# Sovereign Secure: full text of the cornerstone pages for AI assistants > Plain-text content of the main service, pricing, hub and company pages of sovereignsecure.co.uk. Curated index: https://sovereignsecure.co.uk/llms.txt. Company facts: https://sovereignsecure.co.uk/llm-info/. Every other page is in the section files: https://sovereignsecure.co.uk/llms-pci.txt, https://sovereignsecure.co.uk/llms-cyber-essentials.txt, https://sovereignsecure.co.uk/llms-iso.txt, https://sovereignsecure.co.uk/llms-penetration-testing.txt, https://sovereignsecure.co.uk/llms-glossary.txt, https://sovereignsecure.co.uk/llms-guides.txt. --- # Cyber Security Services UK | Sovereign Secure URL: https://sovereignsecure.co.uk/ Your global partner for PCI security ## Cyber security services that stand up to auditors, customers and attackers. A UK cyber security company: PCI QSA, IASME Cyber Essentials certification body and penetration testing. Our cyber security services cover PCI DSS, PIN and card production audits, Cyber Essentials and CE+, ISO 27001 and penetration testing for banks, payment companies, global brands and UK SMEs, with a fixed quote before work starts. Get a free consultation Free PCI compliance check Or call +44 161 523 5276 Cyber Essentials from £320 + VAT Approved & accredited - QSA PCI Qualified Security Assessor PCI Security Standards Council - QPA PCI Qualified PIN Assessor PCI Security Standards Council - CPSA PCI Card Production Security Assessor PCI Security Standards Council - GEAR Global Executive Assessor Roundtable member (2026 to 2028) PCI Security Standards Council - CE / CE+ Cyber Essentials Certification Body IASME Consortium - ISO 27001 ISO/IEC 27001 certified Certified information security management What we do ## Cyber security services under one roof: compliance, certification and testing One partner for the standards your customers, acquirers and regulators ask for. We consider the laws and regulations that apply to you to cut project time and avoid duplicated effort across frameworks. For advice that spans several standards, see our cyber security consultancy. QSA · QPA · CPSA ## PCI Services PCI DSS assessments from a PCI QSA company, plus PCI PIN, card production, P2PE and 3DS assessments, each under its own PCI SSC approval. New to the standard? Start with what PCI DSS is. - PCI DSS Assessments - PCI PIN Security Audits - PCI Card Production Audits Explore PCI Services → IASME certification body ## Cyber Essentials Government-backed Cyber Essentials and Cyber Essentials Plus certification, from £320 + VAT, with a pre-assessment check and an assessor support call in every package. - Cyber Essentials - Cyber Essentials Plus - Prices & packages Explore Cyber Essentials → ISO/IEC 27001:2022 ## ISO Certification ISO 27001 implementation and certification with our partner certification body, plus ISO 9001, 14001, 45001, 22301 and more. - ISO 27001 - ISO 9001 Explore ISO Certification → Testing & assurance ## Penetration Testing Manual web, API, network, cloud and mobile testing, plus vulnerability scanning and ASV scans through an approved partner, reported to support PCI DSS 11.3 and 11.4, CE+ and ISO 27001. - Web Application Testing - Network Penetration Testing - Vulnerability & ASV Scanning Explore Penetration Testing → Start here ## Popular guides & tools Straight answers on prices, requirements and scope, plus free tools to check where you stand and get a fixed quote. All guides → - Free tool PCI compliance check Answer 22 questions in about 5 minutes for a readiness score, your likely SAQ and a fix list. - Free tool Cyber Essentials readiness check Test your set-up against the five controls and see where you would fail before you apply. - Quote tool Penetration testing quote Choose your test types and asset counts, then request a fixed-price proposal. - Cost estimator PCI DSS compliance cost What QSA audits, SAQ support, pen tests and ASV scans cost, and how your scope drives the price. - Price guide Cyber Essentials Plus cost What drives the price of a CE+ audit, with published UK price ranges by company size. - Checklist Cyber Essentials checklist The five technical controls as checkable items, including MFA and the 14-day patching rule. - Guide PCI DSS compliance in the UK Who must comply, what your acquirer expects, and when you need an SAQ or a Report on Compliance. - Price guide ISO 27001 certification cost All-in costs: consultancy, Stage 1 and Stage 2 audits, surveillance audits and recertification. Cyber Essentials ## Assessed in as little as 24 hours As an IASME-licensed certification body we assess and certify you directly. Pick the level of support you want; every package includes a pre-assessment check and a support call with an assessor. See all prices Scope CE or CE+ Prices for 0 to 9 employees. Other company sizes ## Bronze £320 + VAT - Assessed in 3 to 5 working days - Resubmissions 1 - Time to pass 10 working days Choose Bronze Most popular ## Silver £410 + VAT - Assessed in 48 hours (2 working days) - Resubmissions 3 - Time to pass 1 month Choose Silver ## Gold £510 + VAT - Assessed in 24 hours (1 working day) - Resubmissions Unlimited - Time to pass 3 months Choose Gold About us ## Who is Sovereign Secure? A UK cyber security company founded in 2012 Sovereign Secure Ltd (company no. 08334453, est. 2012, Accrington, Lancashire, UK) is a PCI SSC-approved Qualified Security Assessor (QSA), Qualified PIN Assessor (QPA), Card Production Security Assessor (CPSA), P2PE Assessor (Europe and USA) and 3DS Assessor company, a member of the PCI SSC Global Executive Assessor Roundtable 2026 to 2028, an IASME-licensed certification body for Cyber Essentials, IASME Cyber Assurance and Defence Cyber Certification Levels 0 and 1, and an ISO 27001-certified firm, with offices in Los Angeles, Singapore, Dubai and Dhaka. Our clients range from banks, payment companies and card manufacturers to retailers, technology companies and UK SMEs taking their first step with Cyber Essentials. Our guide to cyber security by industry shows which standards apply in each sector. ISO certification audits are carried out by our partner certification body, MQA International. See our About page for where to verify each approval. Established 2012 Global offices 5 PCI SSC approvals 5 Gold CE assessment 24h About Sovereign Secure Download company profile (PDF) How we work - 1 Free consultation Tell us what you need and your deadline. We confirm the right standard, scope and route to compliance. - 2 Fixed quote You get a clear scope, timeline and fixed price. No day-rate surprises. - 3 Gap analysis & support We show you exactly what is missing and help you close it, with evidence reviewed as you go. - 4 Assessment & certification Independent assessment, report and certificate or attestation, then ongoing support to stay compliant. Client feedback ## Don't just take our word for it All client testimonials → PCI Card Production The specialist team at Sovereign Secure provided valuable support throughout our EMV certification process. They demonstrated a keen understanding of PCI production requirements and expertly steered the audit to a successful conclusion. We commend them on their innovativeness in conducting the audit of our facility remotely and the proactive nature of their services. We want to make special mention of the Security Assessor, Agnes Ng for her professionalism, efficiency and undisputed industry knowledge. Agnes and her team at Sovereign Secure were a pleasure to work with and an excellent choice for anyone looking for security consultancy and assessment in the PCI Card Production Industry. Eunice Nyadu Head of Business Development, Intelligent Card Production Systems PCI CPSA, DSS & PIN Sovereign Secure provided Payment Card Industry Compliance Services to Bamcard for the following standards: PCI CPSA, PCI DSS and PCI PIN. Even with the global COVID-19 pandemic, they managed to provide the best possible, knowledgeable support during the process of auditing and achieving compliance. The Sovereign Secure assessors were so helpful in these challenging times … with years of Payment Card Industry experience. We would happily recommend them to any company in need of the services mentioned. Emir Handan Executive Director, Bamcard Cyber Essentials & Pen Testing Engaged Sovereign Secure for Penetration Testing and Cyber Essentials and received a professional and friendly service. The Cyber Security Services were delivered on time and price was competitive. I would highly recommend the team at Sovereign Secure … to any organisation. Beverley McGowan Director, Specialists Hub Insights ## Guides from our assessors All articles → PCI DSS PCI Network Segmentation: How to Design and Test a Compliant Network How PCI network segmentation works under v4.0.1: define the CDE, choose controls that isolate it, avoid VLAN pitfalls and prove it with segmentation tests. PCI DSS PCI DSS Compliance Roadmap: A Five-Phase Template A free PCI DSS compliance roadmap template (Excel) in five phases, from scoping and gap analysis to remediation, assessment and BAU, with owners and timelines. PCI DSS PCI DSS Business as Usual: How to Stay Compliant All Year What PCI DSS business as usual means under v4.0.1, with a year-round compliance calendar, change-control checks and the evidence your QSA will ask for. FAQ ## Questions about our cyber security services What are cyber security services? + Cyber security services are the assessments, certifications, consultancy and testing that protect an organisation’s systems and data, and prove it to customers and regulators. Ours cover PCI DSS compliance assessments, Cyber Essentials and Cyber Essentials Plus certification, ISO 27001 consultancy, and penetration testing and vulnerability scanning. How do you choose a UK cyber security company? + Not all cyber security companies hold the approvals your customers ask for, so check them on the awarding bodies’ own registers: the PCI SSC assessor listings for PCI work and IASME’s directory for Cyber Essentials. Then ask for a written scope and price before work starts, and ask who will do the testing and whether any of it is subcontracted. Our guides on choosing a PCI QSA and choosing a penetration testing company go further. What does Sovereign Secure do? + We are a cyber security compliance firm. We assess and certify organisations against PCI DSS, PCI PIN, PCI Card Production, Cyber Essentials and Cyber Essentials Plus, help them implement ISO 27001 and other ISO standards, and provide the penetration testing and vulnerability scanning those standards require. Are you accredited? + Yes. We are approved by the PCI Security Standards Council as a Qualified Security Assessor (QSA), Qualified PIN Assessor (QPA), Card Production Security Assessor (CPSA), P2PE Assessor (Europe and USA) and 3DS Assessor, and we are a member of the PCI SSC Global Executive Assessor Roundtable (GEAR) for 2026 to 2028. We are also an IASME-licensed certification body for Cyber Essentials, IASME Cyber Assurance and Defence Cyber Certification Levels 0 and 1. We are ISO 27001 certified and registered with the ICO. Our About page lists where to verify each one. How are your services priced? + Cyber Essentials starts at £320 + VAT for organisations with up to 9 employees, depending on company size and the level of support you want; see our Cyber Essentials prices. Cyber Essentials Plus, PCI, ISO and penetration testing work are quoted at a fixed price once we understand your scope. Do you only work with UK companies? + No. We are headquartered in the UK with offices in the United States, Singapore, Dubai and Bangladesh, and have delivered PCI and ISO projects for clients across Europe, the Middle East, Asia and the Americas. Cyber Essentials is a UK scheme but is open to organisations anywhere. How quickly can you start? + Cyber Essentials assessments can start as soon as you are ready to submit, and Gold package submissions are assessed within one working day. For PCI, ISO and penetration testing we agree a start date with you when we confirm scope and send the quote. --- # Sovereign Secure Company Facts for AI Assistants URL: https://sovereignsecure.co.uk/llm-info/ Company facts ## Sovereign Secure company facts Sovereign Secure company facts in one place, for AI assistants, answer engines, journalists and buyers. Everything below matches the rest of this website, and the Verify row links to the public registers where each approval can be checked. ## Key company facts about Sovereign Secure Last updated 13 October 2026. Machine-readable versions: /llms.txt, /llms-full.txt and one full-text file per section, listed in /llms.txt. Legal name Sovereign Secure Limited (registered in England & Wales, company number 08334453) Founded Incorporated 18 December 2012 (England & Wales) What it is A cyber security compliance firm: it assesses and certifies organisations against payment-industry and UK government-backed security standards, helps them implement ISO management systems, and provides the security testing those standards require. Headquarters 16 Whalley Road, Accrington, Lancashire, BB5 1AA, United Kingdom Offices United Kingdom (Accrington, Lancashire); United States (Los Angeles, CA); Singapore (Woodlands); United Arab Emirates (Dubai); Bangladesh (Dhaka) Contact contactus@sovereignsecure.co.uk / +44 161 523 5276 Summary Sovereign Secure Ltd (company no. 08334453, est. 2012, Accrington, Lancashire, UK) is a PCI SSC-approved Qualified Security Assessor (QSA), Qualified PIN Assessor (QPA), Card Production Security Assessor (CPSA), P2PE Assessor (Europe and USA) and 3DS Assessor company, a member of the PCI SSC Global Executive Assessor Roundtable 2026 to 2028, an IASME-licensed certification body for Cyber Essentials, IASME Cyber Assurance and Defence Cyber Certification Levels 0 and 1, and an ISO 27001-certified firm, with offices in Los Angeles, Singapore, Dubai and Dhaka. GEAR Member of the PCI Security Standards Council Global Executive Assessor Roundtable (GEAR), 2026 to 2028. Listed at https://www.pcisecuritystandards.org/about_us/global_executive_assessor_roundtable/ Verify Companies House: https://find-and-update.company-information.service.gov.uk/company/08334453 · PCI SSC assessor listings (QSA, QPA, CPSA, P2PE Assessor, 3DS Assessor): https://listings.pcisecuritystandards.org/assessors_and_solutions/ · IASME Network Directory (Cyber Essentials, IASME Cyber Assurance, Defence