The device or account is isolated straight away to stop any spread. #### Investigate An analyst confirms what happened, how, and what it touched. #### Recover Access restored, credentials reset, gaps closed, systems back to normal. #### Report You get a clear write-up of what happened and what we changed. ### Inside our SOC Our SOC is UK-based and staffed by our own analysts, not a faceless offshore service. Critical threats are escalated to senior analysts, and there's clear accountability for every task, so you always know who is responsible for what. Because the same team looks after your day-to-day IT, context isn't lost. The people responding to an alert already know your systems. ### Fully managed, or alongside your team Choose what fits. We can run everything, from day-to-day IT to monitoring and maintenance, or work alongside your in-house IT team as their security operations capability. Either way you choose the services you need, from security monitoring alone to full planning, compliance support and business continuity. ### MDR questionsHow is MDR different from antivirus? Antivirus looks for known threats on a device. MDR watches behaviour across your whole environment and puts a human analyst behind every serious alert, with the authority to act.Do we need our own IT team? No. Many customers rely on us for everything. If you do have an internal team, we work alongside them and share the load.What do we see as a customer? Clear reporting on what we've detected and done, plus a named contact who can walk you through it. ### Keep exploring #### Layered cyber security Overlapping defences so no single failure lets an attacker in. #### Business continuity and backups Backups and recovery plans that are tested, not assumed. #### IT health check 18 questions across 5 areas, about 5 minutes, a clear view of your gaps. ### ## Layered cyber security | Clipeum IT URL: https://www.clipeumit.com/cyber-security/layered/ Home/Cyber security/Layered cyber security ## Layered security: no single point of failure No one product stops every attack. Layered security means that if one control is beaten, the next one catches it. Here's how the layers fit together. Book a callSend us a message ### Click through the layers 8 layers, from your people to our SOC. Each one is designed to catch what the others miss. People Identity Email Endpoints Network Data Recovery 24/7 SOC #### People Your team is both the most targeted layer and the best defence. Trained people spot the scam that technology misses. Monthly phishing simulations Short, relevant awareness training Clear reporting routes for anything suspicious ### Why layers beat a bigger wall Attackers only need one way in. A single strong control, however good, is still a single point of failure. Layers force an attacker to beat several different defences in a row, and every extra step is another chance for us to spot them. The layers are also designed to work together. A suspicious sign-in, an odd email and unusual file activity might each look minor on their own. Seen together by our SOC, they tell a story. ### How we build your layers #### Map We list every control you already have across the 8 layers, and where the gaps are. #### Fill the gaps Highest-risk gaps first: usually MFA, email filtering, endpoint detection and backup. #### Connect Every layer reports to our SOC so a suspicious sign-in and an odd email are seen together. #### Prove it A vulnerability scan or penetration test shows the layers hold, and Cyber Essentials certifies it. ### Signs you've got a wall, not layers Antivirus and a firewall, and not much else Email without multi-factor authentication Backups that sit on the same network as the data Alerts that go to an inbox nobody reads at 2am Staff who have never seen a phishing simulation No test has ever been run against your defences ### Layered security questionsWe're a small business. Do we really need all 8 layers? Yes, but not all at the same depth. A 15-person firm needs MFA, patching, email filtering, endpoint detection, backup and training as much as a 400-person one; what changes is the tooling and how much of it we run for you. Cyber Essentials covers 5 of the layers as a baseline.Isn't this expensive? Layered security is mostly configuration and process on tools you already pay for, particularly in Microsoft 365, plus monitoring. It costs a fraction of one ransomware incident, and it's included in our AISP plan rather than sold as add-ons.How does this relate to Cyber Essentials? Cyber Essentials is the government baseline for 5 of these layers. Layered security is how you go beyond the certificate to security that works day to day, with detection and response on top.Can you work alongside our existing IT provider? Yes. We can provide the security layers and SOC while your provider runs day-to-day support. We agree who owns what up front so nothing falls between us. ### Keep exploring #### Managed detection and response 24/7 detection and response from our in-house UK SOC. #### Crucial safeguards Cyber Essentials controls and the basics every business needs. #### Data security Find, label, protect and back up the data that matters. ### ## Crucial safeguards | Clipeum IT URL: https://www.clipeumit.com/cyber-security/safeguards/ Home/Cyber security/Crucial safeguards ## The safeguards every business should have in place Most successful attacks exploit the basics: an unpatched laptop, a reused password, an admin account nobody locked down. Get these right and you've shut the door on the majority of threats. Book a callSend us a message ### The Cyber Essentials five, done properly These are the government-backed Cyber Essentials controls. They're the baseline for most supply chains, including defence. #### Firewalls Boundary protection on every network and device, configured, not left on defaults. #### Secure configuration Unnecessary software and accounts removed, default passwords changed. #### User access control Admin rights only where needed, and accounts removed when people leave. #### Malware protection Modern endpoint detection on every device, centrally managed. #### Security update management Critical and high-risk patches applied within 14 days, automatically. ### Then the essentials beyond the essentials Multi-factor authentication on every account, phishing-resistant for admins Backups kept separately from Microsoft 365, and tested Monthly phishing simulations and short training A password manager instead of spreadsheets and sticky notes Email filtering and DNS filtering to stop bad links A written, rehearsed incident response plan ### Cyber Essentials and Cyber Essentials Plus We hold Cyber Essentials Plus and IASME Cyber Assurance ourselves, so we know exactly what assessors look for. We'll get your controls in place, prepare the evidence, and take you through certification. Then we keep you there. Certificates renew annually, and we track your renewal date so it never catches you out. ### How certification works with us #### Gap review We check your setup against the 5 controls and tell you exactly what would fail. #### Fix Our engineers close the gaps, or hand your team a list if you'd rather do it yourselves. #### Assess You complete the Cyber Essentials questionnaire with our help and our assessors mark it. #### Plus For Cyber Essentials Plus, our assessors test a sample of your devices and cloud accounts. #### Certify Certificate issued, insurance included where eligible, and a renewal date in the diary. ### Cyber Essentials questionsHow long does Cyber Essentials last? 12 months. Renewal is a fresh assessment each year, which is why we keep your controls maintained all year rather than scrambling before the anniversary.What's actually in scope? Every device, server and cloud service used to access your data, unless you deliberately scope a subset. Home workers' laptops and Microsoft 365 are in. We'll help you define a scope that passes and still means something.What happens if we fail? For Cyber Essentials you get feedback and 2 further attempts. For Cyber Essentials Plus you have 21 days to fix any failures and be retested. Our gap review is designed to make sure neither happens.Do we need Cyber Essentials to get DCC? Yes. Every Defence Cyber Certification level requires Cyber Essentials, and Levels 2 and 3 require Cyber Essentials Plus. We can take you through both. ### Keep exploring #### Defence and DCC DCC certification and cyber assurance for the defence supply chain. #### Layered cyber security Overlapping defences so no single failure lets an attacker in. #### IT health check 18 questions across 5 areas, about 5 minutes, a clear view of your gaps. ### ## Optimising data security | Clipeum IT URL: https://www.clipeumit.com/cyber-security/data-security/ Home/Cyber security/Data security ## Your data, protected wherever it lives Customer records, designs, financials, contracts. Your data is scattered across laptops, Microsoft 365, file shares and inboxes. We find it, label it, lock it down and make sure you can always get it back. Book a callSend us a message ### How we approach it #### Discover Map where your sensitive data actually sits, and who can reach it. #### Classify Label data by sensitivity so the right protections follow it. #### Protect Encryption, access controls and data loss prevention rules. #### Back up Independent backups of Microsoft 365, servers and devices. #### Review Regular access reviews so permissions don't quietly sprawl. ### What's included #### Encryption everywhere Devices, email and files encrypted at rest and in transit. #### Sensitivity labels Confidential documents stay confidential, even when shared. #### Data loss prevention Rules that stop card numbers, personal data or designs leaving by accident. #### Permission clean-up We find overshared SharePoint sites and Teams before someone else does. #### Microsoft 365 backup Microsoft keeps your service running. Backing up your data is your job, so we do it. #### GDPR support Practical help with your obligations, records and subject access requests. ### Getting ready for AI Tools like Microsoft Copilot can see everything a user can see. If permissions have sprawled, Copilot will happily surface a salary spreadsheet to the wrong person. Our data security work is the foundation for a safe AI rollout. See AI and Copilot. ### Where data usually leaks from Files forwarded to personal email to work from home Public sharing links that never expire Laptops without encryption, lost in taxis and cafes Old file shares nobody has reviewed in years Leavers' accounts that were never closed USB sticks and personal cloud storage ### Data security questionsWhat's a sensitivity label? A tag on a file or email, such as Confidential, that follows the content wherever it goes and controls who can open it, whether it can be shared outside the business and whether it's encrypted. Labels can be applied automatically based on what the file contains.Will data loss prevention stop people getting their work done? Not if it's tuned properly. We start in monitoring mode to see what people actually do, then block only the risky patterns, such as sending a spreadsheet of customer records to a personal address, with a clear message explaining why.Doesn't Microsoft back up Microsoft 365 for us? Microsoft keeps the service running and offers limited recovery windows. Restoring a mailbox deleted 6 months ago, or files encrypted by ransomware, is your responsibility, which is why we run an independent backup.How does this help with GDPR? GDPR requires appropriate technical measures to protect personal data. Knowing where personal data is, limiting access, encrypting it and being able to recover it are exactly those measures, and give you evidence if the ICO ever asks. ### Keep exploring #### Layered cyber security Overlapping defences so no single failure lets an attacker in. #### Business continuity and backups Backups and recovery plans that are tested, not assumed. #### AI and Copilot Safe, measurable Copilot and AI adoption. ### ## Cyber assurance | Clipeum IT URL: https://www.clipeumit.com/cyber-assurance/ Home/Cyber assurance ## Don't just say you're secure. Prove it. Independent testing, certification and governance from CRIBB Cyber Security, the assurance arm of the Clipeum group and a UK government-backed Certification Body since 2016. We find the weaknesses, help you fix them, then verify and certify the result so customers, insurers and regulators can see it. Book a callSend us a message Delivered by CRIBB Cyber Security, the assurance arm of the Clipeum group ### Assess. Remediate. Verify. Certify. #### Assess Penetration tests, vulnerability scans and gap analysis against the standard you need to meet. #### Remediate A prioritised fix list, actioned by your own IT team, by our engineers, or both. #### Verify Retesting and technical verification so the fixes are proven, not promised. #### Certify Cyber Essentials, Cyber Essentials Plus, IASME Cyber Assurance and DCC, assessed by our own Certification Body. ### What's in cyber assurance #### Penetration testing Authorised attacks by qualified testers, with a fix list you can act on. #### Vulnerability scanning Regular, rated scans of systems, websites and cloud, with a rescan to prove the fix. #### Certification Cyber Essentials, Plus, IASME, DCC, PCI DSS and ISO 27001, from an accredited Certification Body. #### Defence and DCC DCC certification and cyber assurance for the defence supply chain. #### Data protection and DPO DPO as a Service, GDPR reviews and information governance. #### Incident response and forensics Expert-led response and digital forensics, included for SOC customers. ### Why organisations choose CRIBB #### An accredited Certification Body Cyber Essentials, Cyber Essentials Plus and IASME Cyber Assurance certification issued by us on behalf of IASME, plus DCC Level 0. #### Testers, not just assessors Qualified penetration testers who think like attackers, backed by the 24/7 SOC and engineers of the wider group. #### A 100% record Every client CRIBB has guided through certification has achieved it. #### Governance and data protection Certified data protection officers, GDPR reviews and information governance, not just technical controls. #### Public sector proof Trusted by government suppliers, emergency services, healthcare, education and the defence supply chain. #### Run, protect and prove in one group The only local partner that can run your IT, defend it around the clock and independently certify it. ### One annual programme: Cyber Security Ready Most organisations don't need a one-off test. They need to be provably secure every year, with someone keeping the evidence in order. Our Cyber Security Ready programme wraps it up: an annual external penetration test and vulnerability scan, quarterly reviews with a named data protection officer, an evaluation of your policies and processes, Cyber Essentials certification and renewal, and help with ICO registration. You get regular reports, a living action plan and one team to call. Ask us about it and we'll shape it around your size and risk. ### Cloud security verification Most breaches in the cloud come from configuration, not clever attacks. Our cloud security verification reviews your AWS, Azure, Google Cloud, Oracle or Alibaba environment against recognised best practice benchmarks: identity, network exposure, storage permissions, logging and encryption. You receive a clear report of what's exposed, what's non-compliant and what to change first. ### Cyber assurance questionsWhat's the difference between cyber security and cyber assurance? Cyber security is the doing: firewalls, monitoring, response. Cyber assurance is the proving: independent testing and certification that shows your security actually works, to a standard someone else recognises. Clipeum does both, and keeps them separate so the assurance is credible.Can you certify us if you also run our IT? Cyber Essentials and IASME assessments are carried out by CRIBB's accredited assessors following IASME's rules on independence. For organisations we support day to day, we're transparent about roles and, where a scheme requires it, use a separate assessor.How often should we be tested? At least annually for a penetration test, quarterly for external vulnerability scanning (PCI DSS requires it), and after any major change such as a new website, office or cloud migration.Do you work with our existing IT provider? Yes. Much of CRIBB's work is for organisations with their own IT team or another provider. We test, report and verify; whoever runs your IT does the fixing, or we can.They fully understood our security requirements and were able to deliver their solution, which met the needs of our customer security requirements. We have been extremely pleased with their cheerful help desk support and their dedication to helping us in our IT projects.ATB Group, engineering ### Keep exploring #### Cyber security How we protect your business, end to end. #### Defence and DCC DCC certification and cyber assurance for the defence supply chain. #### Contact Speak to a real person about your IT. ### ## Penetration testing | Clipeum IT URL: https://www.clipeumit.com/cyber-assurance/penetration-testing/ Home/Cyber assurance/Penetration testing ## How secure is your business against a real attack? A penetration test is an authorised attack on your systems by people who know exactly how criminals work. We find and prove the weaknesses that matter before someone else does, then hand you a plan to fix them. Delivered by the CRIBB Cyber Security team. Book a callSend us a message Delivered by CRIBB Cyber Security, the assurance arm of the Clipeum group Reception Server room Finance Open office Customer data Web 443 Mail 25 Remote desktop 3389 VPN Admin panel 8080 1234 Internet RetestedAll 4 fixed Field notes 09:00Scope signed. External and internal test, no destructive actions. 