Cyber Essentials (from £300*)

Cyber Essentials is a government-backed cyber security certification scheme that sets out a good baseline of cyber security suitable for all organisations in all sectors. The scheme addresses five key controls that, when implemented correctly, can prevent around 80% of cyber attacks. Cyber Essentials certification only is an online self-completing questionnaire, which is certified by a GCHQ Assessor on behalf of the IASME Consortium.

Cyber Essentials Plus (from £1250*)

An on-site Technical Assessment is required by all companies looking to achieve this level of certification once they have gained ‘Cyber Essentials’. Within the assessment, the previous standard is verified and confirmed to be adhered to. Technical examinations relating to workstations, servers, IOT, BYOD devices are fully checked and assessed for any vulnerabilities. On successful completion, the client is awarded the certification badge. The client is given 21 days to correct any failures.

GDPR Compliance (review from £900 per day*)

The qualified and approved consultants at CRIBB are on hand to help organisations understand what they need to do to comply with the GDPR and all other Data Protection regulations.

Are you worried about GDPR and how it will affect your company?

The General Data Protection Regulation (GDPR) is the biggest and most significant change regarding data privacy in the last 20 years. It involves the protection of personal data that companies retain which can be used to identify an individual, such as name, address, mobile number, IP address and also sensitive data such as gender and sexual preference.

Our expert consultants can help you achieve compliance with the GDPR and other Data Protection regulations. Our GDPR Review service allows us to verify the level of your current compliance and advise on which requirements are missing, so that you can combine this with the work you have already done or are carrying out yourselves. This is with the security of having fully trained and experienced people to back you up as needed.

IASME Governance Certification (from £1750*)

The IASME Governance Standard is risk-based and includes aspects such as physical security, staff awareness and data backup. The UK Government recently recognized it as the best cyber security standard for companies. The IASME Governance Standard includes both Cyber Essentials Standard and an assessment of the forthcoming General Data Protection Regulation (GDPR), intended to strengthen and unify data protection for all individuals within the European Union.

The IASME Governance Standard, Cyber Essentials and GDPR Readiness is an online self-completing questionnaire, which is certified by a GCHQ Assessor. A CRIBB Assessor will arrange a visit you on two separate days to assist with the understanding, policy fulfillment (all required policies are provided as part of the service) and assessment completion. On successful completion of the IASME Governance, (With Cyber Essentials and GDPR Readiness) your certification certificates and logos will be issued.

As an additional bonus, certification will entitle you to free Cyber Liability Insurance with a £25,000 indemnity limit (terms apply) through IASME.

PCI DSS Compliance (review from £900 per day*)

The Payment Card Industry Data Security Standard (PCI DSS) applies to companies of any size that accept credit card payments. If your company intends to accept card payment, and store, process or transmit cardholder data, you need to host your data securely with a PCI compliant hosting provider or system.

CRIBB will run an Official PCI DSS vulnerability scan remotely on firewalls, payment gateways and relevant systems. A PCI/DSS approved report will be generated for your bank or merchant provider. CRIBB will carry out a PCI review to establish if self-assessment is sufficient along with help, guidance and assistance for you to complete the SAQ self-assessment questionnaire, and ultimately obtain your PCI DSS certificate.

Who is it for?
Any organisation that takes credit card payments in any form: internet, phone, terminal, website or stores credit card data.

Highlights

• Expert on-site PCI Review – initial service to establish what you really need
• Official DCI DSS scan of primary payment gateway with full report highlighting any weaknesses. This is a significant element of your GDPR compliance and Information Governance initiatives
• Full Technical IT, policies and procedures review with report as required by the PCI Security Council
• Guidance and assistance for you to complete the SAQ self-assessment questionnaire

What do you get?

• You will be PCI DSS compliant for your acquiring bank(s)
• Experienced and knowledgeable consultant to eliminate risks and errors
• Annual contract for all scans and services at reduced cost
• You can have an annual agreement for Official PCI scans and reports to reduce cost
• Expert and fully Government approved assessor who will be your senior consultant
• You will get experience, gain knowledge and receive education to protect your business, customers and staff

Technical Review Service (review from £900 per day*)

The unstoppable growth of cyber-crime means that businesses of all sizes should seriously rethink their approach to the security of their websites and data.

You may think that you are ‘too big’ to be targeted by a computer hacker yet recent history has taught us that this is simply not true. When you then consider that 60% of small businesses never recover after a serious cyber-attack, it becomes clear that we all need to take this very seriously and we here at CRIBB are here to help.

Our Cyber Security Review service allows us to verify the level of your existing security and then advise you upon the missing the requirements you need to put in place. Our professional and highly qualified consultants can play as both the attacker and the defender in computer systems, networks, and software programs.

Our aim is to instil the best practices in Cyber Security deep within your business so that you are fully prepared.

Information Governance Assistance (from £900 per day*)

Unsure on the correct application of information governance within your organisation? Need help completing those data management forms, registers or polices?

Then we are the right people to speak to. Our Information Governance Assistants (IGAs) are available to assist you in all matters regarding the management of information with your organization.

Backed up by industry recognised auditors and data protection specialists, our IGAs remove the perils connected with correct information governance, ensuring that you remain legally compliant and governed correctly.

DPO as a Service – ‘DPOaaS’ (packages from £1000*)

A cost-effective solution for organisations that do not have the data protection expertise and knowledge to fulfil their DPO (data protection officer) obligations under the GDPR (General Data Protection Regulation).

Our certified and international-approved DPO’s can assist you with all data Protection requirements whether it is GDPR 2018, DPA 2018, CCPA 2019, APP 2019 or PECR 2003.