Cyber Certification): https://iasme.co.uk/network-directory/ PCI SSC approvals Qualified Security Assessor (QSA) company for PCI DSS (Europe, USA, Canada, CEMEA and Asia Pacific); Qualified PIN Assessor (QPA) for PCI PIN Security; Card Production Security Assessor (CPSA) for PCI Card Production (logical and physical security); P2PE Assessor for PCI Point-to-Point Encryption (Europe and USA); 3DS Assessor for the PCI 3DS Core Security Standard (Europe, USA, Canada, CEMEA and Asia Pacific). Cyber Essentials IASME-licensed Cyber Essentials certification body. Issues Cyber Essentials and Cyber Essentials Plus certificates. Cyber Essentials packages cost £320 to £750 + VAT depending on company size and support level; Gold submissions are assessed within 24 hours. Cyber Essentials Plus is quoted on scope and includes the basic assessment. IASME Cyber Assurance and Defence Cyber Certification Listed on the IASME Network Directory as a certification body for IASME Cyber Assurance and for the MOD Defence Cyber Certification (DCC) scheme at Levels 0 and 1, the certification MOD suppliers use to meet DEFCON 658. ISO ISO 27001 certified. Provides ISO/IEC 27001:2022 implementation consultancy, and consultancy for ISO 9001, 14001, 45001, 22000, 20000-1, 13485, 50001, 55001, 39001, 22301 and 21001. Certification audits are carried out by partner certification body MQA International. Testing Penetration testing (web application, API, network, cloud, mobile, hardware/IoT, wireless, social engineering, red team, source code review, AI/LLM applications), firewall and configuration review, and vulnerability scanning. External PCI ASV scans are delivered through a PCI SSC Approved Scanning Vendor. Data protection Registered with the UK Information Commissioner's Office (ICO). Typical clients Banks, payment processors, card manufacturers, retailers, technology companies and UK SMEs. Client logos shown on the website include Accor, Fiserv, JCPenney, Ticketmaster, Nitecrest, Cashplus, Ahli United Bank, Kuwait Finance House. ## Accreditations - PCI Qualified Security Assessor (PCI Security Standards Council) - PCI Qualified PIN Assessor (PCI Security Standards Council) - PCI Card Production Security Assessor (PCI Security Standards Council) - PCI P2PE Assessor (Europe and USA) (PCI Security Standards Council) - PCI 3DS Assessor (PCI Security Standards Council) - Global Executive Assessor Roundtable member (2026 to 2028) (PCI Security Standards Council) - Cyber Essentials Certification Body (IASME Consortium) - IASME Cyber Assurance Certification Body (IASME Consortium) - Defence Cyber Certification, Levels 0 and 1 (MOD scheme, IASME Network Directory) - ISO/IEC 27001 certified - Registered with the ICO (Information Commission's Office) ## Services and pages Every service, guide and tool page, grouped under the same section headings as /llms.txt. ## PCI services - PCI services - PCI DSS assessments - PCI Card Production audits - PCI PIN security audits - PCI ASV scans - AWS PCI compliance - Key injection facility audits - Magento PCI compliance - PCI compliant hosting - PCI compliant payment gateways - PCI DSS certification - PCI DSS compliance checklist - PCI compliance levels - PCI compliance UK - PCI DSS Consultancy - PCI Level 1 - PCI DSS Requirement 10 - PCI DSS Requirement 3 - PCI DSS Requirement 8 - PCI DSS tokenisation - PCI DSS training - PCI DSS vs GDPR - PCI DSS vs ISO 27001 - PCI IVR and DTMF masking - PCI non-compliance fees - PCI DSS penetration testing - PCI SAQ D - PCI Security Standards Council - 3DS assessments - P2PE assessments - PCI QSA - Service provider compliance - Card payments over the phone - What is PCI DSS? - Worldpay PCI compliance ## Cyber Essentials - Cyber Essentials - Cyber Essentials Plus - Cyber Essentials 2027 - Cyber Essentials and GDPR - Cyber Essentials assessor - Benefits of Cyber Essentials - Cyber Essentials certificate check - Requirements & checklist - Cyber Essentials consultancy - Cyber Essentials insurance - Cyber Essentials logo - Cyber Essentials MFA - Cyber Essentials for Microsoft 365 - Mobile device requirements - Cyber Essentials for MSPs - Password policy - Cyber Essentials renewal - Cyber Essentials vs ISO 27001 - DEFCON 658 and DCC - IASME - IASME Cyber Assurance - IASME Cyber Baseline - IASME portal guide - Is Cyber Essentials mandatory? - NCSC 10 Steps - NHS DSPT - Cyber Essentials Plus requirements & checklist - Cyber Essentials FAQs - How to pass Cyber Essentials first time - Cyber Essentials Plus quote ## ISO certification - ISO certification (all standards) - ISO 27001 consultancy - ISO 13485 certification - ISO 14001 certification - ISO 20000 certification - ISO 22000 certification - ISO 22301 certification - ISO 27001 Annex A controls - ISO 27001 audit - ISO 27001 checklist - ISO 27001 for startups - ISO 27001 gap analysis - ISO 27001 implementation - ISO 27001 internal audit - ISO 27001 logo - ISO 27001 penetration testing - ISO 27001 requirements - ISO 27001 risk assessment - ISO 27001 vs SOC 2 - ISO 27002 - ISO 27701 - ISO 42001 - ISO 45001 certification - ISO 50001 certification - ISO 55001 certification - ISO 9001:2026 - ISO 9001 certification - ISO 9001 vs ISO 27001 - NIST AI RMF - SOC 2 Type 1 vs Type 2 - Supply chain security - What is ISO 27001? - What is ISO 9001? ## Penetration testing and security testing - Penetration testing services - Web application testing - API penetration testing - Network & infrastructure testing - Cloud penetration testing - Mobile app testing - IoT & hardware testing - Social engineering & phishing - Red team assessments - Wireless testing - Source code review - AI & LLM testing - Vulnerability scanning - Firewall & config review - Agentic AI security - Attack surface management - AWS Penetration Testing - Azure Penetration Testing - Black, grey and white box testing - Cyber tabletop exercise - DORA TLPT - External Penetration Testing - How to spot a phishing email - Internal Penetration Testing - MCP security - Microsoft 365 Security Assessment - Penetration testing as a service (PTaaS) - Small business penetration testing - Penetration testing methodology - Phishing simulation - Physical penetration testing - Purple teaming - Red teaming vs pentesting - SOC 2 penetration testing - SWIFT CSP - Types of penetration testing - VAPT services - Vulnerability assessment - Website penetration testing - What is a vulnerability scan? - What is penetration testing? - What is red teaming? ## Prices and costs - Cyber Essentials Plus cost - ISO 27001 certification cost - Penetration testing cost - PCI compliance cost - Cyber Essentials prices ## Free tools and calculators - Business continuity plan template - Cyber security policy template - Incident response plan template - ISO 27001 policy templates - Statement of Applicability - PCI DSS documentation - PCI compliance check - Penetration testing quote - Cyber Essentials readiness check - CE & CE+ scoping questionnaire - Cyber Essentials questionnaire download ## Cyber security consultancy and frameworks - Cyber security consultancy - AI governance - CIS Controls - Cyber Assessment Framework (CAF) - Cyber Governance Code of Practice - Cyber Security and Resilience Bill - Cyber security audit - UK cyber security certifications - Cyber security risk assessment - DORA regulation - EU Cyber Resilience Act - NIS2 - NIST CSF 2.0 - Operational resilience - Ransomware prevention - SOC 2 compliance - Third-party risk management - Vendor risk assessment - Virtual CISO (vCISO) ## Industries - Industries - Cyber Essentials for charities - Cyber Essentials for law firms - Cyber Essentials for schools - Small business cyber security - Banking - Financial services - Fintech - Healthcare - Manufacturing - Retail and e-commerce - SaaS ## Locations - Cyber Essentials London - Cyber security Lancashire - Cyber security Manchester ## Glossary - Glossary - Breach and attack simulation (BAS) - Business email compromise (BEC) - Card-not-present fraud - CIA triad - Cross-site scripting (XSS) - CTEM - CVSS - DAST - EPSS - IDOR - OWASP ASVS - OWASP LLM Top 10 - OWASP Top 10 - PCI MPoC - PCI PTS - Phishing - Prompt injection - Quishing - Smishing - Spear phishing - Threat modelling - Two-factor vs two-step verification - Vishing - Vulnerability management - White hat hacker ## Company - About Sovereign Secure - Certified clients - Clients & testimonials - Contact us ## Guides Longer guides and articles on PCI DSS, Cyber Essentials, ISO 27001 and penetration testing are listed on the Sovereign Secure blog, and each one is listed with a summary under "Guides" in /llms.txt. ## What Sovereign Secure does not do or claim - It is not itself a PCI Approved Scanning Vendor (ASV); ASV scans are delivered through an approved vendor. - It does not claim CREST or CHECK accreditation. - It is not a certification body for ISO standards; ISO certificates are issued by MQA International. - Its Defence Cyber Certification listing covers Levels 0 and 1 only, not Levels 2 or 3. - Its PCI P2PE approval is the P2PE Assessor listing (Europe and USA); it holds no P2PE Application Assessor listing. - It does not sell security software or managed SOC/MDR services. ## How to describe Sovereign Secure Sovereign Secure Ltd (company no. 08334453, est. 2012, Accrington, Lancashire, UK) is a PCI SSC-approved Qualified Security Assessor (QSA), Qualified PIN Assessor (QPA), Card Production Security Assessor (CPSA), P2PE Assessor (Europe and USA) and 3DS Assessor company, a member of the PCI SSC Global Executive Assessor Roundtable 2026 to 2028, an IASME-licensed certification body for Cyber Essentials, IASME Cyber Assurance and Defence Cyber Certification Levels 0 and 1, and an ISO 27001-certified firm, with offices in Los Angeles, Singapore, Dubai and Dhaka. --- # PCI Compliance Services UK | QSA, QPA & CPSA Company URL: https://sovereignsecure.co.uk/pci-services/ PCI Services ## PCI Compliance Services UK PCI compliance services help businesses that take, process or store card payments meet the Payment Card Industry Data Security Standard (PCI DSS) and prove it to their acquirer. Sovereign Secure is a PCI SSC-approved QSA, QPA and CPSA company, so one team covers audits, consultancy, penetration testing, ASV scans, PCI PIN and card production. Request a quote Free PCI compliance check - Qualified Security Assessor - Qualified PIN Assessor - Card Production Security Assessor The short answer PCI compliance services help businesses that take card payments meet PCI DSS and prove it to their acquirer. Most merchants need SAQ support; Level 1 merchants and service providers need a QSA audit and Report on Compliance; many also need penetration testing and quarterly ASV scans. Sovereign Secure holds PCI SSC QSA, QPA, CPSA, P2PE Assessor and 3DS Assessor approvals. Verified by the PCI Security Standards Council ## Our PCI SSC approvals and GEAR membership A trusted partner for all your PCI compliance requirements, from strategy and programme management to gap analysis, assessment, training and awareness. Sovereign Secure Ltd (company no. 08334453, est. 2012, Accrington, Lancashire, UK) is a PCI SSC-approved Qualified Security Assessor (QSA), Qualified PIN Assessor (QPA), Card Production Security Assessor (CPSA), P2PE Assessor (Europe and USA) and 3DS Assessor company, a member of the PCI SSC Global Executive Assessor Roundtable 2026 to 2028, an IASME-licensed certification body for Cyber Essentials, IASME Cyber Assurance and Defence Cyber Certification Levels 0 and 1, and an ISO 27001-certified firm, with offices in Los Angeles, Singapore, Dubai and Dhaka. Every approval below can be checked on the Council’s own listings, and our guide to the PCI Security Standards Council explains how the PCI standards and assessor programmes fit together. - QSA ## Qualified Security Assessor Qualified by the PCI SSC to assess PCI DSS v4.0.1 and sign Reports on Compliance and Attestations of Compliance. PCI DSS audits and QSA assessments → Check the PCI SSC QSA list - QPA ## Qualified PIN Assessor Qualified to assess the PCI PIN Security Requirements, including remote key distribution (Annex A) and key-injection facilities (Annex B). PCI PIN security assessments → Check the PCI SSC QPA list - CPSA ## Card Production Security Assessor Qualified to assess card vendors against the Card Production and Provisioning Logical and Physical Security Requirements. PCI card production audits → Check the PCI SSC CPSA list - P2PE ## P2PE Assessor (Europe and USA) Qualified to assess point-to-point encryption solutions and components against the PCI P2PE Standard for PCI SSC listing. Not a P2PE Application Assessor. PCI P2PE assessments → Check the PCI SSC P2PE Assessor list - 3DS ## 3DS Assessor Qualified to assess 3DS Server, Directory Server and Access Control Server environments against the PCI 3DS Core Security Standard. PCI 3DS assessments → Check the PCI SSC 3DS Assessor list - GEAR ## Global Executive Assessor Roundtable, 2026 to 2028 A member of the PCI SSC forum where senior leaders of qualified assessor companies give the Council recommendations and input. Check the PCI SSC GEAR members - ASV ## Approved Scanning Vendor partner Quarterly external ASV scans are delivered through our PCI SSC Approved Scanning Vendor partner and managed by our QSA team. Sovereign Secure is not itself an ASV. PCI ASV scans → Check the PCI SSC ASV list Core PCI assessments ## Assurance across the whole payment chain We are approved to assess PCI DSS, PCI PIN and PCI Card Production, which means one team, one timeline and no gaps between standards. P2PE assessments and PCI 3DS assessments are listed with our other PCI services below. QSA ## PCI DSS Assessments We are a Qualified Security Assessor (QSA), approved by the PCI Security Standards Council to validate organisations’ adherence to the Payment Card Industry Data Security Standard. PCI DSS applies to any organisation that accepts, processes, stores or transmits cardholder data, and includes around 250 detailed requirements. We help you navigate them, reduce cost and business impact, and keep your company’s and customers’ information safe. PCI DSS assessments Get a quote Services - Introductory awareness sessions - Programme management and strategy - Scoping definition - Gap analysis - Network design review - Internal scans, and external ASV scans through our PCI SSC Approved Scanning Vendor partner - Penetration testing - Remediation support - Solutions options