09:40Remote desktop reachable from the internet. Weak password. 09:58Same local admin password on the file server. In. 10:21No separation between the office network and customer data. 10:34Customer data reachable. Stopping here, as agreed. Day 5Report delivered. 4 findings, 1 critical, all with fixes. Day 19Retest. Door shut, passwords changed, network segmented. Scope Recon Test Exploit Report Retest ### Tests for every part of your attack surface #### External penetration test Your internet-facing systems, tested the way an outside attacker would: firewalls, VPNs, email, remote access and anything exposed. #### Internal penetration test What could someone do once inside: a rogue employee, a compromised laptop or a visitor on the Wi-Fi. How far can they get? #### Web application test Websites, portals and APIs tested for injection, broken authentication, access control flaws and the rest of the OWASP list. #### Code review Source code reviewed for insecure logic and weaknesses before they reach production. #### Red team assessment A goal-based, quiet attack that tests your detection and response, including social engineering. For mature security programmes. #### IT Health Check (ITHC) The formal assessment UK government systems and suppliers need, aligned to Cyber Essentials and government security classifications. ### What actually happens #### Scope We agree what's in and out, the goals, the rules of engagement and when. You sign the authorisation. #### Reconnaissance We map your footprint: domains, services, technologies, people, anything an attacker would find. #### Test and exploit Automated tooling first, then hands-on testing to prove which weaknesses are really exploitable, safely. #### Report A management summary for the board and a technical report for whoever fixes it, with every finding rated and prioritised. #### Retest Once you've fixed the findings, we verify them and update the report so you can show it to whoever asked. ### Black, grey or white box?1 #### Black box We get a company name or a URL and nothing else, and attack as an outsider would. The most realistic view of external risk.2 #### Grey box We get some information, such as a user login, for a more focused test in less time. Ideal for web applications with logged-in areas.3 #### White box We get architecture, credentials and sometimes source code. The deepest assurance of your application and infrastructure logic. ### Penetration testing questionsHow often should we run a penetration test? At least once a year, and after any significant change: a new website or app, a cloud migration, a merger or a new office. Many customer contracts, insurers and schemes such as PCI DSS set their own minimums.How long does it take? A typical external test for a small or mid-sized business takes 2 to 5 days of testing, with the report a few days later. Internal and web application tests take longer depending on size. We'll give you a fixed scope and timeline up front.Will it break anything? Testing is planned and authorised, and destructive techniques are agreed with you in advance or excluded. We test at times that suit you and keep a line open throughout.What's the difference between a pen test and a vulnerability scan? A scan is automated and tells you what might be vulnerable. A pen test is human-led and proves what actually is, chaining weaknesses together the way an attacker would. Most organisations need both: scans regularly, a pen test at least annually.Who does the testing? CRIBB Cyber Security's qualified penetration testers, part of the Clipeum group, working under strict confidentiality. Ask us for our testers' current credentials when you request a quote. ### Keep exploring #### Vulnerability scanning Regular, rated scans of systems, websites and cloud, with a rescan to prove the fix. #### Certification Cyber Essentials, Plus, IASME, DCC, PCI DSS and ISO 27001, from an accredited Certification Body. #### Managed detection and response 24/7 detection and response from our in-house UK SOC. ### ## Vulnerability scanning | Clipeum IT URL: https://www.clipeumit.com/cyber-assurance/vulnerability-scanning/ Home/Cyber assurance/Vulnerability scanning ## Find the weak spots before someone else does. Regular, non-intrusive scanning of your systems, websites and cloud services, with every finding rated Critical, High, Medium or Low and a plain-English fix for each. Quarterly scans keep you compliant; monthly scans keep you ahead. Book a callSend us a message Delivered by CRIBB Cyber Security, the assurance arm of the Clipeum group CoreServersEndpointsInternet-facing FW-01wwwmailvpnM365FS-01AD-01SQL-01FIN-LTHR-LTDIR-LTPRINTWIFIENG-LTBACKUPAzure 0%Scanning 16 assets Findings 0Crit 0High 0Med 0Low Mediumwww: outdated web frameworkFixed HighVPN: no MFA enforcedFixed LowMicrosoft 365: legacy sign-in allowedFixed CriticalFS-01: unpatched since 2023Fixed MediumFinance laptop: local admin, no MFAFixed LowDirector's laptop: 3 updates pendingFixed HighPrinter: on the guest Wi-FiFixed MediumWi-Fi: default admin loginFixed Non-intrusive. Nothing gets exploited, nothing goes down. ### 5 kinds of scan #### Internal Your servers, workstations and network devices, scanned from inside for missing patches, weak configuration and known flaws. #### External Everything you expose to the internet, scanned the way attackers scan it, every month or every quarter. #### Web applications Your websites and portals checked for common application weaknesses and outdated components. #### PCI DSS The official quarterly scan of your payment systems that requirement 11 of PCI DSS demands, with the report your bank or acquirer needs. #### Personal data (PII) A search of your file shares and systems for unprotected personal data that needs anonymising, moving or locking down under GDPR. #### Cloud configuration AWS, Azure, Google Cloud, Oracle and Alibaba environments checked against best-practice benchmarks. ### Two reports, one fix list Every scan produces a management report that tells leadership where you stand in a page, and a technical report that tells your engineers exactly what to change, host by host. Findings are rated by severity and by how easy they are to exploit, so the list starts with what matters. Fixes can be actioned by your own IT team or by our engineers as a trusted fixer. Either way, we rescan to confirm they've landed. ### When to scan Quarterly, as a minimum, for anyone taking card payments Monthly if you're in a regulated sector or hold sensitive data Before and after Cyber Essentials Plus, so you pass first time After every significant change to your network or website Continuously if you're on AISP or our Cyber Security Ready programme Whenever a customer or insurer asks for evidence ### Scanning questionsWill scanning disrupt our systems? No. Vulnerability scanning is non-intrusive: it identifies weaknesses without exploiting them, so it can run during the working day.We already have antivirus and a firewall. Why scan? They protect against attacks. Scanning tells you where they'd get through: the forgotten server that's missed 2 years of patches, the printer on the wrong network, the website running an old plugin.What do we get? A management summary, a technical report with every host and finding, a prioritised fix list, and a rescan to confirm the fixes. For PCI DSS, the approved scan report your acquirer needs. ### Keep exploring #### Penetration testing Authorised attacks by qualified testers, with a fix list you can act on. #### Certification Cyber Essentials, Plus, IASME, DCC, PCI DSS and ISO 27001, from an accredited Certification Body. #### Layered cyber security Overlapping defences so no single failure lets an attacker in. ### ## Vulnerability scanning | Clipeum IT URL: https://www.clipeumit.com/cyber-assurance/certification/ Home/Cyber assurance/Vulnerability scanning ## Find the weak spots before someone else does. Regular, non-intrusive scanning of your systems, websites and cloud services, with every finding rated Critical, High, Medium or Low and a plain-English fix for each. Quarterly scans keep you compliant; monthly scans keep you ahead. Book a callSend us a message Delivered by CRIBB Cyber Security, the assurance arm of the Clipeum group CoreServersEndpointsInternet-facing FW-01wwwmailvpnM365FS-01AD-01SQL-01FIN-LTHR-LTDIR-LTPRINTWIFIENG-LTBACKUPAzure 2%Scanning 16 assets Findings 0Crit 0High 0Med 0Low Mediumwww: outdated web frameworkFixed HighVPN: no MFA enforcedFixed LowMicrosoft 365: legacy sign-in allowedFixed CriticalFS-01: unpatched since 2023Fixed MediumFinance laptop: local admin, no MFAFixed LowDirector's laptop: 3 updates pendingFixed HighPrinter: on the guest Wi-FiFixed MediumWi-Fi: default admin loginFixed Non-intrusive. Nothing gets exploited, nothing goes down. ### 5 kinds of scan #### Internal Your servers, workstations and network devices, scanned from inside for missing patches, weak configuration and known flaws. #### External Everything you expose to the internet, scanned the way attackers scan it, every month or every quarter. #### Web applications Your websites and portals checked for common application weaknesses and outdated components. #### PCI DSS The official quarterly scan of your payment systems that requirement 11 of PCI DSS demands, with the report your bank or acquirer needs. #### Personal data (PII) A search of your file shares and systems for unprotected personal data that needs anonymising, moving or locking down under GDPR. #### Cloud configuration AWS, Azure, Google Cloud, Oracle and Alibaba environments checked against best-practice benchmarks. ### Two reports, one fix list Every scan produces a management report that tells leadership where you stand in a page, and a technical report that tells your engineers exactly what to change, host by host. Findings are rated by severity and by how easy they are to exploit, so the list starts with what matters. Fixes can be actioned by your own IT team or by our engineers as a trusted fixer. Either way, we rescan to confirm they've landed. ### When to scan Quarterly, as a minimum, for anyone taking card payments Monthly if you're in a regulated sector or hold sensitive data Before and after Cyber Essentials Plus, so you pass first time After every significant change to your network or website Continuously if you're on AISP or our Cyber Security Ready programme Whenever a customer or insurer asks for evidence ### Scanning questionsWill scanning disrupt our systems? No. Vulnerability scanning is non-intrusive: it identifies weaknesses without exploiting them, so it can run during the working day.We already have antivirus and a firewall. Why scan? They protect against attacks. Scanning tells you where they'd get through: the forgotten server that's missed 2 years of patches, the printer on the wrong network, the website running an old plugin.What do we get? A management summary, a technical report with every host and finding, a prioritised fix list, and a rescan to confirm the fixes. For PCI DSS, the approved scan report your acquirer needs. ### Keep exploring #### Penetration testing Authorised attacks by qualified testers, with a fix list you can act on. #### Certification Cyber Essentials, Plus, IASME, DCC, PCI DSS and ISO 27001, from an accredited Certification Body. #### Layered cyber security Overlapping defences so no single failure lets an attacker in. ### ## Data protection and governance | Clipeum IT URL: https://www.clipeumit.com/cyber-assurance/data-protection/ Home/Cyber assurance/Data protection and DPO ## A data protection officer, without hiring one. Certified data protection officers, GDPR compliance reviews and information governance from CRIBB Cyber Security. We keep you compliant, deal with the ICO and handle the requests, so your team can get on with the business. Book a callSend us a message Delivered by CRIBB Cyber Security, the assurance arm of the Clipeum group ### What we cover #### DPO as a Service A named, certified data protection officer on a contract, fulfilling the DPO obligations many organisations now have under GDPR. #### GDPR compliance review Where you stand against GDPR and the Data Protection Act, what's missing and a plan to close it, building on the work you've already done. #### Information governance Registers, retention schedules, policies and the data management forms nobody wants to complete, done properly and kept current. #### Data protection impact assessments DPIAs for new systems, projects and suppliers, so risk is understood before the data moves. #### Subject access requests Handling access, rectification and erasure requests correctly and on time. #### Policies and training Privacy notices, staff training and the awareness that stops incidents happening in the first place. ### Who needs a DPO? Public authorities, and any organisation whose core activities involve large-scale monitoring of people or large-scale processing of sensitive data, must appoint one. Plenty of others choose to because customers, funders and insurers expect it. The role must be independent and expert, which is why an outsourced DPO is often the practical answer. Our DPOs act as your point of contact with the Information Commissioner's Office, monitor your compliance, advise on impact assessments and handle requests from the people whose data you hold. We work with UK GDPR and the Data Protection Act 2018, and with international regimes including the EU GDPR, CCPA, Australia's APPs and PECR. ### Data protection questionsDo we legally need a DPO? If you're a public authority, or your core activities involve large-scale regular monitoring of individuals or large-scale processing of special category or criminal offence data, yes. If not, you can still appoint one voluntarily, and many organisations do to satisfy customers and insurers.Can the DPO be outsourced? Yes. GDPR explicitly allows the DPO to be provided under a service contract, provided they're independent, expert and properly resourced. That's exactly what DPO as a Service provides.What does the DPO actually do each month? Monitors compliance, advises on new processing and projects, handles subject access requests and breach assessments, keeps your registers and policies current, joins your quarterly review and is the contact for the ICO.We've had a breach. What now? Call us. You may have 72 hours to notify the ICO, and the decision about whether to notify needs to be made and documented quickly. Our DPOs and incident response team handle this together. ### Keep exploring #### Incident response and forensics Expert-led response and digital forensics, included for SOC customers. #### Certification Cyber Essentials, Plus, IASME, DCC, PCI DSS and ISO 27001, from an accredited Certification Body. #### Data security Find, label, protect and back up the data that matters. ### ## Incident response and forensics | Clipeum IT URL: https://www.clipeumit.com/cyber-assurance/incident-response/ Home/Cyber assurance/Incident response and forensics ## When it goes wrong, you'll want people who've done this before. Expert-led incident response and digital forensics from the Clipeum group. We contain, investigate and recover, preserve the evidence, and help you talk to clients, insurers and regulators while it's happening. Included for every organisation defended by our SOC. Book a callSend us a message Delivered by CRIBB Cyber Security, the assurance arm of the Clipeum group ### How we respond #### Get ready Before anything happens: playbooks for specific events, forensic artefact handling, policy review and board-level crisis exercises until the right moves are second nature. #### Rapid response Immediate access to seasoned responders who assess and triage as the situation develops. #### Investigate Forensic analysis across endpoints, networks, cloud platforms and logs to find the root cause and full scope, with chain of custody