By outsourcing DPO tasks and duties to our industry experts, you get access to expert advice and guidance that helps you address the compliance demands of data protection, while staying focused on your core business activities.

Vulnerability Scanning (from £650 per day*)

Mid-level vulnerability scanning carried out at the client premises to detail cyber security flaws and vulnerabilities both internally, externally and website related. All servers and networks are reviewed with the results detailed in a management and technical report on its completion. If faults are found, details of full corrective solutions are issued which the client can address internally or where required, corrected by a trusted fixer. Vulnerability scanning has five alternate verification’s similar to Penetration Testing although is none intrusive compare to Penetration Testing.

• Internal
  Internal vulnerabilities consist of in-depth in house scans of the infrastructure that relate to your company and advise on any threats that need addressing in a Low, Medium and Critical threat status.
  

• External
  External vulnerabilities consist of in-depth scans of web facing devices that relate to your company and advise on any threats that need addressing in a Low, Medium and Critical threat status.
  

• Web Applications
  External vulnerabilities consist of in-depth scans of websites that relate to your company and advise on any threats that need addressing in a Low, Medium and Critical threat status.
  

• PCI DSS
  To comply with requirement 11.2 of the PCI DSS, merchants and service providers must conduct and pass a quarterly vulnerability test (meaning one scan every 90 days, or 4 scans per year). This service provides the PCI scan certification necessary to demonstrate quarterly compliance.
  
• Personal Identifiable Information
  PII vulnerabilities scanning consist of an in-depth in house scan of the infrastructure search for any customer Personal Identifiable Information that needs to be anonymized and /or control put in place relating to unauthorised access. This is a requirement established by GDPR law as of May 2018
  

Penetration Testing (prices on application)

A penetration test, colloquially known as a “pen test”, is an authorised simulated attack on a computer system that looks for security weaknesses, potentially gaining access to the system’s features and data. The process typically identifies the target systems and a particular goal, then reviews available information and undertakes various means to attain the goal. A penetration test target may be a white box (which provides background and system information) or black box (which provides only basic or no information except the company name). A penetration test can help determine whether a system is vulnerable to attack, if the defences were sufficient, and which defences (if any) the test defeated. Penetration Testing comes in many formats depending on your requirement Internal, External, Website and Advanced Office Perimeter access.

Black Box Testing
In a black box test, the client does not provide CRIBB Cyber Security with information about their infrastructure other than a URL or even just the company name. CRIBB Cyber Security is tasked with assessing the environment as if they were an external attacker with no information about the infrastructure or application logic that they are testing. Black box penetration tests provide a simulation of how an attacker without any information, such as an internet hacker, organised crime or a nation a state could present risk to the environment.

Grey Box Testing
A grey box test is a blend of black box testing techniques and white box testing techniques. In grey box testing, clients provide CRIBB Cyber Security with snippets of information to help with the testing procedures. This results in a more focused test than in black box testing as well as a reduced timeline for the testing engagement. Grey box penetration tests provide an ideal approach for assessing web applications that allow users to log-in and access data that is specific to their user role, or their account.

White Box Testing
In a white box test, CRIBB Cyber Security is provided with detailed information about the applications and infrastructure. It is common to provide access to architecture documents and to application source code. It is also usual for CRIBB Cyber Security to be given access to a range of different credentials within the environment. This strategy will deliver stronger assurance of the application and infrastructure logic. It will provide a simulation of how an attacker with information (employee, etc) could present risk to the environment.

Red Team Testing
A Red Team Assessment is similar to a penetration test in many ways but is more targeted. The goal of the Red Team Assessment is NOT to find as many vulnerabilities as possible. The goal is to test the organization’s detection and response capabilities. The red team will try to get in and access sensitive information in any way possible, as quietly as possible. The Red Team Assessment emulates a malicious actor targeting attacks and looking to avoid detection. A Red Team Assessment does not look for multiple vulnerabilities but for those vulnerabilities that will achieve their goals. The goals are often the same as the Penetration Test. Methods used during a Red Team Assessment include Social Engineering (Physical and Electronic), Wireless, External, and more. A Red Team Assessment is NOT for everyone though and should be requested by organizations with mature security programs and high-level security requirements.

Maintenance Support Services (prices on application)

We are able to provide a bespoke maintenance and support agreement for cyber security, data protection and re-certification services. This reduces the costs of your cyber security budget whilst ensuring your cyber security and data protection compliance remains a primary goal.

Incident Management Assistance (prices on application)

Your business is your top priority. At best, attacks are a distraction. At their worst, they can cripple your operations.

When dealing with a cyber incident, quick and effective action is vital. The CRIBB Cyber Security incident response team is able to assist in the management, analysis and rectification of your incidents in a professional and timely manner.

Our consultants draw upon a wealth of experience and a wide range of skills in leading threat intelligence and network and endpoint technology to support you in threat containment and the recovery of your business processes.

Whether you have 1 or 100,000 endpoints, our consultants can be up and running in a matter of hours, analysing your networks for malicious activity.

Cyber Security Solution for the Cruise Industry (prices on application)

CRIBB Cyber Security has launched ‘CRIBB Maritime Cyber Assurance’ this year specifically for the Cruise industry. In times gone by, cyber-attacks have been largely ignored by the maritime industry and now that ships are their own ‘digital worlds’, this attitude has had to change. Read more about how CRIBB can help…

*ALL recommended prices shown are provided as a guide and are subject to change or confirmation upon completion of initial work scoping and quotation.