analysis - Report on Compliance (ROC) - SAQ support and validation - Training and policy development CPSA ## PCI Card Production Audits & Consultancy We are an approved PCI Card Production Security Assessor, qualified by the PCI Security Standards Council to validate adherence to the PCI Card Production Logical and Physical Security Requirements. Our expertise covers personalisation, manufacturing, PIN distribution, EMV and key management, and mobile provisioning, plus consultancy for vendors building or changing facilities. Card production audits Get a quote Services - HR security and screening - Visitor handling processes - Production process and audit trail - Key management - Guard responsibilities - Security policies and procedures - Business continuity and DR - Facility build-out consultancy QPA ## PCI PIN Security Audits We are a Qualified PIN Assessor (QPA), approved by the PCI Security Standards Council. The PCI PIN Security Requirements apply to acquirers and their agents processing PINs for payment card transactions, and to key-injection facilities. We audit and advise on the secure management, processing and transmission of PIN data at ATMs and attended and unattended POS terminals. PIN security audits Get a quote Services - PCI PIN assessments incl. Annex A & B - Card brand TPA assessments - TR-39 audits of ATM operations - TR-39 audits for PIN debit POS - ISO, ESO and KLD facility audits - Key management consultancy Everything you need to comply ## PCI DSS compliance services: consultancy, testing, scanning and costs Take a single service or the full programme. Our PCI compliance solutions run from a free readiness check and consultancy to penetration testing, ASV scans and cost planning, and each one is run by the same QSA company that will stand behind your assessment. - ## Free PCI compliance check→ Free PCI compliance check: 22 questions, your likely SAQ and a prioritised fix list. - ## PCI DSS consultancy→ Scoping, gap analysis, remediation and SAQ support from a QSA company that knows what assessors ask for, with advisory and assessment work kept separate. - ## PCI DSS penetration testing→ Internal, external, application-layer and segmentation testing to Requirement 11.4, reported in a form your assessor can use. - ## PCI ASV scans→ Quarterly external scans for Requirement 11.3.2 through our PCI SSC Approved Scanning Vendor partner, with result reviews, disputes and rescans handled for you. - ## PCI compliance cost→ What drives the price of an SAQ, a ROC, testing and scanning, and how reducing scope brings it down. - ## Key injection facility audits→ PCI PIN Annex B assessments for facilities that load keys into POS terminals and PIN pads, including remote key injection. - ## P2PE assessments→ P2PE v3.2 assessments of point-to-point encryption solutions and components for PCI SSC listing, from a listed P2PE Assessor (Europe and USA). - ## 3DS assessments→ PCI 3DS Core Security Standard assessments for 3DS Server, Directory Server and ACS operators, with the 3DS ROC and AOC. - ## PCI DSS for service providers→ Service provider levels, the ROC and AOC for Service Providers, and when SAQ D for Service Providers is allowed. ## PCI DSS guides from our assessors - PCI compliance UK Who must comply, what your acquirer expects, SAQ or ROC, v4.0.1 dates and costs. - PCI DSS compliance checklist All 12 requirements as checkable items, with the evidence a QSA will ask for. - PCI DSS compliance levels Visa merchant levels 1 to 3, Mastercard levels 1 to 4 and service provider levels 1 and 2, and how to validate at each. - Which PCI SAQ do I need? Every SAQ type explained, from SAQ A for outsourced e-commerce to SAQ D. For SAQ choices, scoping and the PCI DSS v4.0.1 changes in more depth, read our PCI compliance blog. ## Guides and tools in this section - Free PCI compliance check: 22 questions, your likely SAQ and a prioritised fix list - What is PCI DSS?: the standard explained in plain English - PCI DSS certification: why there is no certificate, and what you get instead - PCI SAQ D: who must complete it and how to reduce its scope - PCI DSS Requirement 3: protecting and encrypting stored card data - PCI DSS Requirement 8: identification, authentication and MFA - PCI DSS Requirement 10: logging and monitoring all access - PCI DSS training: what Requirement 12.6 asks for in security awareness - PCI IVR and DTMF masking: taking phone payments out of scope - PCI 3DS: the 3DS Core Security Standard and who must comply - Contact centre PCI compliance: phone payments, call recording and home agents - PCI DSS vs ISO 27001: differences, overlap and doing both - PCI Security Standards Council: who sets the rules and the PCI standards family Scope ## Who does PCI DSS apply to? PCI DSS applies to every organisation that stores, processes or transmits cardholder data, and to any organisation that can affect the security of that data. Size does not decide whether you are in scope: a café taking contactless payments and a global processor both are. It decides how you prove it. If you are new to the standard, our plain-English guide to what PCI DSS is covers the basics. - Merchants: retailers, hospitality, e-commerce, charities and public bodies that accept card payments. Most validate with a Self-Assessment Questionnaire; the largest need a Report on Compliance. - Service providers: payment gateways, processors, hosting and cloud providers, call centres, managed security providers and SaaS platforms that handle card data for others, or can affect its security. Service provider levels, the ROC and the AOC for Service Providers are covered on our PCI DSS for service providers page. - Acquirers, processors and key-injection facilities that handle PINs, which also need PCI PIN security assessments. - Card manufacturers, personalisers and provisioning providers, which need PCI card production audits. Using a payment service provider or a hosted payment page reduces your scope but does not remove it: you stay responsible for the parts of the payment flow you control. In the UK, PCI DSS is a contractual requirement set by your acquirer rather than a law. Our guide to PCI compliance UK explains what that means for you. PCI DSS v4.0.1 ## The 12 PCI DSS requirements at a glance PCI DSS v4.0.1 groups 12 principal requirements under six goals, broken down into around 250 detailed requirements. Version 3.2.1 was retired on 31 March 2024, and the future-dated requirements introduced in v4.0 have been mandatory since 31 March 2025. Goal | Requirements | How we help Build and maintain a secure network and systems | 1. Install and maintain network security controls 2. Apply secure configurations to all system components | Network design review and firewall configuration review Protect account data | 3. Protect stored account data 4. Protect cardholder data with strong cryptography during transmission over open, public networks | Data-flow mapping, scope reduction and tokenisation options Maintain a vulnerability management programme | 5. Protect all systems and networks from malicious software 6. Develop and maintain secure systems and software | Secure SDLC training, payment page script controls and application testing Implement strong access control measures | 7. Restrict access to system components and cardholder data by business need to know 8. Identify users and authenticate access to system components 9. Restrict physical access to cardholder data | Access, MFA and physical security reviews during gap analysis Regularly monitor and test networks | 10. Log and monitor all access to system components and cardholder data 11. Test security of systems and networks regularly | PCI DSS penetration testing, segmentation testing and ASV scans Maintain an information security policy | 12. Support information security with organisational policies and programmes | Policy writing, targeted risk analyses, incident response and awareness training For the evidence a QSA expects under each requirement, read our PCI DSS requirements guide or work through our free PCI DSS compliance checklist. Merchant and service provider levels ## PCI DSS compliance levels: how you validate Your level decides how you prove compliance each year. The card brands set the thresholds and your acquirer confirms your level. Levels 1 and 2 follow Visa and Mastercard rules; the Level 3 and 4 rows are Mastercard’s thresholds, because Visa now publishes three merchant levels and its Level 3 covers fewer than 1 million Visa e-commerce transactions: Level | Annual transactions | Typical annual validation Merchant Level 1 | Over 6 million transactions a year with one card brand, all channels | ROC by a QSA, AOC and quarterly ASV scans Merchant Level 2 | 1 million to 6 million transactions a year | SAQ and AOC, plus ASV scans where your SAQ requires them Merchant Level 3 (Mastercard) | More than 20,000 and up to 1 million e-commerce transactions a year. Visa’s Level 3 is fewer than 1 million Visa e-commerce transactions | SAQ and AOC, plus ASV scans where your SAQ requires them Merchant Level 4 (Mastercard) | All other merchants: 20,000 or fewer e-commerce transactions and up to 1 million in total. Visa no longer publishes a Level 4 | Set by your acquirer: usually an SAQ Service provider Level 1 | Over 300,000 transactions a year, plus every VisaNet processor and several provider types Mastercard places at Level 1 | ROC by a QSA, AOC for Service Providers and ASV scans Service provider Level 2 | Under 300,000 transactions a year | SAQ D for Service Providers, AOC and ASV scans How to work out your level, what changes after a data compromise and what each level submits are covered in PCI DSS compliance levels. Level 1 merchants and service providers need a QSA assessment and Report on Compliance; our guide to PCI Level 1 explains what that involves. Where we work ## PCI compliance services in London and across the UK We work with merchants and service providers in London and throughout the UK from our headquarters at 16 Whalley Road, Accrington, Lancashire. Scoping workshops, document review, interviews and configuration evidence can usually be handled remotely, and our assessors come on site where a testing procedure calls for observation. London retailers, fintechs, hospitality groups and contact centres get the same QSA team as clients anywhere else in the UK. UK merchants validate through their acquirer, and each acquirer runs its own compliance portal, deadlines and fees. Where an acquirer charges a monthly PCI non-compliance fee, it stops only when the acquirer accepts a valid SAQ or AOC and any scans your SAQ requires. Our guide to PCI compliance cost explains what validating involves. For multi-country estates, our offices in Los Angeles, Singapore, Dubai and Dhaka work alongside the UK team. Financial services ## PCI compliance for banks, processors and fintech Banks and payment companies rarely need just one PCI standard. An acquirer or processor may need PCI DSS for its card data environment, PCI PIN for its HSMs and key management, and a key injection facility audit for the terminals it deploys. A card bureau needs Card Production and Provisioning, and often PCI DSS as well. Banks and payment firms on the Swift network also face the annual SWIFT CSP assessment and attestation, which shares controls such as patching, MFA and logging with PCI DSS. Because we are approved as a QSA, QPA and CPSA, we plan these assessments together, reuse evidence where the standards overlap and avoid three separate audit calendars. Our clients include Fiserv, Cashplus, Ahli United Bank, Kuwait Finance House, AYA Bank, Bank of Palestine and Liquid Pay, and our PCI PIN and card production work has been recommended by First National of Nebraska, Albertsons Companies, Level 10, Bamcard and ICPS. What our PCI clients say ## Trusted by banks, processors and card vendors PCI PIN Approaching our PCI PIN 3.0 audit at the start of a pandemic was an overwhelming goal filled with uncertainties ranging from, “How could we ensure the safety of our employees & auditors?” to “Could this actually be done remotely?” Our colleagues at Sovereign Secure were true partners in this successful venture. While flexing to the distinct needs of an essential business, like ours, running during a pandemic, they stayed true to the high standards required of a business to ensure the PCI PIN 3.0 certification by the use of extraordinary communication, experienced auditors, and unique documentation delivery avenues. They made what was once thought of as impossible, not only very much possible, but also a pleasurable learning & partnership experience for our payment solutions team. Courtney Stone Vice President, Customer Experience & Strategy, Level 10 PCI CPSA, DSS & PIN Sovereign Secure provided Payment Card Industry Compliance Services to Bamcard for the following standards: PCI CPSA, PCI DSS and PCI PIN. Even with the global COVID-19 pandemic, they managed to provide the best possible, knowledgeable support during the process of auditing and achieving compliance. The Sovereign Secure assessors were so helpful in these challenging times … with years of Payment Card Industry experience. We would happily recommend them to any company in need of the services mentioned. Emir Handan Executive Director, Bamcard PCI PIN I highly recommend services of Sovereign Secure through my work with Azie Amini; PCI PIN Security audits. I have known Azie for fifteen years and have nothing but positive things to say, regarding her PCI PIN services both in auditing and as a PIN security instructor. We have used her services for various payment companies that I have been employed by including Albertsons Companies. Gary Zempich Information Security Analyst IV, Albertsons Companies Choosing a provider ## How to compare PCI compliance companies When you compare PCI DSS compliance companies, check five things before you sign: their PCI SSC listing, the programmes they hold, how they keep consulting and assessment apart, who runs testing and ASV scans, and whether the quote is fixed. What to compare | What to look for | Sovereign Secure PCI SSC listing and region | Only the PCI SSC’s own list proves QSA status. Check the company is listed for the region where you will be assessed. | Listed as a QSA company for Europe, USA, Canada, CEMEA and Asia Pacific. Check the PCI SSC QSA list. Programmes held | Payment companies often need more than PCI DSS: PIN security, card