preserved. #### Contain and eradicate Affected systems isolated, malicious actors neutralised and service stability restored, in phases that avoid unnecessary downtime. #### Communicate Clear, accurate updates for clients, staff and regulators, including ICO notification support where needed. #### Report and improve Board-ready incident reports, evidence packs and practical recommendations that reduce the risk of next time. ### Why organisations and MSPs call us #### We augment your team Whether you're an IT provider needing specialist skills or a business with no security team, we add capacity without taking over. #### Confidential and court-ready We act under strict confidentiality, for customers or as a trusted third party, and can serve as an expert witness. #### Tool-agnostic We work with your stack: Microsoft Sentinel, Defender, Microsoft 365, Elastic, CrowdStrike, Splunk and more, without disruption. #### No jargon Clear explanations, remediation steps and strategic advice, written for the board as well as the engineers. #### Hours, not days Whether you have 1 endpoint or 100,000, our consultants can be analysing your environment within hours. #### Pre-breach included Organisations on our SOC service get responder access and readiness training as standard, not as an emergency purchase. ### What a response looks like in practice Ransomware through a stolen VPN login: the infection was spreading fast when we were called. Within hours we had isolated it, validated the backups so the business could restore, identified the malware and traced the attack path for full remediation. Invoices quietly redirected by a hidden mailbox rule: we found how the attacker got in, secured the Microsoft 365 tenant, supported the ICO notification and produced a forensic evidence report with full chain of custody that would stand up in court. An intruder who'd been inside for weeks: unusual outbound traffic led us to a custom backdoor and movement across older systems. We deployed endpoint detection, imaged the affected systems for analysis and ran a phased containment that kept production running. Details have been changed to protect the organisations involved. ### Incident response questionsWe think we've been breached. What do we do first? Don't switch things off or wipe anything: you may destroy the evidence. Isolate affected devices from the network if you safely can, call us on 0333 996 4264, and start noting times and what you've seen.Do you only work with your own customers? No. We respond for any organisation, and we partner with other IT providers who need forensic and response expertise for their clients.Will you deal with our insurer and the ICO? We'll produce the evidence and reports they need and support your notifications. Your DPO or ours makes the ICO decision within the 72-hour window. ### Keep exploring #### Managed detection and response 24/7 detection and response from our in-house UK SOC. #### Data protection and DPO DPO as a Service, GDPR reviews and information governance. #### Business continuity and backups Backups and recovery plans that are tested, not assumed. ### ## Managed IT | Clipeum IT URL: https://www.clipeumit.com/managed-it/ Home/Managed IT ## IT support that prevents problems, not just fixes them Slow systems, endless tickets and security updates you never get round to. We take all of it off your plate with fully managed, proactive IT from UK engineers who talk in plain English. Book a callSend us a message ### What managed IT actually means for you It means never having to wonder whether your systems are secure, up to date and working as they should. We take care of: Day-to-day IT issues, so you don't have to System monitoring and preventative maintenance Cloud services, backups and hardware support Fast help from UK engineers, never an overseas call centre Whether you want full outsourcing or support for your in-house team, we flex around you. ### Explore managed IT #### Delivery models Fully managed, co-managed or project support. #### Business continuity and backups Backups and recovery plans that are tested, not assumed. #### TAM and vCIO Standards, roadmaps and budgets from your own strategic team. ### What if you could plan ahead instead of firefighting? Every customer gets a Technical Alignment Manager and a virtual Chief Information Officer. Together they give you a strategic partner who plans your IT roadmap, keeps it aligned to your goals, and helps you avoid costly surprises. Quarterly IT planning and budgeting Cyber security and compliance support Business continuity and growth planning ### Is your tech keeping up with your growth?Could we predict problems before they hit? Yes. We monitor, analyse and tune your systems continuously, so we're fixing the disk that's about to fail rather than the server that's already down. Fewer disruptions, more productive people.How much time are we losing to slow technology? More than most businesses realise. Every minute waiting on a slow laptop or a dropped connection costs money. We streamline everything from cloud infrastructure to communication tools so your team works faster.Could our IT handle twice the workload tomorrow? Rapid growth breaks unprepared systems. We build infrastructure that scales with you, whether you're adding people or opening new sites.Are we making technology decisions on data or guesswork? Our reporting shows what's working, what isn't and where to invest next, in language that makes sense to a board, not just an engineer. ### ## AISP: one plan for all of it | Clipeum IT URL: https://www.clipeumit.com/aisp/ Home/AISP, our all-in-one plan ## One plan. Support, security and services, all in. AISP replaces separate support, backup, security and licensing contracts with a single plan: one monthly price per person, one team accountable for all of it, and nothing important left as an optional extra. Book a callSend us a message ### What's in the plan Everything a business of 20 to 500 people needs to run and stay secure, without a menu of add-ons. #### Helpdesk and engineering UK engineers who know your setup, on the phone and on site. #### Monitoring and patching Devices and servers kept healthy and up to date, proactively. #### 24/7 SOC and MDR Our own analysts watching your identities, devices, email and cloud. #### Backup and continuity Tested backups and a recovery plan you've seen work. #### Microsoft 365 Licensing, configuration and security of your tenant, managed. #### TAM and vCIO A quarterly review, a roadmap and a budget you can plan around. #### Awareness training Phishing simulations and short training for every member of staff. #### Cyber Essentials support Certification kept current, with DCC when your contracts need it. ### Why one plan beats 4 suppliers Most businesses we meet pay 3 or 4 different companies for support, backup, security and licensing, and when something goes wrong nobody owns the outcome. AISP puts every part under one roof, so there's one number to call and one team on the hook. It's priced per person, so it scales with you as you grow. Most customers choose a 3-year plan with stepped pricing agreed up front, which makes budgeting simple and removes the annual renewal haggle. ### How we move you onto AISP #### Discovery We audit what you have, what's exposed and what you're paying today. #### Plan A single plan built around your risk, your people and your contracts. #### Onboard Phased over a few weeks, with no downtime for your team. #### Review Quarterly reviews with your technical alignment manager and vCIO. ### Who it suits Businesses with 20 or more people Firms that handle customer, financial or defence data Teams without an internal IT department, or with one that needs backup Anyone tired of juggling suppliers who blame each other Businesses bidding for contracts that ask about cyber security Leaders who want one predictable number for all of IT ### AISP questionsIs it really everything? Support, monitoring, security operations, backup, Microsoft 365 and strategic reviews are all in. The only things outside the plan are one-off projects, such as an office move or a major migration, which we quote separately and up front.We have an internal IT person. Does that still work? Yes. AISP runs co-managed too. Your person keeps the parts they're best at and we take the out-of-hours cover, security operations and heavy lifting.How is it priced? One monthly price per person, agreed up front, with everything in the plan included. The figure depends on your size, your risk and what's already in place, and you'll always see it in full before you decide anything.How long does it take to move? Most businesses are fully onboarded within 4 to 6 weeks. We phase it so nobody loses a day's work.It's that extra level of care from Onyx that we love. Late one night, outside of normal or extended support hours, I couldn't connect to my Wi-Fi. Andrew, one of their lovely engineers (they are all lovely), picked up my ticket and drove out to help. Needless to say, when he tried to connect it did it first time, LoL.Monk Plant Hire, plant hire ### Keep exploring #### Delivery models Fully managed, co-managed or project support. #### Managed detection and response 24/7 detection and response from our in-house UK SOC. #### Contact Speak to a real person about your IT. ### ## Delivery models | Clipeum IT URL: https://www.clipeumit.com/managed-it/delivery-models/ Home/Managed IT/Delivery models ## Fully managed, co-managed or somewhere in between Some businesses want us to run everything. Others have a capable internal team that needs extra depth. We shape the service around how you already work. Book a callSend us a message ### 3 ways to work with us Most customers start fully managed. Businesses with their own IT team usually choose co-managed. Service Fully managedWe run your IT and security end to end Co-managedWe work alongside your internal team Projects and consultancySpecific pieces of work, when you need them Helpdesk for your staffOptional– 24/7 monitoring and alertingOptional Patching and maintenance– 24/7 SOC and managed detection and responseOptional Access to our senior engineers TAM and vCIO strategic reviewsOptional Projects and migrations Your internal team stays in control– Swipe the table sideways to compare all 3 options. ### Co-managed works when it's genuinely shared The best co-managed relationships have clear lines. We agree who owns what, share one ticketing view, and give your team access to our tooling, our SOC and our senior engineers. Your people stay focused on the projects only they can do. We take the monitoring, patching, out-of-hours cover and security operations that drain their time.I've been so impressed by the detailed understanding they have about the complexities of our business, and what we need to future proof our operation across Norfolk. Ultimately, we are fit for purpose, agile and adaptive thanks to their careful management.Sowerbys, estate agency ### How we set up a co-managed arrangement #### Responsibility map A simple table of who owns what: helpdesk, patching, security, projects, strategy. #### Shared tooling Your team gets access to our monitoring, ticketing and documentation, so there's one version of the truth. #### Escalation Clear paths for when something is beyond your team, out of hours, or a security incident. #### Review Quarterly, we look at what's working and adjust the split as your team and business change. ### Delivery model questionsCan we change model later? Yes. Plenty of customers start co-managed and move to fully managed when their IT person moves on, or the other way when they hire. The contract flexes with you.Who owns the tooling and documentation? You do. Documentation is yours, and if you ever leave us it comes with you in a usable format.What happens if our internal IT person leaves? We step up to cover their responsibilities from day one, so nothing drops while you decide whether to replace them.Do you do one-off projects for businesses you don't support? Yes: migrations, office moves, server replacements and security projects, quoted up front. Many project customers later move to a managed plan, but there's no obligation. ### What's included every month #### Helpdesk UK engineers by phone, email and portal, with named people who know your setup. #### Monitoring Servers, devices and cloud services watched around the clock, problems fixed before you notice. #### Patching Security updates tested and applied within 14 days, the Cyber Essentials standard. #### Backup checks Every backup job verified daily and restore-tested regularly. #### Microsoft 365 Licences, configuration, security settings and new starters handled for you. #### Joiners and leavers Accounts, devices and access set up on day 1 and removed on the last day. #### Reporting A monthly view of tickets, uptime and security, in plain English. #### Reviews Alignment visits and a quarterly strategic review with your vCIO. ### Keep exploring #### TAM and vCIO Standards, roadmaps and budgets from your own strategic team. #### Managed detection and response 24/7 detection and response from our in-house UK SOC. #### Contact Speak to a real person about your IT. ### ## Business continuity and backups | Clipeum IT URL: https://www.clipeumit.com/managed-it/continuity/ Home/Managed IT/Business continuity and backups ## When something goes wrong, you'll know exactly what happens next Fire, flood, ransomware or a deleted folder. Backups only matter if they bring you back, quickly, in the right order. We design, run and test your recovery so it's a plan, not a hope. Book a callSend us a message ### Continuity, covered end to end #### Microsoft 365 backup Email, OneDrive, SharePoint and Teams backed up independently of Microsoft. #### Server and device backup Image-level backups with fast restore, on site and in the cloud. #### Agreed recovery times We agree with you how quickly each system must be back, and how much data you can afford to lose. #### Regular restore testing We prove backups work by restoring from them, not by checking a green tick. #### Written recovery plans Who does what, in what order, with contact details that work when email doesn't. #### Tabletop exercises We walk your leadership through a realistic incident so the first time isn't the real time. ### Why it matters £195k Potential cost of a significant cyber attack to a UK businessKPMG estimate24/7 Monitoring of backup jobs, so failures get fixed the same dayClipeum ITTested Recovery procedures exercised with you, not just written downClipeum IT Nothing is too much trouble for the team and the speed at which they respond is very impressive. As well as hands-on support and monitoring of our network, they give us advice and guidance on IT storage, systems and backup. Invaluable, as we no longer have that expertise in-house.Age UK Norfolk, charity ### How we build your continuity plan #### Impact We work out how long each system can be down and how much data you can afford to lose. That sets your recovery objectives. #### Design Backups, replicas and recovery steps designed to hit those objectives, with immutable copies ransomware can't touch. #### Implement Configured, documented and monitored daily, with alerts to our team when a job fails. #### Test Restore tests at least annually, and after any major change, with results you can show insurers and auditors. #### Review Objectives revisited every quarter as the business changes. ### What's covered Servers and virtual machines, on site and in the cloud Microsoft 365 mail, files, Teams and SharePoint Laptops and the data people keep on them Line-of-business applications and their databases Network configuration, so you can rebuild fast The plan itself, kept where you can reach it when systems are down ### Continuity questionsWhat are RTO and RPO? Recovery time objective is how long until you're back; recovery point objective is how much data you can afford to lose. A 4-hour RTO and 15-minute RPO means back in 4 hours with no more than 15 minutes of work lost. We agree both with you and design to meet them.How often are backups tested? Every backup job is checked daily, and we run full restore tests at least once a year, or more often if your risk or insurer requires it. You get a report each time.Can ransomware encrypt our backups? Not if they're designed properly. We keep copies that can't be altered or deleted for a set period, stored separately from your network, so even an attacker with admin rights can't reach them.Does our cyber insurance need this? Most policies now ask about tested backups, offline copies and a documented recovery plan. Having them documented and evidenced can lower premiums and, more importantly, means a claim isn't refused. ### Keep exploring #### Data security Find, label, protect and back up the data that matters. #### Managed detection and response 24/7 detection and response from our in-house UK SOC. #### IT health check 18 questions across 5 areas, about 5 minutes, a clear view of your gaps. ### ## TAM and vCIO | Clipeum IT URL: https://www.clipeumit.com/managed-it/tam-vcio/ Home/Managed IT/TAM and vCIO ## A technical lead and an IT director, without the salaries Your Technical Alignment Manager keeps your systems to best-practice standards. Your virtual CIO turns that into a roadmap and budget that serves the business. Together they make IT strategic. Book a callSend us a message ### 2 roles, one joined-up view Technical Alignment Manager (TAM). Reviews your environment against our standards: security settings, patching, backups, licensing, hardware age and network health. Anything out of line goes on a prioritised plan. Virtual Chief Information Officer (vCIO). Takes the TAM's findings into business language. Budgets, a three-year roadmap, your risk register and board-ready reporting. The person who asks where the business is heading and makes sure IT is ready for it. ### How the quarterly cycle works #### Align Your TAM audits your environment against best-practice standards. #### Prioritise Findings are scored by risk and business impact. #### Plan Your vCIO builds the roadmap and budget with you. #### Review A quarterly business review tracks progress and resets priorities. ### Meet the alignment team Real people you'll get to know by name. Click a face for their story. JERead bio Joe EdeHead of Technical Alignment ARRead bio Andrew RouseTechnical Alignment Manager DFRead bio Dominic FutterTechnical Alignment Manager DORead bio Dillon OliverVirtual Chief Information Officer LWRead bio Leon WilkinsonVirtual Chief Information Officer ### What you get from it A three-year IT roadmap tied to your business plan Budgets you can plan around, with no nasty surprises A risk register that includes your cyber risks Threat modelling for the risks that matter to you Hardware and licence lifecycle planning Clear, jargon-free reporting for your board ### TAM and vCIO questionsWhat's the difference between a TAM and a vCIO? Your technical alignment manager checks your environment against our standards and fixes drift, so the boring things are always right. Your virtual CIO looks 1 to 3 years ahead, turning those findings and your business plans into a roadmap and budget. One is about today, the other about next year.How often do we meet? Quarterly as standard for the strategic review, with alignment visits between. Faster-moving businesses sometimes choose monthly.Do we get a written roadmap? Yes. A living roadmap and budget, updated each quarter, that you can take to your board or bank.Is this included in AISP? Yes. Technical alignment and quarterly vCIO reviews are part of the plan rather than a separate consultancy engagement. ### Keep exploring #### Delivery models Fully managed, co-managed or project support. #### Our team The people behind your technology. #### IT health check 18 questions across 5 areas, about 5 minutes, a clear view of your gaps. ### ## Business automation | Clipeum IT URL: https://www.clipeumit.com/automation/ Home/Business automation ## What's stopping your business from automating? Manual processes, disconnected systems and paperwork-heavy workflows cost more time and money than they should. We help growing businesses find faster, smarter ways of working. Book a callSend us a message ### What automation can do for you #### Give your team their time back Automate routine work so people can focus on customers, strategy and the jobs that need a human. #### Compete with bigger players Automated systems let you move faster with fewer resources, which levels the field. #### Make better decisions, faster Real-time data from automated processes means decisions based on facts, not gut feel. #### Scale without the overhaul Automations grow with the business, so you're not rebuilding every time you expand. ### Explore automation #### AI and Copilot Safe, measurable Copilot and AI adoption. #### Business process automation Power Platform apps and automated workflows. #### Document management and workflow Organised, compliant document management in Microsoft 365. ### Start small. Prove it. Then scale. You don't have to overhaul everything at once. Pick one process that frustrates people, automate it, measure the time saved, then move to the next. Our automation specialists work with Microsoft Power Platform, Copilot and SharePoint every day, and because we also run your IT and security, everything we build is supported and secure from day one. ### Why work with us on automation #### UK-based experts Specialists who understand how SMBs actually work. #### Plain English Simple explanations, no jargon. #### Proven experience Hands-on work across SMB systems in every sector. #### Ongoing support Training, updates and improvements after go-live. ### How an automation project runs #### Discover We sit with the people doing the work and map the process as it actually happens. #### Prototype A working version in days, not months, so you can react to something real. #### Build Hardened, documented and secured, with the right access and audit trail. #### Adopt Training for the team and a switch-over that doesn't stop the business. #### Improve We watch how it's used and keep refining it. ### Automation questionsDo we need extra licences? Often not. A great deal can be built with the Power Platform capabilities already in most Microsoft 365 business plans. Where a premium connector or licence is needed, we'll tell you before we build.Is our data safe in Power Automate and Copilot? It stays inside your Microsoft 365 tenant, protected by the same security we run for everything else. We set governance rules so nobody can build a flow that sends company data to a personal account.How quickly will we see results? Most first automations are live within 2 to 4 weeks, and the time saved is measurable immediately: hours per week per person for typical onboarding, invoice and approval processes.Someone in-house built us a few automations. Can you take them on? Yes. We review, document and secure what's there, then support and extend it, so the business isn't dependent on one person's memory. ### Keep exploring #### AI and Copilot Safe, measurable Copilot and AI adoption. #### Business process automation Power Platform apps and automated workflows. #### Document management and workflow Organised, compliant document management in Microsoft 365. ### ## AI and Copilot | Clipeum IT URL: https://www.clipeumit.com/automation/ai/ Home/Business automation/AI and Copilot ## AI that earns its place in your business Microsoft Copilot and AI agents can save hours every week, but only if your data is ready and your people know how to use them. We make AI safe, useful and measurable. Book a callSend us a message ### Our route to a safe Copilot rollout #### Assess A Copilot readiness assessment of your Microsoft 365 tenant, permissions and data exposure. #### Remediate Fix oversharing, apply sensitivity labels and tighten access before AI can surface it. #### Pilot Licence a small group, pick real use cases, and measure the time saved. #### Adopt Train teams, write an AI use policy, and roll out to the people who benefit. ### Where we help #### Copilot readiness Find out what Copilot would see before it sees it. #### Microsoft 365 Copilot Summaries, drafts and analysis inside the apps your team already uses. #### AI agents Copilot Studio agents that answer questions from your own policies and data. #### Automated reporting Reports, emails and data entry generated automatically. #### Real-time insight Forecasting and trends pulled from your live business data. #### AI policy and training Clear rules on what staff can use AI for, and how. ### Where AI helps, and where it doesn't AI is brilliant at drafting, summarising and finding things. It's poor at judgement, at anything that needs guaranteed accuracy, and at decisions that should have a person accountable for them. We'll be honest about which of your processes suit AI and which don't. Read more in our guide to where AI fits. ### Copilot readiness checklist Sensitivity labels applied so Copilot respects what's confidential SharePoint and Teams sharing tidied, so old files don't resurface Permissions reviewed, because Copilot shows people what they can already see An AI use policy your staff have actually read A pilot group with clear use cases and a way to measure the time saved Training, so people know how to ask and how to check the answer ### AI and Copilot questionsDoes Copilot train on our data? No. Microsoft 365 Copilot uses your data to answer your prompts inside your tenant; it isn't used to train the underlying models, and it stays subject to your existing Microsoft 365 security and compliance settings.Which Copilot do we need? Microsoft 365 Copilot works inside Word, Excel, Outlook and Teams with your data. Copilot Studio builds custom agents for specific jobs, such as answering questions about your own policies. Most businesses start with the first for a pilot group.What about staff using ChatGPT and other tools? They probably already are. An AI use policy, a sanctioned tool and some training are far more effective than a ban, and we help you put all 3 in place.How do we know it's worth it? Measure before and after. We set a baseline for the tasks in your pilot, such as time to produce a proposal or summarise a meeting, and report the difference after 8 weeks. ### Keep exploring #### Data security Find, label, protect and back up the data that matters. #### Business process automation Power Platform apps and automated workflows. #### Document management and workflow Organised, compliant document management in Microsoft 365. ### ## Business process automation | Clipeum IT URL: https://www.clipeumit.com/automation/process/ Home/Business automation/Business process automation ## Turn spreadsheets and email chains into systems that run themselves With Microsoft Power Platform we build custom apps, automate approvals and connect the tools you already pay for, with minimal code and no expensive bespoke software. Book a callSend us a message ### Typical things we automate #### Starters and leavers Accounts, licences, devices and access created and removed automatically. #### Approvals Holiday, purchase orders and expenses routed to the right person, with reminders. #### Forms to data Paper and PDF forms replaced with apps that feed straight into your systems. #### System integration Your CRM, finance and line-of-business apps talking to each other. #### Dashboards Power BI reporting that updates itself, instead of monthly spreadsheet marathons. #### Alerts and escalations The right people told the moment something needs attention. ### Benefits you'll feel quickly Streamlined operations with fewer manual steps Faster service for your customers Fewer errors from rekeying data Processes that don't depend on one person's memory We document everything we build and support it afterwards, so you're never left with an app nobody understands. ### How a project runs #### Discover We map the process with the people who actually do it. #### Design A simple design you can see and agree before we build. #### Build Iterative build, tested with real users. #### Support Training, documentation and ongoing improvements. ### Signs a process is ready to automate It happens every week and follows the same steps Someone re-keys data from one system into another It waits for an approval by email, and sometimes gets lost A spreadsheet is emailed around and nobody knows which version is current Errors come from copy and paste, not judgement One person holds it together, and the process stops when they're on holiday ### Process automation questionsWhat do you build with? Mostly Microsoft Power Automate, Power Apps, SharePoint and Dataverse, because most of our customers already have them and they inherit Microsoft 365 security. Where a business system has its own API, we connect to that.Will it break when Microsoft changes something? Microsoft manages the platform and gives notice of changes. We monitor every automation we build and fix issues as part of the service, so you're not the one who finds out.Who maintains it? We do, under your managed plan. Everything is documented so your team can understand it too, and you own it.Can our own staff build automations later? Yes, and we encourage it, within governance rules we set up so that citizen-built flows are secure and supported rather than a hidden risk. ### Keep exploring #### AI and Copilot Safe, measurable Copilot and AI adoption. #### Document management and workflow Organised, compliant document management in Microsoft 365. #### Contact Speak to a real person about your IT. ### ## Document management and workflow | Clipeum IT URL: https://www.clipeumit.com/automation/documents/ Home/Business automation/Document management and workflow ## Find any document in seconds. Keep it compliant for years. Lost files, cluttered folders and 10 versions of the same contract. We implement secure, centralised document management in Microsoft 365 that your team will actually use. Book a callSend us a message ### What good looks like #### One organised structure SharePoint and Teams laid out around how your business works. #### Search that works Metadata and naming so the right document comes up first. #### Version control One current version, with a full history behind it. #### Secure sharing Share externally without losing control of sensitive files. #### Retention rules Documents kept for as long as the law requires, then removed. #### Workflow Reviews, approvals and sign-offs built into the document itself. ### Easier collaboration, lower admin, stronger security A well-run document system means less time hunting and more time working. It also makes audits simpler, because you can show where information lives, who can see it and how long you keep it. Done properly, it's also the foundation for Copilot and AI tools, which rely on your documents being well organised and correctly permissioned. ### How we set it up #### Audit What you have, where it lives, who can see it and what's duplicated or obsolete. #### Structure A SharePoint design based on how you work, not a copy of the old folder tree. #### Migrate Content moved in phases with permissions mapped, and nothing lost. #### Govern Labels, retention and sharing rules applied automatically. #### Train Short sessions so people find things faster on day 1 than they did before. ### Compliance built in #### Retention labels Keep records exactly as long as the law or your contracts require, then dispose of them properly. #### Audit trails Who opened, edited or shared what, and when. #### Sharing controls External sharing allowed where the business needs it and blocked where it doesn't. #### Access reviews Regular checks that the right people, and only the right people, can see each library. #### Version history Every change kept, so nothing is ever truly lost. #### Evidence for auditors The controls and records ISO 27001, Cyber Essentials and your customers ask to see. ### Document management questionsWhy move off a file server? A file server can't tell you who shared what, apply retention automatically, let people co-author a document or work safely from anywhere. SharePoint and OneDrive do all of that and are already in your Microsoft 365 plan.What about paper and scanned documents? Scanned documents can be captured, made searchable and filed automatically. We often start with the post and invoices.Can we keep some things longer than others? Yes. Retention is set per type of content, so contracts might be kept 7 years, HR records for a set period after someone leaves, and general working files for less.Will our people actually use it? They will if it's designed around how they work and they've been shown it. That's why the audit and training steps matter as much as the migration. ### Keep exploring #### Business process automation Power Platform apps and automated workflows. #### Data security Find, label, protect and back up the data that matters. #### AI and Copilot Safe, measurable Copilot and AI adoption. ### ## Defence and DCC | Clipeum IT URL: https://www.clipeumit.com/defence/ Home/Defence and DCC ## Cyber assurance for the defence supply chain. Primes are pushing cyber requirements down the chain, and Defence Cyber Certification is becoming the benchmark. We're an accredited DCC Level 0 Certification Body, and we already look after defence manufacturers and their suppliers every day. Book a callAsk which level you need ### What is Defence Cyber Certification? DCC is an organisation-wide cyber security certification developed by the Ministry of Defence and IASME. It's aligned to Defence Standard 05-138 and delivered through IASME's network of assured Certification Bodies. It gives suppliers a single certificate they can present across UK defence