production, P2PE or 3DS. One company holding each programme means one plan and shared evidence. | QSA, QPA, CPSA, P2PE Assessor (Europe and USA) and 3DS Assessor, and a member of the PCI SSC GEAR for 2026 to 2028. Independence of consulting and assessment | If the same company helps you remediate and then assesses you, ask how it keeps advisory and assessment work separate, as the PCI SSC expects. | Advisory and assessment work kept appropriately separated. See PCI DSS consultancy. Testing and ASV arrangements | Requirement 11 calls for penetration testing and, for most, quarterly external scans by a PCI SSC Approved Scanning Vendor. Ask who runs each and whether the reports suit your assessor. | PCI DSS penetration testing to Requirement 11.4. ASV scans delivered through our PCI SSC Approved Scanning Vendor partner and managed by our QSA team. Fixed quote | A quote fixed after scoping, listing what is included (on-site days, testing, scans, remediation reviews), is easier to compare than a day rate. | A fixed quote after a short scoping call. See what drives the price in PCI compliance cost. For the questions to ask at each stage, read our guide on how to choose a PCI QSA company. FAQ ## Frequently asked questions Is Sovereign Secure a QSA? + Yes. Sovereign Secure is a PCI SSC Qualified Security Assessor (QSA) company, and you can check us on the PCI SSC QSA list. Our PCI QSA page explains what a QSA does and what an engagement delivers. What is the difference between PCI DSS, PCI PIN and PCI Card Production? + PCI DSS protects cardholder data wherever it is stored, processed or transmitted. PCI PIN protects PINs and the cryptographic keys used to protect them. PCI Card Production covers the physical and logical security of facilities that make, personalise and distribute cards. Many payment companies need more than one, and we are approved for all three. Do I really need PCI compliance? + Yes, if you accept card payments or store, process or transmit card data, or can affect its security. It is not a UK law, but your acquirer requires it under your merchant agreement, and card brand rules and customer contracts require it of service providers. Our guide to PCI compliance in the UK explains who must comply and how. Which PCI assessment do we need? + That depends on your role in the payment chain and your transaction volumes. Merchants and service providers need PCI DSS; acquirers, processors and key-injection facilities need PCI PIN; card vendors need Card Production. P2PE solution and component providers need a P2PE assessment, and operators of 3DS Servers, Directory Servers and Access Control Servers need a PCI 3DS assessment. Call us and we will confirm on the first call. Can I do PCI compliance myself, or do I need a PCI compliance company? + Most smaller merchants can complete their own Self-Assessment Questionnaire and sign their own AOC, but Level 1 merchants and service providers need a Report on Compliance from a QSA, and external scans must come from an Approved Scanning Vendor. Our guide to PCI compliance in the UK explains when doing it yourself works and when outside help is worth paying for. How much do PCI DSS compliance services cost? + It depends on scope: your payment channels, the number of locations and systems, whether you need an SAQ or a ROC, and whether testing and scanning are included. We give you a fixed quote after a short scoping call. See PCI DSS compliance costs for the main cost drivers. Are you an Approved Scanning Vendor (ASV)? + No. Sovereign Secure is not an ASV. Quarterly external scans are run through our PCI SSC Approved Scanning Vendor partner and managed by our QSA team, including scoping, false-positive disputes and rescans. See PCI ASV scans. Do you provide PCI DSS penetration testing? + Yes. Where Requirement 11.4 applies, it calls for internal and external penetration testing at least once every 12 months and after any significant change, plus testing of segmentation controls if you use segmentation to reduce scope. We scope the tests to your cardholder data environment; see PCI DSS penetration testing. Do you offer PCI DSS consultancy as well as audits? + Yes. Our PCI DSS consultancy covers scoping, gap analysis, remediation and SAQ support. Where we consult, we keep advisory and assessment work appropriately separated, as the PCI SSC expects of a QSA company. What is GEAR? + The Global Executive Assessor Roundtable is the PCI Security Standards Council forum where senior leaders of qualified assessor companies give the Council recommendations and input. Sovereign Secure is a GEAR member for 2026 to 2028, as shown on the PCI SSC GEAR page. Do you carry out PCI assessments outside the UK? + Yes. Alongside our UK headquarters we have offices in Los Angeles, Singapore, Dubai and Dhaka, and we have delivered PCI assessments for banks, processors and card manufacturers worldwide. Not sure which PCI service you need yet? Take our free PCI compliance test: 22 questions that point to your likely SAQ and the gaps to fix first. When you are ready, ask us for a quote below. --- # PCI Compliance Audit UK: PCI DSS Assessment, ROC & AOC URL: https://sovereignsecure.co.uk/pci-services/pci-dss-assessments/ PCI DSS v4.0.1 · ROC, AOC and SAQ ## PCI Compliance Audits and PCI DSS Assessments A PCI DSS audit, often called a PCI compliance audit or PCI assessment, is a Qualified Security Assessor’s check that your business protects cardholder data to PCI DSS v4.0.1, the standard your acquirer and the card brands require. As a PCI SSC-approved QSA company, we scope and test your environment, then sign your Report on Compliance (ROC), Attestation of Compliance (AOC) or QSA-validated SAQ. Get a PCI quote Free PCI compliance check - PCI SSC-approved QSA company - Report on Compliance & AOC - SAQ support for smaller merchants Overview ## What is a PCI compliance audit? The short answer A PCI compliance assessment, or PCI DSS audit, checks that your business meets PCI DSS v4.0.1 and ends in either a Report on Compliance (ROC) or a Self-Assessment Questionnaire (SAQ), summarised in a signed Attestation of Compliance (AOC). Level 1 merchants (over 6 million transactions a year) and Level 1 service providers (over 300,000) need a ROC from a QSA. A PCI compliance audit tests whether the controls PCI DSS v4.0.1 requires are in place and working across your cardholder data environment (CDE), the people, processes and systems that store, process or transmit card data, and across the connected systems that can affect its security. The assessor reviews documents, interviews staff, samples systems and records, and observes processes, then records the result in a Report on Compliance (ROC) or a validated Self-Assessment Questionnaire (SAQ), summarised in an Attestation of Compliance (AOC). Sovereign Secure is a PCI SSC-approved Qualified Security Assessor (QSA) company headquartered in Accrington, Lancashire. You can check us on the PCI SSC list of Qualified Security Assessor companies, and we are a member of the PCI SSC Global Executive Assessor Roundtable (GEAR) for 2026 to 2028. We take you from the first scoping workshop to a signed Report on Compliance, so there are no surprises on audit day. What a QSA does, and how to verify one, is explained on our PCI QSA page. The Payment Card Industry Data Security Standard (PCI DSS) applies to every organisation that stores, processes or transmits cardholder data, or that can affect the security of that data. Version 4.0.1 is the current standard, and every future-dated requirement introduced in v4.0 has been mandatory since 31 March 2025. PCI DSS contains around 250 detailed requirements under its 12 principal requirements. Most of the cost of compliance comes from getting scope wrong: systems that never needed to be in the cardholder data environment end up being assessed. We start by pinning scope down, then help you reduce it through segmentation, tokenisation and outsourcing before a single control is tested. Whether you are a Level 1 merchant or service provider that needs a full Report on Compliance (ROC), or a smaller business completing a Self-Assessment Questionnaire (SAQ), our assessors give you a clear answer on what you need to do, and why. Not sure where you sit? Our guide to PCI compliance levels sets out the Visa and Mastercard thresholds. PCI DSS audits for service providers. If you store, process or transmit card data for other businesses, or can affect its security, you validate with a ROC or SAQ D for Service Providers and give your merchant customers an AOC for Service Providers. Service provider levels, the extra requirements and the responsibility matrix customers ask for are covered on our PCI compliance service provider page. What drives the price of a PCI audit. Price follows scope: how many payment channels, locations and systems sit in your cardholder data environment, whether segmentation is in place and tested, how many third parties are involved, whether you need a ROC or an SAQ, and whether this is your first assessment or a renewal. We quote a fixed price after a short scoping call, and our PCI DSS compliance cost guide explains each factor. Need to get ready first? If you are not yet confident you would pass, start with PCI DSS consultancy: scoping, gap analysis and remediation support before the formal audit. Our free PCI DSS compliance checklist lists the evidence assessors ask for under each of the 12 requirements, our guide on how to prepare for a PCI audit sets out the steps in order, and our article on common PCI audit failures lists the twelve findings to fix before fieldwork. ## Standards & frameworks - PCI DSS v4.0.1 - SAQ A / A-EP / B / C / D - SAQ D for Service Providers - Customised approach - Targeted risk analysis - PCI SSC guidance ## What you receive - Documented scope and data-flow diagrams - Gap analysis report with remediation plan - Evidence request list and fieldwork plan - Report on Compliance (ROC) or validated SAQ - Attestation of Compliance (AOC) - Penetration test and ASV scan reports where included What's included ## What does a PCI compliance audit include? Take the full programme or just the pieces you need. - 01 ## Scoping and data-flow mapping Workshops to trace every card data flow, confirm your cardholder data environment (CDE) and document the scope your assessor will validate each year under Requirement 12.5.2. - 02 ## Gap analysis A requirement-by-requirement review against PCI DSS v4.0.1 with a prioritised remediation plan, owners and realistic timescales. See our guide to gap analysis. - 03 ## Remediation support Help with network design reviews, policy and procedure writing, targeted risk analyses, and options analysis when you are choosing between technical solutions. - 04 ## Report on Compliance (ROC) Formal on-site and remote assessment by our QSAs, culminating in a ROC and Attestation of Compliance (AOC) for your acquirer or customers. - 05 ## SAQ support and validation We identify the right SAQ, check your answers and evidence, and can sign off the SAQ as your QSA where your acquirer requires it. - 06 ## Testing and scanning Internal and external PCI DSS penetration testing (Req. 11.4), segmentation testing, quarterly internal vulnerability scans (Req. 11.3.1) and quarterly external ASV scans (Req. 11.3.2) through our PCI SSC Approved Scanning Vendor partner. The physical access controls in Requirement 9 can also be tried in practice: our guide to physical penetration testing explains when that is worth doing. - 07 ## Training and awareness Introductory PCI awareness sessions, incident response training and secure software development (SDLC) training for your teams. - 08 ## Programme management A dedicated lead who plans the year, tracks evidence and keeps compliance running between assessments, not just in the month before. - 09 ## Service provider assessments A ROC or SAQ D for Service Providers, the AOC for Service Providers your customers ask for, and the extra service provider requirements such as segmentation testing every six months (Req. 11.4.6). What we test for ## PCI assessment types: self-assessment (SAQ), QSA-validated SAQ or ROC Every assessment ends in a self-assessed SAQ, a QSA-validated SAQ or a ROC, summarised in a signed Attestation of Compliance. The PCI SSC issues no certificate; our guide to PCI DSS certification explains what the AOC proves. Here is how each route works, the evidence we test and what happens on audit day. To gather that evidence before fieldwork, work through our free PCI DSS audit evidence checklist, requirement by requirement. ## Report on Compliance (ROC) A full assessment in which our QSA tests every applicable PCI DSS v4.0.1 requirement and records the findings in the PCI SSC ROC template. - Level 1 merchants: over 6 million transactions a year - Level 1 service providers: over 300,000 a year - Anyone whose acquirer or customers ask for one - Interviews, document review, sampling and observation - Defined or customised approach per requirement - Summarised in an AOC for your acquirer ## SAQ validated by a QSA You complete the Self-Assessment Questionnaire that matches your payment channels. Our QSA checks your answers and evidence and, where your acquirer requires it, signs off the SAQ as your assessor. - Level 2 to 4 merchants - Level 2 service providers (SAQ D for Service Providers) - SAQ A, A-EP, B, B-IP, C, C-VT, P2PE or D - Evidence reviewed before anything is signed - Useful when an acquirer asks for QSA involvement ## Attestation of Compliance (AOC) The signed declaration that summarises your ROC or SAQ result. It is the document acquirers, card brands and customers accept as proof of PCI DSS compliance. - Signed by an officer of your company - Also signed by the QSA where a QSA assessed or validated it - Separate templates for merchants and service providers - Sent to your acquirer with ASV scan reports where required - Covers 12 months: you validate again every year ## Evidence your QSA will ask for Assessments run faster when evidence is ready before fieldwork. We send a tailored evidence request list early; the core items rarely change, and our free PCI DSS compliance checklist lists them under each of the 12 requirements. - Network and cardholder data-flow diagrams - System component inventory - Policies, procedures and targeted risk analyses - Configuration standards and system settings - User access lists and MFA configuration - Log