procurements, instead of answering the same questions contract by contract. Certification lasts 3 years, with an annual attestation and an annual Cyber Essentials renewal in between. The MOD has signalled 31 December 2026 as the point by which industry partners should hold Level 0. Counting back through scoping, Cyber Essentials and assessment, the time to start is now. ### 4 levels, set by contract risk The level you need depends on the cyber risk profile of the work. Every level starts with Cyber Essentials. L0 #### Very low risk 3 controls, plus Cyber Essentials The baseline for the whole supply chain L1 #### Low risk 101 controls, plus Cyber Essentials L2 #### Moderate risk 139 controls, plus Cyber Essentials Plus L3 #### High risk 144 controls, plus Cyber Essentials Plus Control counts as published for the scheme. Your contract or prime will specify the level required. ### How we help From your first Cyber Essentials certificate to the controls behind the higher levels. #### Scope Confirm the level you need and define what's in scope. #### Cyber Essentials Get Cyber Essentials or Cyber Essentials Plus in place. #### Certify DCC Level 0 assessment, with us as your Certification Body. #### Level up Implement and run the controls behind Levels 1 to 3 as contracts demand. ### Security that suits defence work #### 24/7 monitoring Our in-house UK SOC watching your environment day and night. #### Supplier questionnaires Help answering prime and DEFCON 658 cyber requirements. #### UK team Engineers and SOC analysts based here in the UK. #### Certified ourselves Cyber Essentials Plus and IASME Cyber Assurance held by the group. #### Manufacturing know-how Experience with shop-floor systems, engineering data and multi-site operations. #### Straight answers We'll tell you the level you actually need, not the most expensive one. They fully understood our security requirements and were able to deliver their solution, which met the needs of our customer security requirements. We have been extremely pleased with their cheerful help desk support and their dedication to helping us in our IT projects.ATB Group, engineering ### DCC questionsDo we need DCC if we don't hold MOD contracts directly? Any organisation can apply, whether or not it holds defence contracts. If you supply a prime or another defence supplier, expect it to be asked for as requirements flow down the chain.Which level do we need? It's set by the cyber risk profile of the contract, and your contract or prime will tell you. Level 0 is the baseline most of the supply chain will need.Is Level 0 a self-assessment? No. Every DCC level is independently assessed, including Level 0.We already have Cyber Essentials. Does that help? Yes. Every level starts with Cyber Essentials, so a current certificate means you're already part of the way there. ### Get DCC ready before the deadline. Tell us who you supply and we'll help you work out the level you need and the quickest route to it. Book a callSend us a message 0333 996 4264 info@clipeumit.com Take the 5-minute IT health check ## About us | Clipeum IT URL: https://www.clipeumit.com/about/ Home/About us ## Simple, human IT for growing UK businesses. We help small and mid-sized businesses make smarter technology decisions, stay secure and get more done. Whether it's a security gap, day-to-day support or busywork that should be automated, we make IT simpler and more human. Book a callMeet the team Who we work with ### Every sector where someone else checks your security. Our customers range from defence primes' suppliers to charities, fire services, law firms and estate agents. What they share is a customer, regulator, insurer or funder asking hard questions about their IT, and a team that would rather be running the business than worrying about it. Defence and aerospaceDCC, Cyber Essentials Plus and supplier questionnaires from primes. Manufacturing and engineeringShop-floor systems, design data and production that can't stop. Construction and tradesSites, subcontractors and shared drawings, secure and accessible. Professional servicesLegal, accountancy and consultancy firms with confidentiality at stake. Financial servicesClient money, regulators and insurers who want evidence. Property and estate agencyID checks, client funds and a team always on the move. Charities and not-for-profitDonor data, funders' requirements and tight budgets. Healthcare and carePatient and client data, CQC expectations and shift patterns. Education and trainingSafeguarding, remote learning and hundreds of devices. Logistics and transportDepots, drivers and systems that run around the clock. Plant hire and equipmentYards, telematics and hire systems that keep trading. Food, drink and agricultureProduction lines, cold chain and seasonal peaks. Recruitment and HRCandidate data, GDPR and fast-moving teams. Technology and softwareYour own customers' security questionnaires, answered properly. Local government and public sectorProcurement rules, accessibility and public accountability. Retail and hospitalityPayments, footfall systems and staff who change often. Public sector and emergency servicesCyber Essentials Plus, ITHC and the scrutiny that comes with public money. Insurance and legalClient confidentiality, regulators and evidence for your own insurers. Managed service providersIncident response, forensics and certification for your customers, delivered as your partner. Don't see your sector? We look after businesses in plenty more. If you have 10 to 500 people and technology you depend on, talk to us. ### Clipeum IT at a glance What we are A UK managed service provider and managed security service provider (MSP and MSSP). Who we serve Organisations with 10 to 500 people across the UK, with a strong focus on the defence supply chain. Where we are Offices across Norfolk, Suffolk and Hertfordshire, supporting customers nationwide. Our head office is in Norwich. Group companies Onyx IT, REACT Computer Partnership and CRIBB Cyber Security. Accreditations Microsoft Solutions Partner; Cyber Essentials Plus and IASME Cyber Assurance certified; a Certification Body for Cyber Essentials, Cyber Essentials Plus, IASME Cyber Assurance and DCC Level 0 through CRIBB Cyber Security. Recognition MSP Titans of the Industry finalist, Advanced Cybersecurity, 2025 and 2026. ### Why Clipeum? Clipeum comes from the Latin for a shield: the round one Roman soldiers carried into battle. It's a fair description of the job. We stand between your business and the things that would stop it working, and we'd rather deal with a problem before you ever hear about it. That means proactive support, not reactive patch-ups. Security that's watching around the clock. And a relationship with people who know your business, not a ticket number. 10 to 500Employees at the businesses we support 30Specialists across the group 3Offices across Norfolk, Suffolk and Hertfordshire; serving customers nationwide 24/7In-house UK security operations centre ### What you get with us Whether you're exploring automation, need serious cyber security or simply want IT that works, this is how we operate. #### No jargon One relationship for all your IT, explained in plain English. #### Problem prevention Proactive support, not reactive patch-ups. #### UK based Engineers who understand your day-to-day, never an overseas call centre. #### Built to scale Solutions designed to evolve as your business grows. ### What makes us different Clipeum IT was formed by bringing together 3 highly respected technology firms: Onyx, REACT and CRIBB. Together they give our customers the best of both worlds, deep regional experience and national reach. We didn't just join forces. We strengthened the support network for businesses right across the UK, with one team, one set of standards and one security operations centre behind every customer. Our heritage ### Why now? The IT landscape is moving fast, and SMEs are often left behind. Between evolving cyber threats, supply chain requirements like Cyber Essentials and DCC, and the arrival of AI, it's easy to feel overwhelmed. With the right partner, technology stops being a burden and becomes a growth driver. We're ready to help you rethink what's possible, so you can focus on what you do best: running your business. ### Some of the people you'll work with Every customer gets named people, not a queue. JDRead bio John DaleManaging Director PCRead bio Patrick CarolanTechnical Director, CRIBB Cyber Security JDRead bio Josh DaviesGroup Sales Director MGRead bio Michael GrayGroup Operations Director See the whole team ### Let's talk about your IT. Tell us what's frustrating you about your IT or security. We'll give you an honest view of what we'd change, whether or not you work with us. Book a callSend us a message 0333 996 4264 info@clipeumit.com Take the 5-minute IT health check ## Our team | Clipeum IT URL: https://www.clipeumit.com/about/team/ Home/About us/Our team ## The people behind your technology. Specialists across managed IT, cyber security, cloud and automation, so every solution is backed by real-world expertise and a friendly face. Click anyone to read their story. Leadership Strategy and alignment Helpdesk and engineering Founders and board 2people on this page 0UK offices 24/7security operations centre 1team behind every customer 7 people ### Leadership The team running the group day to day. JDRead bio John DaleManaging Director PCRead bio Patrick CarolanTechnical Director, CRIBB Cyber Security JDRead bio Josh DaviesGroup Sales Director MGRead bio Michael GrayGroup Operations Director DMRead bio Daniel MiddleditchGroup Technical Director CSRead bio Clare SowryFinance and Office Manager PMRead bio Penny MathewsFinance and Office Manager 5 people ### Strategy and alignment Your technical alignment managers and virtual CIOs, keeping your IT to standard and on plan. JERead bio Joe EdeHead of Technical Alignment ARRead bio Andrew RouseTechnical Alignment Manager DFRead bio Dominic FutterTechnical Alignment Manager DORead bio Dillon OliverVirtual Chief Information Officer LWRead bio Leon WilkinsonVirtual Chief Information Officer 11 people ### Helpdesk and engineering The engineers who answer the phone, fix the problem and keep your systems healthy. NMRead bio Nick MargerumHead of Helpdesk MBRead bio Matt BusseyHead of Helpdesk LHRead bio Leon HilderCyber Security Engineer TWRead bio Tom WilsonSupport Engineer JTRead bio Jordan TooneSupport Engineer KERead bio Kade EdwardsSupport Engineer WKRead bio Will Kiddle-MorrisSupport Engineer KGRead bio Kieron GrewSupport Engineer DTRead bio Darren TunstallSupport Engineer LDRead bio Luis DoneySupport Engineer MLRead bio Matthew LevellSupport Engineer 7 people ### Founders and board Experience from telecoms, cyber security, finance, law and M&A at the very top. ABRead bio Adam BarrettFounder and CEO AVRead bio Attila Vittai OBEFounder and Chairman SCRead bio Stuart ClarkeFounder and Finance Director KARead bio Ken AllanFounder DERead bio David EvansFounder EGRead bio Edwin GodfreyFounder DPRead bio David ParryFounder ### How our team makes the difference #### Real experience Hands-on knowledge from across the UK's IT landscape. #### Clear communication Honest, helpful advice without the jargon. #### Responsive support UK-based professionals, available when you need them. #### Specialists Your systems deserve focused expertise, not generalists. ### Want to meet the people who'd look after you? Book a call and you'll speak to someone from this page, not a sales script. Book a callSend us a message 0333 996 4264 info@clipeumit.com Take the 5-minute IT health check ## Our heritage | Clipeum IT URL: https://www.clipeumit.com/about/heritage/ Home/About us/Our heritage ## 3 respected firms. One stronger partner. Clipeum IT brings together Onyx IT, REACT Computer Partnership and CRIBB Cyber Security. Deep local roots, national reach, and specialists in every part of your technology. Book a call The group ### 3 firms, one team Each firm keeps its name, its people and its local roots. Together they share one helpdesk, one 24/7 SOC and one set of standards. #### Onyx IT Norwich, Norfolk Strategic IT and business cyber defence, trusted by Norfolk businesses since 1989. About Onyx #### REACT Computer Partnership Woodbridge, Suffolk Measurably better IT support since 1997, and home to much of our Power Platform expertise. About REACT #### CRIBB Cyber Security Hertfordshire Our cyber assurance arm: penetration testing, certification and data protection, and a UK government-backed Certification Body since 2016. About CRIBB Timeline ### How we got here 3 firms with decades behind them, and one group built to give every customer all of it. 1989 #### Onyx IT founded in Norwich Proactive IT support for Norfolk businesses, many of whom are still customers today. 1997 #### REACT Computer Partnership founded in Woodbridge Measured, professional IT support and consultancy for Suffolk and beyond. 2016 #### CRIBB Cyber Security founded in Hertfordshire A government-backed Certification Body for Cyber Essentials and IASME Cyber Assurance. 2025 #### Clipeum IT Group #### 3 firms, one team Onyx, REACT and CRIBB come together under Clipeum IT: one helpdesk, one 24/7 security operations centre, one set of standards. 2025 and 2026 #### MSP Titans of the Industry finalist Advanced Cybersecurity category, 2 years running, the only UK firm in the category both years. 2026 #### DCC Level 0 Certification Body Accredited to certify the defence supply chain under Defence Cyber Certification. ### What it means for you One team and one helpdesk platform across every office A shared 24/7 security operations centre behind every customer The same standards and TAM reviews, whichever office looks after you Local engineers who can be on site, with national depth behind them Specialists in security, automation and governance under one roof It's that extra level of care from Onyx that we love. Late one night, outside of normal or extended support hours, I couldn't connect to my Wi-Fi. Andrew, one of their lovely engineers (they are all lovely), picked up my ticket and drove out to help. Needless to say, when he tried to connect it did it first time, LoL.Monk Plant Hire, plant hire ### ## Case studies | Clipeum IT URL: https://www.clipeumit.com/case-studies/ Home/Case studies ## Case studies Real organisations, real deadlines, real outcomes. More added as customers give us permission to tell their stories. Emergency services ### Bedfordshire Fire and Rescue Service Cyber Essentials renewed and Cyber Essentials Plus achieved on time, for 550+ staff across 14 stationsRead the case study ### Want to be the next one? Tell us where you are and what's being asked of you. We'll show you the quickest credible route. Book a callSend us a message 0333 996 4264 info@clipeumit.com Take the 5-minute IT health check ## Case study: Bedfordshire Fire and Rescue Service | Clipeum IT URL: https://www.clipeumit.com/case-studies/bedfordshire-fire-and-rescue/ Home/Case studies/Case study: Bedfordshire Fire and Rescue Service Case study, Emergency services ## Bedfordshire Fire and Rescue Service With a Cyber Essentials certificate about to expire and a hard deadline, a fire and rescue service covering more than 550 staff and 14 stations needed a Certification Body that could move fast and get it right first time. IASME recommended CRIBB. Book a callOur certification service Delivered by CRIBB Cyber Security, the assurance arm of the Clipeum group The outcome Cyber Essentials renewed and Cyber Essentials Plus achieved on time, for 550+ staff across 14 stations ### The challenge The service's Cyber Essentials certificate was close to expiry, and its contracts and insurers required continuous certification. It wanted to step up to Cyber Essentials Plus in the same window, which means independent technical testing of real devices, not just a questionnaire. The estate was varied: virtual desktops, cloud servers and a fleet of mobile devices across 14 sites, all of which had to be in scope. ### What we did A gap review against the 5 Cyber Essentials controls, with a prioritised list of what would fail and how to fix it. Renewal of the Cyber Essentials certificate so there was no gap in cover. Cyber Essentials Plus assessment by our assessors: vulnerability scans and technical verification of a sample of virtual desktops, cloud servers and mobile devices. Clear reporting the service could hand to its board, insurers and partners. ### The result Cyber Essentials renewed and Cyber Essentials Plus achieved within the deadline. Every device type in the estate verified, including the virtual and mobile estate that often trips organisations up. A recommendation from IASME, the scheme's own delivery partner, which is about as strong an endorsement of a Certification Body as it gets. ### Keep exploring #### Certification Cyber Essentials, Plus, IASME, DCC, PCI DSS