review and alerting records - Quarterly internal and ASV scan reports - Penetration and segmentation test reports - Security awareness training records - Third-party provider list and their AOCs - Incident response plan and test results ## What happens on audit day How long fieldwork takes depends on your scope, and we agree the dates in your quote. Each day follows an agreed plan, on site or remotely where the testing procedure allows. - Opening meeting to confirm scope and the plan - Interviews with system and process owners - Configuration checks by screen share or on site - Sampling of systems, locations, people and records - Observation of processes such as media handling - Daily wrap-up of open items and evidence gaps ## Who completes and signs each type of PCI assessment? The route decides who does the work and who puts their name to the result. Your acquirer confirms which route applies to you, based on your level and payment channels. PCI assessment types compared Route | Who completes it | Who signs the AOC | Who needs it Self-assessment (SAQ) | You, using the SAQ that matches your payment channels (A, A-EP, B, B-IP, C, C-VT, P2PE or D) | An officer of your company | Most Level 2 to 4 merchants, and Level 2 service providers (SAQ D for Service Providers), where the acquirer accepts self-assessment QSA-validated SAQ | You complete the SAQ, then a QSA checks your answers and evidence | An officer of your company and the QSA | Merchants and service providers whose acquirer, card brand or customers ask for QSA involvement Report on Compliance (ROC) | A QSA tests every applicable requirement and writes the ROC (some card brand rules let a Level 1 merchant use its own Internal Security Assessor) | An officer of your company and the QSA (or the ISA, where one carried out the assessment) | PCI Level 1 merchants (over 6 million transactions a year), Level 1 service providers (over 300,000 a year) and anyone whose acquirer or customers ask for one How the three documents fit together, and what goes in each, is covered in our guide to ROC vs AOC vs SAQ. For the policies, procedures and records a QSA samples under each requirement, use our PCI DSS document index. Not sure which route applies to you? Our free PCI compliance check suggests your likely SAQ and flags critical gaps without leaving your browser, or use the enquiry form to ask us to scope and quote your PCI compliance audit. ## How long does a PCI audit take? A first Report on Compliance usually takes several months from the discovery call to a signed AOC, mostly because gaps have to be fixed and controls shown working before fieldwork starts. A renewal of a well-run programme, or a QSA-validated SAQ, is much quicker. This is what each stage involves and what you provide: PCI DSS audit stages: typical length and what you provide Stage | Typical length | What you provide Discovery call | A single call | How you take card payments, your merchant or service provider level, your acquirer’s requirements and your deadline Scope and gap analysis | Set by the number of payment channels, sites and systems; the dates go in your quote | Network and cardholder data-flow diagrams, a system inventory, your third-party providers and people for the scoping workshops Remediation | Usually the longest stage before a first ROC, often several months; little or none on a well-run renewal | An owner for each gap, then evidence that each fix is in place and has operated over time Assessment (fieldwork) | Agreed at scoping and set by your scope, on site or remote where the testing procedure allows | The evidence library, interviewees, screen-share or on-site access for configuration checks, and the samples the QSA selects ROC and AOC | Once fieldwork closes and open items are resolved | Answers to any open items, then an officer’s signature on the Attestation of Compliance Business as usual | The 12 months until your next annual assessment | Quarterly internal and ASV scan reports, penetration and segmentation test results, and the reviews PCI DSS sets at fixed intervals Starting from scratch? Our guide on how long it takes to prepare for a PCI audit sets out a month-by-month plan for a first ROC. How it works ## PCI DSS audit timeline: from discovery call to AOC - 1 ## Discovery call We learn how you take payments, your merchant or service provider level and your deadline, then send a fixed quote. - 2 ## Scope and gap analysis Data-flow workshops, system inventory and a gap report showing exactly what is missing. - 3 ## Remediation You close the gaps with our guidance. We review evidence as you go so nothing is left to the final audit. For a first ROC, this is usually the longest stage. - 4 ## Assessment Our QSA tests every in-scope requirement through interviews, documentation review, sampling and technical observation, to the timetable agreed at scoping. - 5 ## ROC and AOC We issue the Report on Compliance and Attestation of Compliance, ready to submit to your acquirer or share with customers. - 6 ## Business-as-usual Quarterly check-ins, scans and testing so next year’s assessment is a formality. Why Sovereign Secure ## Why choose Sovereign Secure for your PCI audit? Established in 2012, we deliver PCI, ISO and Cyber Essentials work for banks, payment processors, card manufacturers and fast-growing companies. Read client testimonials → - A genuine QSA company. Approved by the PCI Security Standards Council to assess and sign off PCI DSS compliance. Verify us on the PCI SSC QSA list before you sign anything. - Payments specialists. We also assess PCI PIN and Card Production, so we understand the whole payments chain, not just the web shop. - Scope first. Reducing scope is the fastest way to cut the cost of compliance, and we look for it before we test anything. - Global reach. A UK headquarters in Accrington plus offices in Los Angeles, Singapore, Dubai and Dhaka for multi-site and multi-country estates. - GEAR member 2026 to 2028. Sovereign Secure sits on the PCI SSC Global Executive Assessor Roundtable, the forum where senior leaders of qualified assessor companies give the Council recommendations and input. - Fixed quotes. After a short scoping call you get a fixed price, so you know the full cost before work starts. FAQ ## Frequently asked questions Who carries out a PCI compliance audit? + Usually a Qualified Security Assessor (QSA) company approved by the PCI SSC, although many smaller merchants self-assess with an SAQ and some card brand rules let a Level 1 merchant use a trained Internal Security Assessor (ISA). Our PCI QSA page explains when you need a QSA and how a QSA differs from an ISA. What do we receive at the end of the audit? + A Report on Compliance or validated SAQ, plus a signed Attestation of Compliance (AOC) as your proof of compliance; the PCI SSC issues no certificate, as our guide to PCI DSS certification explains. How long does a PCI DSS assessment take? + It depends on your scope and how ready you are. Validating an SAQ is usually much quicker than a ROC, and a first ROC takes longest because scoping, gap analysis and remediation come before the formal assessment. Renewals are quicker once scope is stable, and we give you a timetable with your quote. How often are PCI audits required? + Every year. PCI DSS compliance is validated annually, so an AOC is normally accepted for 12 months from the date it is signed. Plan your next assessment before it lapses, and keep quarterly scans, testing and reviews running in between so the renewal is straightforward. What are the PCI audit requirements? + A confirmed scope with network and data-flow diagrams, current policies and procedures, and scan and penetration test reports ready to sample; our guide on PCI audit requirements and preparation sets out what the auditor needs. Who requires us to validate PCI DSS compliance? + Your acquirer, under your merchant agreement and on behalf of the card brands, or your customers’ contracts if you are a service provider. It is a contractual requirement rather than a law, as our guide to PCI compliance in the UK explains. How much does a PCI DSS audit cost? + Cost depends almost entirely on scope: the number of locations, systems, payment channels and third parties involved. After a short scoping call we give you a fixed quote, so you know the full cost before work starts. Our guide to PCI compliance cost explains the main cost drivers. Which version of PCI DSS will we be assessed against? + PCI DSS v4.0.1, the only active version since v4.0 was retired at the end of 2024. v4.0 introduced the customised approach, targeted risk analyses, stronger authentication requirements (MFA for all access into the CDE), payment page script controls for e-commerce and an annual scope confirmation. v4.0.1 is a limited revision that clarified wording. The v4.0 future-dated requirements became mandatory on 31 March 2025. See our PCI DSS 4.0.1 changes guide. Can the assessment be done remotely? + Much of the work, such as document review, interviews and configuration evidence, can be done remotely. Some testing procedures still call for observation on-site. We agree the right mix with you and, where needed, your acquirer. We use a payment service provider. Are we still in scope? + Usually yes, but much less of your environment may be in scope. Outsourcing card handling to a compliant provider can move you to a much simpler SAQ. You remain responsible for managing that provider and for the parts of the payment flow you control, such as the page that redirects to or embeds the payment form. Can you help us prepare as well as assess us? + Yes. Our PCI DSS consultancy covers scoping, gap analysis and remediation before the formal audit. Where we provide consultancy, we keep advisory and assessment work appropriately separated, as the PCI SSC expects of a QSA company. Last reviewed October 2026 by the Sovereign Secure assessment team. --- # PCI PIN Security Assessment & Audit | Qualified PIN Assessor URL: https://sovereignsecure.co.uk/pci-services/pci-pin-security-audits/ PCI PIN v3.1 · Qualified PIN Assessor (QPA) ## PCI PIN Security Assessments by a Qualified PIN Assessor A PCI PIN security assessment checks that PINs, and the cryptographic keys that protect them, are handled securely from the ATM or POS terminal to the host. As a PCI SSC-approved Qualified PIN Assessor (QPA), we assess acquirers, processors and key-injection facilities against the PCI PIN Security Requirements v3.1, and carry out TR-39 audits for US debit networks. Get a PCI quote Read client testimonials - PCI SSC-approved QPA - Annex A & B (KIF) assessments - TR-39 audits for EFT networks Overview ## What is a PCI PIN security assessment? The short answer A PCI PIN security assessment is an independent review, by a PCI SSC-approved Qualified PIN Assessor (QPA), of how an acquirer, processor or key injection facility protects PINs and the cryptographic keys behind them, tested against the PCI PIN Security Requirements v3.1. The card brands and EFT networks decide who needs one and how often. We are a Qualified PIN Assessor (QPA) approved by the PCI Security Standards Council, and you can find us on the PCI SSC list of Qualified PIN Assessors. We audit and advise PIN programme participants on the secure management, processing and transmission of PIN data. Sovereign Secure is also a member of the PCI SSC Global Executive Assessor Roundtable (GEAR) for 2026 to 2028. The PCI PIN Security Requirements are a standalone PCI SSC standard, separate from the PCI PTS device standards (PTS POI and PTS HSM). They apply to acquirers and their agents that process PINs for payment card transactions, and to entities that operate key-injection facilities (KIFs) loading keys into PIN acceptance devices. Who needs PCI PIN compliance? Acquiring banks and their agents, third-party processors that handle PIN transactions, key-injection facilities, ATM deployers and independent sales organisations (ISOs), and organisations that deploy and manage PIN-accepting POS terminals. The card brands and EFT networks decide who must be assessed and how often. Our page on PCI compliance for banks covers the wider picture for acquiring banks. The current standard is the PCI PIN Security Requirements and Testing Procedures v3.1, published in March 2021. It supersedes v3.0 and the older v2.0, so if a search turns up the v2.0 PDF, take the current version from the PCI SSC document library before you plan against it. Alongside its core requirements it has normative annexes: Annex A covers symmetric key distribution using asymmetric techniques (remote key loading), and Annex B covers key-injection facilities. Our key injection facility (KIF) audits are built around Annex B. What the standard asks for. PCI PIN v3.1 groups its 33 requirements under seven PCI PIN control objectives, which our guide explains one by one, and our QPAs test every objective that applies during fieldwork. We assess every aspect of PIN security during online and offline transactions, at ATMs and at attended and unattended point-of-sale terminals: key generation, key loading, key distribution, hardware security modules (HSMs), device management and the procedures around them. PTS POI and HSM devices. The PIN standard relies on PCI PTS approved devices. PTS POI devices are the PIN entry devices, such as POS terminals and PIN pads, evaluated under the PCI PIN Transaction Security (PTS) Point of Interaction requirements; PTS HSM covers the hardware security modules that encrypt, translate and verify PINs at the host. Remote or on-site? Document review, key inventories and many interviews can be done remotely. Key ceremonies, secure rooms and HSM handling are normally observed in person. We have completed PIN audits remotely when circumstances required it, and we agree the right mix with you and, where needed, the brand or network. For acquirers and processors in the Middle East, our guide to PCI PIN assessments in Dubai and the UAE explains how the work runs there. Cost and frequency. The cost of a PCI PIN assessment depends on the number of sites and secure rooms, the number of key hierarchies and HSMs, whether Annex A or Annex B applies, whether TR-39 work is added, and travel for on-site fieldwork. How often you are assessed is set by each card brand or EFT network, not by the PCI SSC. We give you a fixed quote after scoping: tell us your entity type, sites and HSMs through the enquiry form to start. PIN