and ISO 27001, from an accredited Certification Body. #### Cyber assurance Independent testing, certification and governance from CRIBB, our Certification Body. #### Defence and DCC DCC certification and cyber assurance for the defence supply chain. ### Need certification before a deadline? Tell us the date and what you hold today. We'll map the quickest route and assess you ourselves. Book a callSend us a message 0333 996 4264 info@clipeumit.com Take the 5-minute IT health check ## Onyx IT | Clipeum IT URL: https://www.clipeumit.com/about/heritage/onyx/ Home/About us/Our heritage/Onyx IT ## Expert IT support for your business, since 1989. Onyx IT has looked after the technology behind East of England businesses for more than 35 years, and many customers have been with us from the start. We don't just manage your IT, we align it with where your business is going. Book a call 01603 414142 10years of IT support, since 1989 Norwich, Norfolk ### Our story Founded in Norwich in 1989, Onyx IT built its name on proactive support and straight talking: fixing things before they break, explaining them in plain English and taking the time to understand what each business is actually trying to do. Today Onyx is the Norwich home of the Clipeum group. The same engineers, the same standards, backed by a 24/7 security operations centre, a certification body and automation specialists across the group. How the group fits together Onyx ### What do you need from your IT? Three reasons businesses come to Onyx, and where each one leads. #### Growth Scale without friction. Cloud services, modern devices and systems that grow with you, so technology never holds a good business back.Find out more #### Safety and security Resilience built in: layered defences, tested backups and our own SOC watching around the clock.Find out more #### IT management Risk understood and managed, with a technical alignment manager keeping you to standard and a vCIO planning ahead.Find out more Services ### What Onyx does More than 37 years of experience, now backed by the whole Clipeum group. Here's some of what we do. IT support Cloud computing Microsoft 365 Power Apps and automation Infrastructure upgrades GDPR compliance Document management vCIO service Site-wide Wi-Fi Cyber security Why Onyx? ### More than an IT supplier. A partner. We take the time to understand your goals and challenges, and tailor what we do to fit. #### Keep your business safe Cyber risks identified and reduced with expertly designed defences, breach prevention and staff training. #### Worry less about IT A dedicated team of helpful, qualified engineers who work around your business, not through it. #### Stay ahead of the curve A clear IT roadmap, so you can concentrate on growing your business and your client base. #### Empower your team Systems aligned, protected and managed so your people can collaborate and deliver faster. #### Spend wisely No outdated systems or quick-fix workarounds. You only pay for the services you need. #### Increase efficiency Streamlined processes on modern systems, managed and monitored so they stay that way. What Onyx customers sayIt's that extra level of care from Onyx that we love. Late one night, outside of normal or extended support hours, I couldn't connect to my Wi-Fi. Andrew, one of their lovely engineers (they are all lovely), picked up my ticket and drove out to help. Needless to say, when he tried to connect it did it first time, LoL.Monk Plant Hire, plant hireNothing is too much trouble for the team and the speed at which they respond is very impressive. As well as hands-on support and monitoring of our network, they give us advice and guidance on IT storage, systems and backup. Invaluable, as we no longer have that expertise in-house.Age UK Norfolk, charityI've been so impressed by the detailed understanding they have about the complexities of our business, and what we need to future proof our operation across Norfolk. Ultimately, we are fit for purpose, agile and adaptive thanks to their careful management.Sowerbys, estate agency Get in touch with Onyx ### Let's get started. Tell us a little about your business and what you'd like to change. One of the Onyx team will be in touch. 100 Hellesdon Park Road, Drayton High Road, Norwich, Norfolk NR6 5DR 01603 414142 getintouch@onyx-it.co.uk onyx-it.co.uk Member of Norfolk Chambers of Commerce Supported by New Anglia Local Enterprise Partnership through the Growing Business Fund Onyx IT is a trading name of Clipeum IT Group Limited, registered in England and Wales (company number 02358518). Your namePlease enter your name. Company EmailEnter a valid email address. Phone MessagePlease tell us a little about what you need. I give consent for Onyx to retain my data and respond to my enquiry. We never share your details. Send to Onyx ### Prefer to talk to the wider group? Clipeum IT brings Onyx together with REACT and CRIBB: one helpdesk, one 24/7 SOC and one Certification Body behind every customer. Book a callSend us a message 0333 996 4264 info@clipeumit.com Take the 5-minute IT health check ## REACT Computer Partnership | Clipeum IT URL: https://www.clipeumit.com/about/heritage/react/ Home/About us/Our heritage/REACT Computer Partnership ## You call. We react. Supporting business IT since 1997. REACT Computer Partnership is an IT support and consultancy business based in Woodbridge, Suffolk, delivering measurably better IT to businesses across the UK. We supply the technology, provide the innovation and make sure your IT achieves its goals. Book a call 01394 387337 3years of IT support, since 1997 Woodbridge, Suffolk ### Our story REACT was founded in 1997 on a simple idea: IT is a professional business service, as valuable as your accountant or solicitor, and it should be measured like one. We continually measure, review and refine our support, and we have years of statistics to prove it. As part of the Clipeum group, REACT is home to much of our Power Platform and business automation expertise, alongside the day-to-day support Suffolk businesses have relied on for nearly 30 years. How the group fits together REACT ### What do you need from your IT? Three reasons businesses come to REACT, and where each one leads. #### Support Fast, friendly, measured. We don't just hear what you're saying, we make sure we understand it, then fix it properly.Find out more #### Innovation Technology never stands still. We evaluate what's new so we can advise you on what's worth adopting, and build it when it is.Find out more #### Security Layered protection and 24/7 monitoring from the group's own security operations centre.Find out more Services ### What REACT does More than 29 years of experience, now backed by the whole Clipeum group. Here's some of what we do. IT support and helpdesk Power Platform and automation Microsoft 365 Infrastructure and networks Cloud and hosting Backup and continuity Custom business applications Strategy and vCIO Cyber security Cyber Essentials Why REACT? ### More than an IT supplier. A partner. We take the time to understand your goals and challenges, and tailor what we do to fit. #### Unleash the potential of your IT We listen to your concerns and your issues, and we make sure we understand them before we act. #### A trusted digital working partner Our expertise goes beyond the technical. We understand the human and practical needs of an organisation. #### Measurable IT support We continually measure, review and refine our support, with the statistics to back it up. #### We innovate on your behalf We understand and evaluate new developments so you don't have to, and advise you on what matters. #### Productive people Effective IT makes staff more productive and reduces the risk of things being overlooked or misunderstood. #### Profitability, not just uptime Everything we do is aimed at improving your business's performance through intelligent use of technology. Get in touch with REACT ### Let's get started. Tell us a little about your business and what you'd like to change. One of the REACT team will be in touch. Deben Mill Business Centre, Woodbridge, Suffolk IP12 1BL 01394 387337 info@reactcp.co.uk reactcp.co.uk Rated 5 stars by customers on Google Fujitsu Select Expert partner REACT Computer Partnership Limited is part of the Clipeum IT group. Registered in England and Wales, company registration no. 04478725. Your namePlease enter your name. Company EmailEnter a valid email address. Phone MessagePlease tell us a little about what you need. I give consent for REACT to retain my data and respond to my enquiry. We never share your details. Send to REACT ### Prefer to talk to the wider group? Clipeum IT brings REACT together with Onyx and CRIBB: one helpdesk, one 24/7 SOC and one Certification Body behind every customer. Book a callSend us a message 0333 996 4264 info@clipeumit.com Take the 5-minute IT health check ## CRIBB Cyber Security | Clipeum IT URL: https://www.clipeumit.com/about/heritage/cribb/ Home/About us/Our heritage/CRIBB Cyber Security ## The assurance arm of the group. Test it, certify it, prove it. CRIBB Cyber Security is a UK government-backed Certification Body for Cyber Essentials, Cyber Essentials Plus and IASME Cyber Assurance, and an accredited DCC Level 0 Certification Body. Penetration testing, vulnerability scanning, data protection and incident response, delivered by people who assess these standards for a living. Book a call 0333 996 4264 1years of cyber assurance, since 2016 Hertfordshire ### Our story Founded in Hertfordshire in 2016, CRIBB set out to make credible cyber assurance accessible to organisations that don't have a security department: fire and rescue services, charities, law firms, manufacturers and the suppliers of defence primes. Every client CRIBB has guided through certification has achieved it. As part of the Clipeum group, CRIBB is the independent proof behind everything else we do: we run your IT, defend it around the clock, and CRIBB certifies that it works. How the group fits together CRIBB ### What do you need from your IT? Three reasons businesses come to CRIBB, and where each one leads. #### Test Penetration testing, vulnerability scanning and cloud verification that find the weaknesses before someone else does.Find out more #### Certify Cyber Essentials, Cyber Essentials Plus, IASME Cyber Assurance, DCC, PCI DSS and ISO 27001, assessed by our own accredited body.Find out more #### Govern DPO as a Service, GDPR reviews, information governance and incident response, so compliance is kept, not just achieved.Find out more Services ### What CRIBB does Independent testing, certification and governance, now available to every Clipeum customer. Penetration testing Vulnerability scanning Cyber Essentials and Plus IASME Cyber Assurance Defence Cyber Certification PCI DSS ISO 27001 implementation DPO as a Service Incident response and forensics GDPR and information governance Why CRIBB? ### More than an IT supplier. A partner. We take the time to understand your goals and challenges, and tailor what we do to fit. #### An accredited Certification Body Certification issued by us on behalf of IASME, plus DCC Level 0 for the defence supply chain. #### A 100% record Every client CRIBB has guided through certification has passed. #### Assessors who test, testers who assess The same people who mark Cyber Essentials run your pen test, so nothing is theoretical. #### Sectors others avoid Emergency services, defence, healthcare and education, with the compliance depth they demand. #### Backed by the whole group Findings can be fixed by Clipeum engineers and watched by our SOC, or handed to your own team. #### Plain English Reports written for the board as well as the engineers, with a clear fix for every finding. Get in touch with CRIBB ### Let's get started. Tell us a little about your business and what you'd like to change. One of the CRIBB team will be in touch. Hertfordshire (serving clients across the UK) 0333 996 4264 info@clipeumit.com IASME Certification Body since 2016 Every certification client to date has achieved certification CRIBB Cyber Security Ltd is part of the Clipeum IT group. Registered in England and Wales, company registration no. 10495840. Your namePlease enter your name. Company EmailEnter a valid email address. Phone MessagePlease tell us a little about what you need. I give consent for CRIBB to retain my data and respond to my enquiry. We never share your details. Send to CRIBB ### Prefer to talk to the wider group? Clipeum IT brings CRIBB together with Onyx and REACT: one helpdesk, one 24/7 SOC and one Certification Body behind every customer. Book a callSend us a message 0333 996 4264 info@clipeumit.com Take the 5-minute IT health check ## Insights | Clipeum IT URL: https://www.clipeumit.com/insights/ Home/Insights ## News and insights Practical guidance on security, IT and AI for businesses without a security department, plus news from the group. ### Latest insightCyber security #### Cyber Essentials or Cyber Essentials Plus: which one do you actually need? The 2 certifications share the same 5 controls. The difference is who checks, and who's asking you for it. An assessor's view.2026, 4 minute read Cyber security #### What actually happens in a penetration test Hoodies and green text are for films. Here's what a real, authorised test of your business looks like, step by step.Company news #### Clipeum IT is now a Defence Cyber Certification Level 0 Certification Body We're now accredited to assess organisations for DCC Level 0, the new baseline for the UK defence supply chain.Company news #### Finalist again: MSP Titans of the Industry, Advanced Cybersecurity For the second year running we're one of 10 finalists worldwide, and the only UK business in the category.Cyber security #### AI is now being used to build ransomware. Here's how to protect your business Criminals are using AI to write malware and phishing faster than ever. The defences that work are more familiar than you might think.Cyber security #### The top 5 cyber threats facing UK SMEs today Small and medium businesses are targeted precisely because attackers expect weaker defences. These are the threats we see most.Cyber security #### Essential data security measures for small businesses SMEs face a double threat: attackers who see them as easy targets, and regulators and customers who expect their data to be protected. Here are the measures that matter most.Buying guide #### What to look for in a cyber security provider Not all providers are equal. Here are the questions worth asking before you sign.Automation #### Where AI helps your business, and where it doesn't AI is a powerful tool with real limits. A practical guide to where it earns its keep. ### Weekly Cybersecurity Drip Tips One free cyber security tip every week on how to keep yourself and your business safe. Relevant to any business, written in plain English, and easy to unsubscribe. Name Work emailEnter a valid email address, like name@company.co.uk. I'm happy for Clipeum IT to store my details to send me the Weekly Cybersecurity Drip Tips. We never share them with third parties. Subscribe ### ## Referral programme | Clipeum IT URL: https://www.clipeumit.com/referrals/ Home/Referral programme ## Introduce a business. Earn up to £1,000. If you know a business that deserves better IT, introduce them to us. When they join, you both receive a credit equal to one month's support fees, up to £1,000 each. ### How it works #### Introduce Tell us who they are using the form below, or just mention your name when they call. #### We talk We have an honest, no-pressure conversation about their IT. #### They join If they become a customer, we let you know. #### You're both credited You and the new customer each receive a credit equal to one month of their support fees, up to £1,000. ### Referral terms The credit equals one month of the new customer's recurring support fees, capped at £1,000 for each party. It's applied once the new customer has signed a managed services agreement and paid their first invoice. The business you introduce must not already be a Clipeum IT, Onyx IT, REACT or CRIBB customer. Credits are applied to your Clipeum IT account. If you're not a customer, ask us how your reward is paid. Please let the business know before you pass on their details. We can change or end the programme at any time. Introductions already made are honoured. ### Make an introduction Please let the business know you're passing on their details first. Your nameEnter your name. Your emailEnter a valid email address. Business you're introducingEnter the business name. Their contact name Their email or phoneAdd a way for us to reach them. I've told this business I'm passing on their details, and I agree to the referral terms. Send introduction ### ## IT health check | Clipeum IT URL: https://www.clipeumit.com/health-check/ Home/IT health check ## How well protected is your business? Find out in 5 minutes. 