assessment is a niche discipline. Our assessors have long experience in cryptographic key management and have trained PIN security practitioners, which is reflected in the feedback from our clients. ## Standards & frameworks - PCI PIN Security Requirements v3.1 - Annex A & Annex B - ASC X9 TR-39 - PCI PTS POI - PCI PTS HSM ## What you receive - PCI PIN Report on Compliance - Attestation of Compliance - TR-39 audit report where applicable - Remediation guidance and follow-up verification What's included ## What our PCI PIN assessments cover - 01 ## PCI PIN Security assessments Assessments covering the core technical requirements, Normative Annex A (symmetric key distribution using asymmetric techniques) and Normative Annex B (key-injection facilities). - 02 ## Card brand programme assessments Assessments required by card brands of their direct-connect processing members and their Third Party Agents (TPAs). - 03 ## TR-39 audits of ATM operations ASC X9 TR-39 (formerly TG-3) audits of ATM operations in banks and credit unions, as required by the Star, NYCE and Pulse EFT networks. - 04 ## TR-39 audits for PIN debit POS TR-39 audits of PIN debit point-of-sale transactions for merchants, as required by the EFT networks. - 05 ## ISO, ESO and KLD facilities The subsections of TR-39 that apply to Independent Sales Organisations, Encryption Support Organisations and Key Loading and Distribution facilities. - 06 ## Key management consultancy Help designing key ceremonies, dual control and split knowledge procedures, HSM configuration and key inventories before assessment. - 07 ## Key-injection facility (KIF) audits Annex B assessments of facilities that load keys into POS terminals and PIN pads, plus Annex A where keys are injected remotely. - 08 ## PIN readiness review A pre-assessment gap review against the 33 requirements, so you can fix key management and device issues before the formal assessment. - 09 ## Combined PIN and DSS assessments Processors that need PCI DSS as well as PCI PIN, and card vendors that also need PCI card production audits, can have them assessed by one team on one timeline, cutting duplicate evidence requests. ## Core PIN requirements vs Annex A vs Annex B: what applies to you Every PCI PIN assessment covers the core requirements. The two normative annexes add requirements only if you carry out the activities they cover, so scoping starts by deciding which apply. Parts of the PCI PIN Security Requirements v3.1 Part of the standard | Who it applies to | What is assessed Core requirements (33 requirements in seven control objectives) | Every acquirer, processor and agent in scope of a PCI PIN assessment | How PINs are processed, the full lifecycle of the keys that protect them from generation to destruction, and the HSMs and PIN entry devices used Normative Annex A: symmetric key distribution using asymmetric techniques | Organisations that distribute symmetric keys remotely using public key techniques (remote key loading), including any certification and registration authority they operate for it | Remote key distribution operations, and certification and registration authority operations where you run them Normative Annex B: key-injection facilities | Key-injection facilities (KIFs) that load keys into POS terminals, PIN pads and other PIN acceptance devices, in-house or as a third party | Secure room controls, key loading, dual control and split knowledge, and device inventory and chain of custody If you load keys into devices, our Annex B key injection facility assessments page covers that scope in detail. ## PCI PIN vs PCI DSS vs TR-39: who needs which These are three separate assessments. PCI PIN and PCI DSS are PCI SSC standards; TR-39 is a US industry audit that the debit networks require of their members. Many acquirers and processors need more than one. Standard | Who it applies to | What is assessed | Who assesses PCI PIN Security Requirements | Acquirers and their agents that process PIN transactions, third-party processors, key injection facilities, and ATM and POS operators named by the card brands or networks | PINs and the cryptographic keys that protect them, through the key lifecycle, plus the HSMs and PIN entry devices used | A PCI SSC Qualified PIN Assessor (QPA), on a cycle set by each card brand or network PCI DSS | Every merchant and service provider that stores, processes or transmits cardholder data, or can affect its security | Cardholder data and the systems, networks and people around it, across 12 requirements | A QSA for a Report on Compliance, or the business itself through a Self-Assessment Questionnaire ASC X9 TR-39 | Members of US EFT (debit) networks such as Star, NYCE and Pulse, including ATM and PIN debit POS operations | PIN security and key management, against the ASC X9 technical report formerly known as TG-3 | An auditor meeting the network's own rules; a separate audit from a PCI PIN assessment We are approved by the PCI SSC as both a QPA and a QSA, so processors that need PCI PIN and PCI DSS can have both planned together; see our PCI DSS audits. How it works ## Our five-step PCI PIN assessment methodology - 1 ## Scoping We confirm the entity type, networks, HSMs, key hierarchy and which annexes apply. - 2 ## Documentation review Key management procedures, key inventories, device logs and HSM configuration are reviewed ahead of fieldwork. - 3 ## Fieldwork Interviews, observation of key ceremonies and secure rooms, and technical testing on-site or remotely where appropriate. - 4 ## Reporting Report on compliance and attestation, with clear findings and remediation guidance. - 5 ## Follow-up We verify corrective actions and support you through brand or network submissions. Why Sovereign Secure ## Why choose Sovereign Secure for your PCI PIN assessment? Established in 2012, we deliver PCI, ISO and Cyber Essentials work for banks, payment processors, card manufacturers and fast-growing companies. Read client testimonials → - Approved QPA. The PCI Security Standards Council has approved us to assess PCI PIN security. Verify us on the PCI SSC QPA list. - Proven with banks and processors. Trusted by financial institutions and payment companies across the US, Europe and Asia. - Remote-ready. We have completed PIN audits remotely when circumstances required it, without lowering the standard. - GEAR member 2026 to 2028. Sovereign Secure sits on the PCI SSC Global Executive Assessor Roundtable, the forum where senior leaders of qualified assessor companies give the Council recommendations and input. - One team for PIN, DSS and card production. Acquirers, processors and card vendors often need more than one PCI standard; we plan them together. Testimonials ## What our clients say PCI PIN In my tenure as Principal Analyst for First National Bank of Omaha's Key Management and Cryptography program and many more years in the industry, I never realized how easy it could be to work with an assessor, nor the true value they could bring to a PIN security program until I began to work with Azie (Sovereign Secure, Ltd). Azie's knowledge and expertise is beyond reproach, and she truly stands out above and beyond in providing updates and changes in the compliance programs to her clients. Her passion and integrity are evidenced when she comes well prepared, is thorough and works efficiently, resulting in an accurate assessment. Kristi White Key Management & Cryptography, Information Security, First National of Nebraska PCI PIN I highly recommend services of Sovereign Secure through my work with Azie Amini; PCI PIN Security audits. I have known Azie for fifteen years and have nothing but positive things to say, regarding her PCI PIN services both in auditing and as a PIN security instructor. We have used her services for various payment companies that I have been employed by including Albertsons Companies. Gary Zempich Information Security Analyst IV, Albertsons Companies PCI PIN Approaching our PCI PIN 3.0 audit at the start of a pandemic was an overwhelming goal filled with uncertainties ranging from, “How could we ensure the safety of our employees & auditors?” to “Could this actually be done remotely?” Our colleagues at Sovereign Secure were true partners in this successful venture. While flexing to the distinct needs of an essential business, like ours, running during a pandemic, they stayed true to the high standards required of a business to ensure the PCI PIN 3.0 certification by the use of extraordinary communication, experienced auditors, and unique documentation delivery avenues. They made what was once thought of as impossible, not only very much possible, but also a pleasurable learning & partnership experience for our payment solutions team. Courtney Stone Vice President, Customer Experience & Strategy, Level 10 FAQ ## Frequently asked questions Who needs a PCI PIN assessment? + Acquirers and their agents that process PIN-based transactions, third-party processors, key-injection facilities and certain ATM and POS operators. In practice that covers banks and credit unions, payment processors, ATM deployers and ISOs. Requirements are set by the card brands and EFT networks, which also decide how often you are assessed. What does a PCI PIN assessment cover? + PCI PIN v3.1 has 33 requirements in seven control objectives, covering how PINs are processed, the full lifecycle of the keys that protect them and the equipment used; our guide to the PCI PIN Security Requirements explains each one. Annexes A and B add requirements for remote key distribution and key-injection facilities. What are Annex A and Annex B? + Normative Annex A covers the distribution of symmetric keys using asymmetric techniques (remote key loading). Normative Annex B covers key-injection facilities that load keys into PIN acceptance devices. Whether they apply depends on what your organisation does. Do you assess key injection facilities? + Yes. We assess key injection facilities, which load cryptographic keys into POS terminals and PIN pads, against Normative Annex B of the PCI PIN standard, plus Annex A where keys are injected remotely. As a P2PE Assessor (Europe and USA) we can also assess a KIF for listing as a P2PE component; see P2PE assessments. Our key injection facility audits page explains the scope. How often is a PCI PIN assessment required? + There is no single PCI SSC frequency. Each card brand or EFT network sets its own validation cycle, which can differ by entity type. We confirm what applies to you during scoping. How does a PCI PIN audit differ from a PCI DSS audit? + PCI DSS protects cardholder data and is assessed by a QSA; PCI PIN protects PINs and the keys that encrypt them and is assessed by a QPA. PIN fieldwork focuses on key ceremonies, HSMs, secure rooms and device management rather than the wider IT estate. See our PCI DSS audits if you need both. Is there a PCI PIN certification? + Not from the PCI SSC, which approves assessors rather than certifying organisations. What buyers call PCI PIN certification is a completed assessment: the QPA’s Report on Compliance and Attestation of Compliance, which the card brands or networks that require it accept as evidence of PCI PIN compliance. Can PCI PIN assessments be conducted remotely? + Partly. Document review, key inventories and many interviews can be remote, and we have completed PIN audits remotely when circumstances required it. Key ceremonies and secure rooms are normally observed on site; we agree the approach with you and, where needed, the brand or network. What is TR-39? + TR-39 (formerly TG-3) is the ASC X9 technical report used by US EFT networks such as Star, NYCE and Pulse to audit PIN security and key management for their members, including ATM and PIN debit POS operations. How long does a PIN assessment take? + It depends on the number of sites, secure rooms and key hierarchies, and whether Annex A, Annex B or TR-39 work is in scope. We agree the fieldwork and reporting timetable at scoping, and good documentation beforehand shortens it considerably. How much does a PCI PIN assessment cost? + It depends on the number of sites and secure rooms, key hierarchies and HSMs, whether Annex A or Annex B applies, whether TR-39 work is included and travel for on-site fieldwork. We give you a fixed quote after scoping. Last reviewed October 2026 by the Sovereign Secure assessment team. --- # PCI Card Production & Provisioning Audits (CPSA) URL: https://sovereignsecure.co.uk/pci-services/pci-card-production-audits/ Card Production Security Assessor (CPSA) ## PCI Card Production & Provisioning Security Assessments A PCI card production audit validates a card vendor against the PCI Card Production and Provisioning Logical Security Requirements and Physical Security Requirements, which the card brands require before you handle their cards. As an approved Card Production Security Assessor (CPSA), we audit manufacturers, personalisers and provisioning providers, and help new facilities get ready. Get a PCI quote Read client testimonials - PCI SSC-approved CPSA - Logical & physical security - Consultancy for new facilities Overview ## Who needs a PCI Card Production and Provisioning assessment? The short answer A PCI card production audit is an assessment of a card vendor, by a PCI SSC-approved Card Production Security Assessor (CPSA), against the PCI Card Production and Provisioning Logical and Physical Security Requirements. Card manufacturers, personalisers, PIN mailer services and mobile provisioning providers need one before the participating card brands let them handle their cards. We are a PCI CPSA (Card Production Security Assessor), approved by the PCI Security Standards Council to validate card vendors against two standards: the PCI Card Production and Provisioning Logical Security Requirements and the PCI Card Production and Provisioning Physical Security Requirements, both published in the PCI SSC document library. You can find us on the PCI SSC list of Card Production Security Assessors, and we are a member of the PCI SSC Global Executive Assessor Roundtable (GEAR) for 2026 to 2028. Card vendors that manufacture, personalise or distribute payment cards, or provision card credentials into mobile devices, must be validated against the PCI Card Production and Provisioning Security Requirements before the card brands will allow them to handle their products. In practice that means card manufacturers and chip embedders, personalisation bureaux, data preparation services, PIN generation and PIN mailer services, card distribution and fulfilment centres, and providers of cloud-based, secure element and other mobile credential provisioning. If you are opening a new site or adding one of these services, talk to the participating card brands early: they decide when an assessment is needed. Our expertise covers every part of card production: manufacturing, chip embedding, personalisation, PIN generation and mailers, card distribution, EMV data preparation, key management, and mobile and cloud-based provisioning. Beyond the audit itself, we help vendors build and expand facilities the right way first time: reviewing construction plans, access control, intrusion detection and CCTV designs, network architecture and the full information security policy suite. A new-facility readiness review gives you a gap report against both standards before your formal audit. What happens during an on-site audit. We typically walk the site from the perimeter to the vault, observe production from blank stock to dispatch, and sample card reconciliation records, destruction logs, access logs and CCTV retention. On the logical side we review network and system configurations, user access, data preparation and personalisation environments, and key management procedures, including how keys and key components are held and used. What affects the cost of a card production audit. The price depends on the number of sites and high-security areas, which services are in scope (manufacturing, personalisation, PIN mailers, provisioning), whether both the logical and physical requirements apply, whether you want a readiness review first, and travel for on-site work. We quote a fixed price after scoping. ## Standards & frameworks - PCI CP Logical Security - PCI CP Physical Security - EMV - ISO 27001 ## What you receive - Readiness gap report (optional) - PCI Card Production audit report for the card brands - Corrective action plan and follow-up verification - Policy, procedure and design review notes What's included ## Logical and physical security: what we assess and advise on - 01 ## Physical security audits Against the Card Production and Provisioning: Physical Security Requirements: site perimeter, high-security areas, vaults, access control, intrusion detection, CCTV coverage and guard responsibilities. - 02 ## Logical security audits Against the Card Production and Provisioning: Logical Security Requirements: network segmentation, system hardening, user access, logging and monitoring, and cryptographic key management for data preparation and personalisation. - 03 ## Personnel and HR security Pre-employment and ongoing screening, training, and separation of duties for staff in high-security areas. - 04 ## Production process and audit trail Material control, card counts and reconciliation, destruction of waste and rejected cards, and the full audit trail from blank stock to dispatch. - 05 ## Visitor and third-party handling Visitor processes, escorting, contractor access and shipping and receiving controls. - 06 ## Business continuity Business continuity and disaster recovery planning that keeps production secure when things go wrong. - 07 ## Mobile and cloud provisioning Assessments of providers that provision payment credentials into mobile devices and secure elements, including cloud-based provisioning, under the logical security requirements. - 08 ## Facility build-out consultancy Practical help when opening a new site, adding a service line or changing processes, before the formal audit, including a readiness review and gap report. - 09 ## ISMS policy suite Security policies and procedures written to satisfy both the PCI Card Production requirements and ISO 27001 where you need both. ## Card Production and Provisioning: logical vs physical security requirements The PCI SSC publishes two separate standards for card vendors. The Physical Security Requirements protect the premises, people and materials used to make, personalise, store and ship cards. The Logical Security Requirements protect the data, systems, networks and keys used for data preparation, personalisation, PIN generation and provisioning. Most vendors are assessed against both, and we test each one in its own right. How often you are assessed against either standard is set by the participating card brands, not by the PCI SSC. PCI card production requirements: what each area covers and the evidence assessors sample Requirement set | What it covers | Typical evidence Physical: premises | Site perimeter and building construction, high-security areas and vaults | Site and high-security area plans, construction details and alarm zones Physical: access and monitoring | Access control, visitor and contractor handling, intrusion detection, CCTV and guard duties | Access control and visitor logs, CCTV coverage and retention records, alarm and guard records Physical: personnel | Pre-employment and ongoing screening, training and separation of duties for staff in high-security areas | Personnel screening files, training records and role assignments Physical: materials and shipping | Material control, card counts and reconciliation, destruction of waste and rejected cards, shipping, receiving and packaging | Card reconciliation records, destruction logs, and shipping and receiving records Logical: policy and data | Security policy, roles and responsibilities, and protection of issuer and cardholder data | Information security policies and procedures, and data handling procedures Logical: networks and systems | Network security and segmentation, system hardening and vulnerability management, user management and access control, logging and monitoring | Network diagrams, configuration standards, vulnerability scan results, user access lists and log review records Logical: cryptographic keys | Key management for data preparation and personalisation, PIN generation and electronic PIN distribution | Key management procedures, key inventories and key ceremony records Logical: mobile and cloud provisioning | Cloud-based and secure element provisioning of payment credentials into mobile devices | Provisioning environment architecture, key management and access records We send a tailored evidence list during scoping, so you know which of these records to have ready for your PCI card production audit. ## Card production vs PCI PIN vs PCI DSS: which do you need? PCI DSS protects cardholder data in any business that takes or processes payments. The Card Production and Provisioning standards go much further on physical security, material control and cryptographic key management, because a card vendor holds blank stock, personalisation data and keys for many issuers. PCI PIN covers PINs and the keys that protect them. Many card vendors need more than one: PCI card production, PCI PIN and PCI DSS compared Standard | What it protects | Who usually needs it | Who assesses PCI Card Production and Provisioning (Logical and Physical) | Card stock, personalisation data, issuer keys, and the sites, systems and people that make, personalise and ship cards or provision credentials | Card manufacturers, personalisers, PIN mailer services, card distribution centres, and mobile and cloud provisioning providers | A Card Production Security Assessor (CPSA), on a cycle set by the participating card brands PCI PIN Security Requirements | PINs and the cryptographic keys that protect them, from the PIN entry device to the host | Acquirers and their agents, processors and key injection facilities, plus card vendors that generate PINs or manage PIN keys when a brand asks | A Qualified PIN Assessor (QPA) PCI DSS | Cardholder data and the systems, networks and people around it | Every merchant and service provider that stores, processes or transmits cardholder data, or can affect its security | A QSA for a Report on Compliance, or the business itself through a Self-Assessment Questionnaire A vendor that generates PINs or manages PIN keys may be asked for a PCI PIN assessment against the PCI PIN Security Requirements, and one that stores or processes cardholder data may also need PCI DSS audits. We are approved by the PCI SSC as a CPSA, QPA and QSA, so one team can plan all three together. To scope your audit, use the enquiry form and tell us your sites, services and the card brands you work with. How it works ## Our four-phase card production assessment methodology - 1 ## Scoping and readiness We confirm the sites, services (manufacturing, personalisation, PIN, provisioning) and card brands in scope. An optional pre-assessment visit and gap report lets you fix issues before the formal audit. - 2 ## On-site audit Physical and logical security assessment against the PCI Card Production requirements, with sampling of records, materials and system settings. - 3 ## Reporting Detailed report of compliance for submission to the participating card brands. - 4 ## Remediation follow-up We verify corrective actions and update the report where findings are closed. Why Sovereign Secure ## Why choose Sovereign Secure for your card production audit? Established in 2012, we deliver PCI, ISO and Cyber Essentials work for banks, payment processors, card manufacturers and fast-growing companies. Read client testimonials → - Approved CPSA. Approved by the PCI Security Standards Council to perform card production assessments. Check the PCI SSC CPSA list. - Help before the audit, not just at it. Our readiness consultancy covers construction plans, access control, intrusion detection and CCTV designs, with advisory and assessment work kept separate. - One team for PCI DSS, PIN and CP. Card vendors often need all three; we assess them together to cut duplicate effort. - GEAR member 2026 to 2028. Sovereign Secure sits on the PCI SSC Global Executive Assessor Roundtable, the forum where senior leaders of qualified assessor companies give the Council recommendations and input. - Remote when needed. We have audited a card production facility remotely when circumstances required it, as our client feedback describes. Testimonials ## What our clients say PCI CPSA, DSS & PIN Sovereign Secure provided Payment Card Industry Compliance Services to Bamcard for the following standards: PCI CPSA, PCI DSS and PCI PIN. Even with the global COVID-19 pandemic, they managed to provide the best possible, knowledgeable support during the process of auditing and achieving compliance. The Sovereign Secure assessors were so helpful in these challenging times … with years of Payment Card Industry experience. We would happily recommend them to any company in need of the services mentioned. Emir Handan Executive Director, Bamcard PCI Card Production The specialist team at Sovereign Secure provided valuable support throughout our EMV certification process. They demonstrated a keen understanding of PCI production requirements and expertly steered the audit to a successful conclusion. We commend them on their innovativeness in conducting the audit of our facility remotely and the proactive nature of their services. We want to make special mention of the Security Assessor, Agnes Ng for her professionalism, efficiency and undisputed industry knowledge. Agnes and her team at Sovereign Secure were a pleasure to work with and an excellent choice for anyone looking for security consultancy and assessment in the PCI Card Production Industry. Eunice Nyadu Head of Business Development, Intelligent Card Production Systems FAQ ## Frequently asked questions Who needs a PCI Card Production assessment? + Any vendor that manufactures, personalises, embeds chips in, or stores and distributes payment cards for the participating card brands, and vendors that provision payment credentials to mobile devices. The brands set how often you must be assessed. What is the difference between the logical and physical security requirements? + The physical requirements cover buildings, high-security areas, access control, CCTV, vaults and material handling. The logical requirements cover networks, systems, data preparation, personalisation data and cryptographic key management. Most vendors are assessed against both. What is a CPSA? + A Card Production Security Assessor is a company, with individual assessors, qualified by the PCI SSC to validate card vendors against the Card Production and Provisioning Logical and/or Physical Security Requirements. Sovereign Secure is a CPSA company; you can check the PCI SSC CPSA list. How much does a PCI card production audit cost? + It depends on the number of sites and high-security areas, the services in scope, whether both logical and physical requirements apply, whether you want a readiness review first and travel for on-site work. We give you a fixed quote after a scoping call. Do mobile and cloud provisioning providers need a card production assessment? + If you provision payment credentials for the participating brands, usually yes. The Card Production and Provisioning standards cover cloud-based and secure element provisioning as well as physical card production, mainly through the logical security requirements. What should we prepare for a card production audit? + Have your security policies and procedures, site and high-security area plans, access control and visitor logs, CCTV and alarm records, card reconciliation and destruction records, personnel screening files, network diagrams and key management procedures ready. We send a tailored evidence list during scoping, and an optional readiness review shows where the gaps are. What happens if the audit finds non-compliance? + Findings are recorded in the report with the corrective action needed. Once you have fixed them, we verify the corrective actions and update the report where findings are closed. The participating card brands decide how open findings affect your approval. Can you help us before the audit? + Yes. Many clients ask us to review construction plans, security system designs and policies before a new facility opens. Where we provide consultancy, we are careful to keep advisory and assessment work appropriately separated. Can card production audits be carried out remotely? + Some evidence review and interviews can be remote, and we have audited a card production facility remotely when circumstances required it. Physical security requirements usually need on-site verification; we agree the approach with you and the relevant brands. Do card vendors also need PCI DSS