18 questions across 5 areas that a good IT partner should already have answered with you. Your score updates as you go, and nothing is sent anywhere unless you choose to. ### 1Protection Is your internet connection protected by a business-grade firewall that's kept up to date and reviewed?Home-grade routers and forgotten firewall rules are one of the most common ways in. YesNot sureNo Are all your devices and servers patched within 14 days of security updates being released?14 days is the Cyber Essentials standard. Most attacks use old, well-known flaws. YesNot sureNo Do all devices run modern endpoint detection and response, rather than just antivirus?Antivirus looks for known files. Detection and response spots behaviour, which is how ransomware gets caught. YesNot sureNo Is inbound email filtered for phishing, spoofing and malicious links, with SPF, DKIM and DMARC set up on your domain?Email is still the number one way in, and an unprotected domain lets criminals send email as you. YesNot sureNo Are all laptops and mobile devices encrypted, and can you wipe them remotely if they're lost or stolen?A lost laptop should be an inconvenience, not a data breach. YesNot sureNo ### 2Detection and response Is someone watching your systems for threats out of hours and at weekends?Attackers favour 2am on a Saturday. Alerts nobody reads are not monitoring. YesNot sureNo Do you have a written incident response plan that names who does what if you're breached, and has it been rehearsed?The first hour of an incident decides how bad it gets. Working it out on the day is too late. YesNot sureNo Are sign-ins, admin actions and cloud activity logged and kept for at least 90 days?Without logs you can't tell what an attacker touched, or prove to insurers and customers what didn't happen. YesNot sureNo ### 3Recovery Have you restored from backup in a real test in the last 12 months?A backup that has never been restored is a hope, not a plan. YesNot sureNo Are your Microsoft 365 emails and files backed up separately from Microsoft?Microsoft keeps the service running. Getting back deleted or encrypted data is your responsibility. YesNot sureNo Do you know how long it would take to get back up after a total outage, and has the business agreed that number?Recovery time and recovery point objectives turn a vague worry into a plan you can budget for. YesNot sureNo ### 4People and access Is every account protected with multi-factor authentication, including email, remote access and admin accounts?A stolen password is far less useful when it isn't enough on its own. YesNot sureNo Do your staff get regular phishing simulations and short security training?Your people are the most targeted layer and, when trained, the best defence. YesNot sureNo Are admin rights limited to the few people who need them, using separate admin accounts?Everyday accounts with admin rights turn a single phishing click into a full compromise. YesNot sureNo When someone leaves, is their access removed everywhere on the day they go?Orphaned accounts are a favourite way back in, and a common audit finding. YesNot sureNo ### 5Governance and compliance Does your IT provider sit down with you for a strategic review at least once a quarter?If nobody is planning your technology, you're only ever reacting to it. YesNot sureNo Do you have a risk register that includes your cyber risks?Insurers, customers and Cyber Essentials assessors all want to see that you know your own risks. YesNot sureNo Do you hold a current Cyber Essentials or Cyber Essentials Plus certificate?Increasingly a condition of contracts and insurance, and the baseline for Defence Cyber Certification. YesNot sureNo --0 of 18 answered #### Answer the questions to see your score. Protection0/5 Detection and response0/3 Recovery0/3 People and access0/4 Governance and compliance0/3 ### Want a proper look under the bonnet? A health check is a start. Book a call and we'll talk through your answers and what we'd prioritise. Book a callSend us a message 0333 996 4264 info@clipeumit.com Defence and DCC ## Contact | Clipeum IT URL: https://www.clipeumit.com/contact/ Home/Contact ## Chat with the experts. Want to take your technology, team and operations to the next level? We're ready when you are. Book a call straight into our diary, or send a message and we'll be in touch shortly. Your nameEnter your name. Company EmailEnter a valid email address, like name@company.co.uk. Phone What can we help with?Managed ITCyber securityBusiness automationDefence and DCCSomething else MessageAdd a short message so we know how to help. I'm happy for Clipeum IT to store my details on its CRM to answer my enquiry. They won't be shared with third parties. Tick the box so we can store your details and reply. Send message Or book a call instead 0333 996 4264Talk to our team info@clipeumit.comWe'll reply shortly Book a callPick a time in our diary LinkedInFollow Clipeum IT Head office100 Hellesdon Park Road, Drayton High Road, Norwich, Norfolk NR6 5DR NorwichHead office and Onyx ITWoodbridgeREACT Computer PartnershipHertfordshireCRIBB Cyber Security £1,000 ### Not for you, but know someone? Introduce a business to us and earn up to £1,000 in credit when they join.How referrals work ## Cookies and privacy | Clipeum IT URL: https://www.clipeumit.com/privacy/ Home/Cookies and privacy ## Cookies and privacy How Clipeum IT Ltd and the companies in our group collect, use and protect your personal data, and how this website uses cookies. Last updated September 2026. ### Who we are Clipeum IT Ltd (company number 12150269) is the data controller for this website. Our registered office is 100 Hellesdon Park Road, Drayton High Road, Norwich NR6 5DR. The group includes Onyx IT, REACT Computer Partnership Limited (04478725), CRIBB Cyber Security Ltd (10495840) and Clipeum IT Group Limited (02358518). Questions about this policy can be sent to info@clipeumit.com or by post to the address above. ### What we collect and why When you contact us, book a call, request a report, make a referral or subscribe to our emails, we collect the details you give us: typically your name, business, email address, phone number and your message. We use them to respond to you, provide the service you asked for and, where you've agreed, send you relevant updates. Our lawful bases are your consent, our legitimate interest in responding to enquiries, and the performance of a contract where you become a customer. The IT health check runs entirely in your browser. Nothing is sent to us unless you choose to share your results through the contact form. If you request a dark web exposure report, we use the domain you give us to search breach data and criminal marketplaces for exposed credentials linked to that domain. We only run the check for a domain you tell us you're authorised to check. ### Who we share it with Your details are stored in our customer relationship system and, where you become a customer, our service management platform. We use trusted UK and EU based suppliers to run these systems and our email tools under contracts that require them to protect your data. We never sell your data and we don't share it with third parties for their own marketing. ### How long we keep it Enquiry details are kept for up to 24 months after our last contact with you unless you become a customer, in which case they're kept for the life of the relationship and up to 6 years afterwards for legal and accounting reasons. Marketing preferences are kept until you unsubscribe. ### Cookies This site uses essential cookies and local storage that make it work, for example remembering that you've already seen the introduction animation. We also use website analytics and visitor identification tools, which set cookies to help us understand how the site is used and which businesses visit. These are only set with your consent, and you can withdraw it at any time from your browser settings or the cookie preferences link in the footer. ### Your rights You have the right to ask for a copy of the personal data we hold about you, to have it corrected or deleted, to object to or restrict how we use it, and to withdraw consent at any time. Email info@clipeumit.com and we'll respond within one month. If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk. ### Changes We'll update this page when our practices change, and note the date at the top. ## Cyber Essentials or Cyber Essentials Plus: which one do you actually need? | Clipeum IT URL: https://www.clipeumit.com/insights/cyber-essentials-or-plus/ Home/Insights Cyber security ## Cyber Essentials or Cyber Essentials Plus: which one do you actually need? The 2 certifications share the same 5 controls. The difference is who checks, and who's asking you for it. An assessor's view.By Patrick Carolan, Technical Director, CRIBB Cyber Security, and Cyber Essentials assessor. 2026, 4 minute read I mark Cyber Essentials assessments and carry out Cyber Essentials Plus testing, so this is the question I'm asked most. The short answer: if someone else has told you which one they need, that's your answer. If nobody has, start with Cyber Essentials and plan to step up. ### The same 5 controls Both certifications assess the same 5 technical controls: firewalls, secure configuration, security update management, user access control and malware protection. Get those right and you stop the large majority of commodity attacks. Neither certification covers governance, policy or people; that's what IASME Cyber Assurance is for. ### Cyber Essentials: verified self-assessment You answer a set of questions about your systems, a board member signs to say they're true, and an assessor like me marks them. It's fast, it's affordable, and it's the minimum for most central government contracts. It also comes with cyber liability insurance for UK organisations under £20 million turnover that certify their whole organisation. ### Cyber Essentials Plus: we check Plus takes your Cyber Essentials answers and tests them. We scan a sample of your devices and servers for missing patches and weak configuration, test whether malware and malicious email get through, and verify your cloud accounts. If something fails you have 21 days to fix it. It's the level primes, insurers and an increasing number of tenders ask for, and every DCC level above 1 requires it. ### How to decide Bidding for defence or government work: check the contract. Cyber Essentials is the floor; Plus is increasingly the expectation. Your insurer or a big customer has asked: they'll say which. It's usually Plus. Nobody has asked yet: get Cyber Essentials now, use the year to tidy up, and go for Plus at renewal. Whichever you choose, prepare first. A gap review and a pre-assessment scan turn a nervous certification into a formality, which is why every organisation CRIBB has guided through the process has passed. If you'd like to talk it through, get in touch, or read more about the certifications we deliver. PC Written byPatrick CarolanTechnical Director, CRIBB Cyber Security, and Cyber Essentials assessorAsk Patrick a question Weekly Cybersecurity Drip Tips #### One free cyber security tip a week, for you and your business Short, practical and free. Easy to unsubscribe.Work emailEnter a valid work email address. I'm happy for Clipeum IT to send me the Weekly Cybersecurity Drip Tips.Subscribe ### More insightsCyber security #### What actually happens in a penetration test Hoodies and green text are for films. Here's what a real, authorised test of your business looks like, step by step.Cyber security #### AI is now being used to build ransomware. Here's how to protect your business Criminals are using AI to write malware and phishing faster than ever. The defences that work are more familiar than you might think.Cyber security #### The top 5 cyber threats facing UK SMEs today Small and medium businesses are targeted precisely because attackers expect weaker defences. These are the threats we see most. ### ## What actually happens in a penetration test | Clipeum IT URL: https://www.clipeumit.com/insights/what-happens-in-a-pen-test/ Home/Insights Cyber security ## What actually happens in a penetration test Hoodies and green text are for films. Here's what a real, authorised test of your business looks like, step by step.By Patrick Carolan, Technical Director, CRIBB Cyber Security. 2026, 4 minute read Most people picture a penetration test as someone in a hoodie typing furiously. The reality is a scoped, authorised project with a start, a finish and a report you can hand to your board. Here's how one runs. ### 1. Scoping and authorisation We agree what's in scope: your external systems, your internal network, a web application, or all of them. We agree the goals, the rules (what's off limits, what hours, who to call), and you sign an authorisation. Nothing happens without it. ### 2. Reconnaissance We map your footprint the way an attacker would: domains and subdomains, exposed services, the technologies you run, what your staff share publicly. It's surprising how much a business gives away. ### 3. Testing and exploitation Automated tools find candidates; people prove them. We chain weaknesses together, a forgotten server here, a default password there, to show what an attacker could really reach. Anything destructive is agreed in advance or excluded. ### 4. Reporting You get 2 documents: a management summary that says where you stand and what to do first, and a technical report with every finding, its severity, the evidence and the fix. No jargon in the first, plenty of detail in the second. ### 5. Retest Once the fixes are in, we verify them and update the report. That updated report is what you show to the customer, insurer or auditor who asked. ### How often? At least annually, and after any big change. Pair it with regular vulnerability scanning in between and you'll know your weaknesses before anyone else does. Find out more about our penetration testing, or start with our 5-minute health check. PC Written byPatrick CarolanTechnical Director, CRIBB Cyber SecurityAsk Patrick a question Weekly Cybersecurity Drip Tips #### One free cyber security tip a week, for you and your business Short, practical and free. Easy to unsubscribe.Work emailEnter a valid work email address. I'm happy for Clipeum IT to send me the Weekly Cybersecurity Drip Tips.Subscribe ### More insightsCyber security #### Cyber Essentials or Cyber Essentials Plus: which one do you actually need? The 2 certifications share the same 5 controls. The difference is who checks, and who's asking you for it. An assessor's view.Cyber security #### AI is now being used to build ransomware. Here's how to protect your business Criminals are using AI to write malware and phishing faster than ever. The defences that work are more familiar than you might think.Cyber security #### The top 5 cyber threats facing UK SMEs today Small and medium businesses are targeted precisely because attackers expect weaker defences. These are the threats we see most. ### ## Clipeum IT is now a Defence Cyber Certification Level 0 Certification Body | Clipeum IT URL: https://www.clipeumit.com/insights/dcc-certification-body/ Home/Insights Company news ## Clipeum IT is now a Defence Cyber Certification Level 0 Certification Body We're now accredited to assess organisations for DCC Level 0, the new baseline for the UK defence supply chain.September 2026, 3 minute read We're proud to share that Clipeum IT is now an accredited Certification Body for Defence Cyber Certification (DCC) Level 0. DCC was developed by the Ministry of Defence and IASME to strengthen cyber resilience across the UK defence supply chain. It's delivered through IASME's network of assured Certification Bodies, and we're now one of them. ### What DCC is DCC is an organisation-wide certification aligned to Defence Standard 05-138. It has 4 levels, from 0 to 3, and the level a supplier needs depends on the cyber risk profile of the contract. Every level starts with Cyber Essentials, and Levels 2 and 3 require Cyber Essentials Plus. Level 0 is the foundation. It covers a small number of core controls on top of Cyber Essentials, and it isn't a self-assessment: it's independently assessed. Certification lasts 3 years, with an annual attestation in between. ### Why it matters now The MOD has signalled 31 December 2026 as the point by which industry partners should have Level 0 in place. That reaches well beyond the primes, into every business that supplies them. Counting back through scoping, Cyber Essentials and assessment, the time to start is now. ### How we can help Scoping your certification and checking your Cyber Essentials status Getting Cyber Essentials or Cyber Essentials Plus in place if you need it DCC Level 0 assessment Implementing the controls needed for higher levels as your contracts demand Much of our customer base is in defence and its supply chain, so this is a natural step for us. If you're not sure which level you need, talk to us or read more on our defence page. CI Written byThe Clipeum IT teamEngineers, analysts and assessors across the Clipeum groupMeet the team Weekly Cybersecurity Drip Tips #### One free cyber security tip a week, for you and your business Short, practical and free. Easy to unsubscribe.Work emailEnter a valid work email address. I'm happy for Clipeum IT to send me the Weekly Cybersecurity Drip Tips.Subscribe ### More insightsCompany news #### Finalist again: MSP Titans of the Industry, Advanced Cybersecurity For the second year running we're one of 10 finalists worldwide, and the only UK business in the category.Cyber security #### Cyber Essentials or Cyber Essentials Plus: which one do you actually need? The 2 certifications share the same 5 controls. The difference is who checks, and who's asking you for it. An assessor's view.Cyber security #### What actually happens in a penetration test Hoodies and green text are for films. Here's what a real, authorised test of your business looks like, step by step. ### ## Finalist again: MSP Titans of the Industry, Advanced Cybersecurity | Clipeum IT URL: https://www.clipeumit.com/insights/msp-titans-2026/ Home/Insights Company news ## Finalist again: MSP Titans of the Industry, Advanced Cybersecurity For the second year running we're one of 10 finalists worldwide, and the only UK business in the category.2026, 2 minute read Clipeum IT has been named a finalist in the Advanced Cybersecurity category at the 2026 MSP Titans of the Industry Awards. It's the second year in a row we've made the final in this category. There are 10 finalists worldwide, and for the second year we're the only UK business on the list. ### What the category recognises The Advanced Cybersecurity award recognises managed service providers that go beyond basic protection, delivering mature, layered security for their customers. For us, that means our in-house 24/7 security operations centre, managed detection and response, and a genuine focus on getting the fundamentals right for every customer, whatever their size. ### What it means for our customers Awards are nice, but they're really a reflection of the work our team does every day and night to keep customers safe. Thank you to every customer who trusts us with their security, and to the team who earn that trust. Want to see what advanced security looks like for a business your size? Book a call. CI Written byThe Clipeum IT teamEngineers, analysts and assessors across the Clipeum groupMeet the team Weekly Cybersecurity Drip Tips #### One free cyber security tip a week, for you and your business Short, practical and free. Easy to unsubscribe.Work emailEnter a valid work email address. I'm happy for Clipeum IT to send me the Weekly Cybersecurity Drip Tips.Subscribe ### More insightsCompany news #### Clipeum IT is now a Defence Cyber Certification Level 0 Certification Body We're now accredited to assess organisations for DCC Level 0, the new baseline for the UK defence supply chain.Cyber security #### Cyber Essentials or Cyber Essentials Plus: which one do you actually need? The 2 certifications share the same 5 controls. The difference is who checks, and who's asking you for it. An assessor's view.Cyber security #### What actually happens in a penetration test Hoodies and green text are for films. Here's what a real, authorised test of your business looks like, step by step. ### ## AI is now being used to build ransomware. Here's how to protect your business | Clipeum IT URL: https://www.clipeumit.com/insights/ai-ransomware/ Home/Insights Cyber security ## AI is now being used to build ransomware. Here's how to protect your business Criminals are using AI to write malware and phishing faster than ever. The defences that work are more familiar than you might think.2026, 4 minute read Artificial intelligence is everywhere, and unfortunately that includes criminal toolkits. Attackers are using AI to write convincing phishing emails in seconds, to generate and adapt malicious code, and to find weaknesses faster. ### What's changed The barrier to entry has dropped. Attacks that once needed skilled developers can now be assembled by people with far less expertise. Phishing emails no longer give themselves away with poor spelling. Malware can be tweaked quickly to slip past tools that rely on recognising known threats. ### What still works The good news: the defences that stop AI-built attacks are largely the same ones that stop everything else, done properly. Behaviour-based detection. Modern endpoint detection looks at what software does, not just what it looks like, so new variants still get caught. Multi-factor authentication. A perfect phishing email is far less useful if a stolen password isn't enough to get in. 24/7 monitoring. Ransomware operators favour nights and weekends. Someone needs to be watching. Tested, independent backups. If the worst happens, you recover rather than pay. Trained people. Regular phishing simulations keep staff sharp as the scams improve. ### Where to start If you're not sure how your business would stand up, take our 5-minute health check. It'll show you where the gaps are. CI Written byThe Clipeum IT teamEngineers, analysts and assessors across the Clipeum groupMeet the team Weekly Cybersecurity Drip Tips #### One free cyber security tip a week, for you and your business Short, practical and free. Easy to unsubscribe.Work emailEnter a valid work email address. I'm happy for Clipeum IT to send me the Weekly Cybersecurity Drip Tips.Subscribe ### More insightsCyber security #### Cyber Essentials or Cyber Essentials Plus: which one do you actually need? The 2 certifications share the same 5 controls. The difference is who checks, and who's asking you for it. An assessor's view.Cyber security #### What actually happens in a penetration test Hoodies and green text are for films. Here's what a real, authorised test of your business looks like, step by step.Cyber security #### The top 5 cyber threats facing UK SMEs today Small and medium businesses are targeted precisely because attackers expect weaker defences. These are the threats we see most. ### ## The top 5 cyber threats facing UK SMEs today | Clipeum IT URL: https://www.clipeumit.com/insights/top-5-threats/ Home/Insights Cyber security ## The top 5 cyber threats facing UK SMEs today Small and medium businesses are targeted precisely because attackers expect weaker defences. These are the threats we see most.2026, 4 minute read In the UK, a small or medium enterprise is one with fewer than 250 staff. That covers the vast majority of businesses, and attackers know many of them have limited security resources. ### 1. Phishing and business email compromise Still the most common way in. A convincing email leads to a stolen login, and from there attackers read inboxes, redirect invoices or launch further attacks. ### 2. Ransomware Files are encrypted and often stolen first, then held to ransom. Recovery without good backups can take weeks. ### 3. Account takeover Reused and weak passwords make it easy for attackers to walk straight in. Multi-factor authentication stops most of these attacks. ### 4. Supply chain attacks Attackers compromise a supplier or software provider to reach their real target. It's one reason primes and larger customers increasingly ask suppliers for Cyber Essentials and DCC. ### 5. Insider mistakes Not every incident is malicious. Misdirected emails, overshared files and lost devices cause real damage. Good access controls and training reduce the risk. Want to know how exposed you are? Try our health check or talk to our team. CI Written byThe Clipeum IT teamEngineers, analysts and assessors across the Clipeum groupMeet the team Weekly Cybersecurity Drip Tips #### One free cyber security tip a week, for you and your business Short, practical and free. Easy to unsubscribe.Work emailEnter a valid work email address. I'm happy for Clipeum IT to send me the Weekly Cybersecurity Drip Tips.Subscribe ### More insightsCyber security #### Cyber Essentials or Cyber Essentials Plus: which one do you actually need? The 2 certifications share the same 5 controls. The difference is who checks, and who's asking you for it. An assessor's view.Cyber security #### What actually happens in a penetration test Hoodies and green text are for films. Here's what a real, authorised test of your business looks like, step by step.Cyber security #### AI is now being used to build ransomware. Here's how to protect your business Criminals are using AI to write malware and phishing faster than ever. The defences that work are more familiar than you might think. ### ## Essential data security measures for small businesses | Clipeum IT URL: https://www.clipeumit.com/insights/data-security-measures/ Home/Insights Cyber security ## Essential data security measures for small businesses SMEs face a double threat: attackers who see them as easy targets, and regulators and customers who expect their data to be protected. Here are the measures that matter most.2026, 4 minute read Small and medium businesses hold a lot of valuable data: customer records, staff details, financial information and, increasingly, the data of larger customers up the supply chain. That makes them a target, and it makes data protection a business requirement rather than a technical nicety. ### Know what you hold and where You can't protect what you can't see. Start by understanding what personal and sensitive data you hold, where it lives (file servers, Microsoft 365, laptops, third-party systems) and who can reach it. Sensitivity labels in Microsoft 365 make this far easier than it used to be. ### Control who can access it Give people access to the data they need for their job and nothing more. Use separate accounts for admin work, remove access the day someone leaves, and protect every account with multi-factor authentication. ### Encrypt devices and data Every laptop and phone should be encrypted, and you should be able to wipe a lost device remotely. Data should be encrypted when it's stored and when it's sent, which modern cloud services do by default if they're configured properly. ### Stop data walking out of the door Data loss prevention rules can stop a spreadsheet of customer details being emailed to a personal address or shared publicly by mistake. Review external sharing settings regularly. ### Back it up, and test the backup Ransomware and human error are the 2 most likely ways to lose data. Keep independent backups, including of Microsoft 365, and restore from them in a real test at least once a year. ### Train your people Most data incidents start with a person: a phishing click, a misdirected email, a shared password. Short, regular training and phishing simulations make a measurable difference. ### Prove it Cyber Essentials gives you a recognised baseline, and customers, insurers and, in defence, the MOD increasingly expect it. If you're not sure where you stand, our health check is a good place to start, or read more about how we approach data security. CI Written byThe Clipeum IT teamEngineers, analysts and assessors across the Clipeum groupMeet the team Weekly Cybersecurity Drip Tips #### One free cyber security tip a week, for you and your business Short, practical and free. Easy to unsubscribe.Work emailEnter a valid work email address. I'm happy for Clipeum IT to send me the Weekly Cybersecurity Drip Tips.Subscribe ### More insightsCyber security #### Cyber Essentials or Cyber Essentials Plus: which one do you actually need? The 2 certifications share the same 5 controls. The difference is who checks, and who's asking you for it. An assessor's view.Cyber security #### What actually happens in a penetration test Hoodies and green text are for films. Here's what a real, authorised test of your business looks like, step by step.Cyber security #### AI is now being used to build ransomware. Here's how to protect your business Criminals are using AI to write malware and phishing faster than ever. The defences that work are more familiar than you might think. ### ## What to look for in a cyber security provider | Clipeum IT URL: https://www.clipeumit.com/insights/choosing-a-provider/ Home/Insights Buying guide ## What to look for in a cyber security provider Not all providers are equal. Here are the questions worth asking before you sign.2026, 3 minute read Choosing a cyber security partner is a big decision. These are the questions we'd ask if we were in your shoes. ### Who is watching, and when? Ask whether they monitor around the clock, and who actually responds to an alert at 3am on a Sunday. Is it their own team, or a third party you'll never speak to? ### Do they respond, or just alert? Detection without response just means you find out faster. A good provider can isolate a device or lock an account the moment a threat is confirmed. ### Do they practise what they preach? Look for certifications like Cyber Essentials Plus and IASME Cyber Assurance on the provider itself, not just offered as a service. ### Will they plan with you? Security isn't a product. Your provider should help you build a risk register, review it with you regularly, and explain things in plain English. ### Can they handle compliance? If you're in a regulated sector or a supply chain like defence, check they understand the frameworks your customers ask for. We're happy to be measured against every one of these. Ask us. CI Written byThe Clipeum IT teamEngineers, analysts and assessors across the Clipeum groupMeet the team Weekly Cybersecurity Drip Tips #### One free cyber security tip a week, for you and your business Short, practical and free. Easy to unsubscribe.Work emailEnter a valid work email address. I'm happy for Clipeum IT to send me the Weekly Cybersecurity Drip Tips.Subscribe ### More insightsCyber security #### Cyber Essentials or Cyber Essentials Plus: which one do you actually need? The 2 certifications share the same 5 controls. The difference is who checks, and who's asking you for it. An assessor's view.Cyber security #### What actually happens in a penetration test Hoodies and green text are for films. Here's what a real, authorised test of your business looks like, step by step.Company news #### Clipeum IT is now a Defence Cyber Certification Level 0 Certification Body We're now accredited to assess organisations for DCC Level 0, the new baseline for the UK defence supply chain. ### ## Where AI helps your business, and where it doesn't | Clipeum IT URL: https://www.clipeumit.com/insights/where-to-use-ai/ Home/Insights Automation ## Where AI helps your business, and where it doesn't AI is a powerful tool with real limits. A practical guide to where it earns its keep.2026, 4 minute read AI tools like Microsoft Copilot can save real time. But they're not magic, and using them in the wrong place creates risk. Here's how we think about it. ### Where AI shines First drafts. Emails, proposals, policies and reports, ready for a human to refine. Summaries. Long email threads, meeting recordings and documents, condensed in seconds. Finding things. Answering questions from your own documents and data. Analysis. Spotting trends in spreadsheets you'd never have time to dig through. ### Where to be careful Anything that must be exactly right. AI can be confidently wrong. Figures, legal wording and technical specifications need checking. Decisions about people. Hiring, performance and customer eligibility need human judgement and accountability. Sensitive data. If your permissions are messy, AI will surface information to people who shouldn't see it. ### Getting it right Start with a readiness assessment to find overshared data, write a simple AI use policy, and pilot with a small group on real tasks. Measure the time saved, then expand. See how we help on our AI and Copilot page. CI Written byThe Clipeum IT teamEngineers, analysts and assessors across the Clipeum groupMeet the team Weekly Cybersecurity Drip Tips #### One free cyber security tip a week, for you and your business Short, practical and free. Easy to unsubscribe.Work emailEnter a valid work email address. I'm happy for Clipeum IT to send me the Weekly Cybersecurity Drip Tips.Subscribe ### More insightsCyber security #### Cyber Essentials or Cyber Essentials Plus: which one do you actually need? The 2 certifications share the same 5 controls. The difference is who checks, and who's asking you for it. An assessor's view.Cyber security #### What actually happens in a penetration test Hoodies and green text are for films. Here's what a real, authorised test of your business looks like, step by step.Company news #### Clipeum IT is now a Defence Cyber Certification Level 0 Certification Body We're now accredited to assess organisations for DCC Level 0, the new baseline for the UK defence supply chain. ###