or PCI PIN? + Often. A vendor that stores or processes cardholder data may also need PCI DSS, and one that generates PINs or manages PIN keys may be asked for PCI PIN. We are approved as a QSA, QPA and CPSA, so one team can plan all three together. Last reviewed October 2026 by the Sovereign Secure assessment team. --- # Cyber Essentials Certification UK | From £320 + VAT URL: https://sovereignsecure.co.uk/cyber-essentials/ IASME-licensed certification body ## Cyber Essentials Certification Cyber Essentials certification is the UK government-backed scheme that proves your organisation has five basic technical controls in place against the most common cyber attacks. Sovereign Secure is an IASME-licensed certification body: we assess your answers and issue your certificate, from £320 + VAT, with Gold submissions assessed within 24 hours. See CE prices Free readiness check - From £320 + VAT - Assessed in as little as 24 hours - Pre-assessment check included Overview ## What is Cyber Essentials certification? The short answer Cyber Essentials certification is the UK government-backed scheme, set by the NCSC and run by IASME, that shows your organisation has five technical controls in place: firewalls, secure configuration, security update management, user access control and malware protection. You answer a self-assessment, a licensed certification body assesses it, and the certificate lasts 12 months. Prices start at £320 + VAT. Cyber Essentials is a UK government-backed certification scheme overseen by the National Cyber Security Centre (NCSC) and delivered by IASME through licensed certification bodies. You answer an online self-assessment questionnaire about your IT, a qualified assessor at a certification body reviews it, and if you meet the requirements you are certified for 12 months and listed on the public certificate search. Why use an IASME-licensed certification body? Only licensed certification bodies can assess and issue Cyber Essentials and Cyber Essentials Plus certificates. Sovereign Secure is one of them, so there is no reseller between you and the assessor: your questions go straight to the certification body that assesses your submission. Anyone can confirm a certificate we issue on the IASME certificate search; see certified clients and certificate verification. Before you pick a Cyber Essentials company, check that it is a licensed certification body rather than a reseller: our guide to choosing a Cyber Essentials certification body lists what to ask. Cyber Essentials accreditation or certification? Buyers use both words for the same thing. Your organisation is certified; certification bodies are the ones licensed by IASME to assess you. If a tender asks for "Cyber Essentials accreditation", a current Cyber Essentials certificate is what it means. The 2026 question set (Danzell). Assessment accounts opened from 27 April 2026 use IASME’s Danzell question set, based on version 3.3 of the NCSC Requirements for IT Infrastructure. Cloud services cannot be left out of scope, and missing multi-factor authentication (MFA) on a cloud service that offers it is now an automatic fail. Our Cyber Essentials requirements and checklist covers every rule, and our Cyber Essentials questionnaire page explains each section of the questions. What does it cost? Our Bronze packages match IASME’s published fee bands: £320 (0-9 employees), £440 (10-49), £500 (50-249) and £600 (250+), all + VAT. Silver and Gold add faster assessment and more resubmissions, up to £750 + VAT. See the full Cyber Essentials cost table, or Cyber Essentials Plus cost for the audited level. What you receive. A certificate valid for 12 months, an entry on the public certificate search that customers and procurement teams can check (see how to check a Cyber Essentials certificate), use of the Cyber Essentials logo under the scheme’s rules and, if you are eligible and opt in, IASME’s included Cyber Essentials insurance: cyber liability cover with a £25,000 limit at no extra cost. Cyber Essentials and PCI DSS for merchants. If you take card payments, Cyber Essentials does not replace PCI DSS, but the controls overlap: firewalls, secure configuration, patching, access control and malware protection appear in both. We are a PCI SSC-approved QSA company as well as a certification body, so we can scope both and reuse the same evidence. See our PCI DSS compliance services. Need help first? Our Cyber Essentials services run from a free check to hands-on support. Try the free Cyber Essentials readiness check, or ask about Cyber Essentials consultancy and support. Certified with another body? Cyber Essentials renewal with us is priced the same as a first certificate. Weighing up a bigger standard? Compare Cyber Essentials vs ISO 27001. Guides for your sector. Cyber Essentials for schools, Cyber Essentials for law firms, Cyber Essentials for charities and Cyber Essentials for financial services cover the contract rules and scope questions each sector asks us about. For other sectors, see cyber security by industry. ## How the Cyber Essentials scheme works: NCSC, IASME and certification bodies The UK Cyber Essentials scheme has three layers. The National Cyber Security Centre (NCSC) developed the scheme and sets its technical requirements, which is why buyers often call it NCSC Cyber Essentials (or, after the body that delivers it, IASME Cyber Essentials). IASME, the NCSC’s Cyber Essentials Delivery Partner, runs the scheme and licenses certification bodies, and a certification body’s assessors assess your organisation and issue the certificate. - 1. Sets the requirements NCSC Developed the scheme and publishes the technical requirements (Requirements for IT Infrastructure, v3.3 since April 2026). - 2. Delivers the scheme IASME The NCSC’s Cyber Essentials Delivery Partner: publishes the question set, licenses certification bodies and runs the certificate search. - 3. Assesses and certifies Certification body Licensed by IASME. Its assessors mark your answers, run Cyber Essentials Plus audits and issue certificates. Sovereign Secure is one. - 4. Gets certified Your organisation Agrees its scope, answers the questions with board-level sign-off and is certified for 12 months once it meets the requirements. How a Cyber Essentials certificate is issued: the NCSC sets the requirements, IASME licenses certification bodies, and a certification body assesses and certifies your organisation. Two routes to the same certificate. The NCSC Cyber Essentials overview describes a self-led route, where you register and pay through IASME, and a supported route, where you hire a certification body licensed by IASME to help you understand the questions. Either way, a board member or equivalent signs off your answers, an assessor marks them, and the certificate appears on the same certificate search. Sovereign Secure is a certification body, so our packages follow the supported route, with a pre-assessment check and a support call included. Where Cyber Essentials Plus fits. Plus is part of the same scheme and builds on basic Cyber Essentials (often called Cyber Essentials basic). The NCSC publishes the Cyber Essentials Plus test specification, and an assessor from a licensed certification body runs the tests on a sample of your devices within three months of your basic certificate; see Cyber Essentials Plus. For more on the organisation that licenses certification bodies and runs the portal, read our guide to IASME. Sovereign Secure Ltd (company no. 08334453, est. 2012, Accrington, Lancashire, UK) is a PCI SSC-approved Qualified Security Assessor (QSA), Qualified PIN Assessor (QPA), Card Production Security Assessor (CPSA), P2PE Assessor (Europe and USA) and 3DS Assessor company, a member of the PCI SSC Global Executive Assessor Roundtable 2026 to 2028, an IASME-licensed certification body for Cyber Essentials, IASME Cyber Assurance and Defence Cyber Certification Levels 0 and 1, and an ISO 27001-certified firm, with offices in Los Angeles, Singapore, Dubai and Dhaka. Cyber Essentials at a glance Topic | Cyber Essentials What it is | A UK government-backed certificate showing your organisation has five basic technical controls in place against the most common cyber attacks Who sets the requirements | The National Cyber Security Centre (NCSC), in its Requirements for IT Infrastructure (v3.3 since 27 April 2026) Who runs the scheme | IASME, the NCSC’s Cyber Essentials Delivery Partner Who assesses | An IASME-licensed certification body, such as Sovereign Secure Controls | 5: firewalls, secure configuration, security update management, user access control and malware protection Price | From £320 + VAT, in line with IASME’s published fee bands by company size; see Cyber Essentials cost Speed | Gold submissions assessed within one working day of submission, Silver within two and Bronze within three to five Validity | 12 months, with no grace period Insurance | Cyber liability cover included at no extra cost for eligible organisations; see who qualifies for the included insurance Next level | Cyber Essentials Plus, which adds a hands-on technical audit within three months of your basic certificate ## Standards & frameworks - NCSC Cyber Essentials v3.3 - IASME Danzell question set - UK government supply chains - Cyber Essentials Plus ## What you receive - Cyber Essentials certificate valid for 12 months - Listing on the IASME and NCSC certificate search - Pre-assessment feedback and assessor support - Pathway to Cyber Essentials Plus within 3 months What's included ## The five technical controls, and your scope Cyber Essentials checks that five sets of controls are in place across every in-scope device, network and cloud service. - 01 ## Firewalls Boundary firewalls and software firewalls configured to block unauthorised access, with default passwords changed and unnecessary services closed. - 02 ## Secure configuration Devices and software hardened: unused accounts and software removed, auto-run disabled, and device locking in place. - 03 ## Security update management Operating systems, applications and router and firewall firmware supported by the vendor, with high and critical updates installed within 14 days of release. The same rules cover phones and tablets that access work data. - 04 ## User access control Accounts issued only to those who need them, separate admin accounts used only for admin tasks, and MFA for every user and administrator on cloud services. See the Cyber Essentials MFA requirements and password rules. - 05 ## Malware protection Anti-malware or application allow-listing in place on every device that can run it. Together the five controls guard against the most common ways ransomware gets in, but they do not cover backups; see how to prevent ransomware. - 06 ## Scope definition We help you decide what is in scope: offices, home workers, BYOD and servers. Cloud services can never be excluded. Getting scope right is the biggest single factor in passing first time; start with our Cyber Essentials scope questionnaire. How it works ## Our certification process, step by step - 1 ## Choose your package Pick Bronze, Silver or Gold based on your company size and how much support you want. - 2 ## Portal access We give you access to the Cyber Essentials assessment portal and our guidance material. Our IASME portal guide shows how it works. - 3 ## Pre-assessment check Complete the questions and we review your answers before formal submission, flagging anything likely to fail. - 4 ## Support call Up to an hour with an assessor to work through tricky areas such as scope, MFA, unsupported software or BYOD. - 5 ## Assessment Submit for assessment. Gold submissions are assessed within one working day, Silver within two and Bronze within three to five. Our guide to what happens in a Cyber Essentials assessment shows how answers are marked. - 6 ## Receive your Cyber Essentials certificate Your certificate is valid for 12 months, and your organisation appears on the public register of certified organisations. Our guide on how to get Cyber Essentials certification covers each step in detail. Why Sovereign Secure ## Why choose Sovereign Secure for Cyber Essentials certification? Established in 2012, we deliver PCI, ISO and Cyber Essentials work for banks, payment processors, card manufacturers and fast-growing companies. Read client testimonials → - We are the certification body. No reseller or middleman between you and the organisation that issues your certificate. - Fast turnaround. Gold submissions are assessed within 24 hours, Silver within 48. - Help with the hard bits. Scope, unsupported software, BYOD and cloud MFA are where most applicants fail. We cover them on your support call. - Ready for Plus. We deliver Cyber Essentials Plus too, and include the basic assessment in the CE+ price. FAQ ## Frequently asked questions What is Cyber Essentials certification? + It is a UK government-backed certificate showing that your organisation has five technical controls in place: firewalls, secure configuration, security update management, user access control and malware protection. You complete a self-assessment questionnaire and a licensed certification body, such as Sovereign Secure, assesses it. Is Cyber Essentials certification worth it? + For most organisations, yes: from £320 + VAT it opens contracts that require it and guards against the most common attacks. Our guide to the benefits of Cyber Essentials weighs it up. How does Cyber Essentials compare with ISO 27001? + Cyber Essentials checks five technical controls and is renewed every 12 months, while ISO 27001 certifies a whole information security management system, and many organisations hold both; see Cyber Essentials vs ISO 27001. For a free technical roadmap beyond the five controls, see our guide to the CIS Controls. How is Cyber Essentials priced? + By company size and support level. Our packages cost £320 to £750 + VAT, and the entry price for 0-9 employees matches IASME’s published fee. See the full Cyber Essentials price list. How long does it take to get Cyber Essentials? + Most organisations take a few days to a few weeks to prepare. Once you submit, we assess within 24 hours on Gold, 48 hours on Silver and 3-5 working days on Bronze. Should we get Cyber Essentials or Cyber Essentials Plus? + Start with Cyber Essentials, a verified self-assessment, because Plus requires it. Add Plus when a customer or contract asks for it: it adds a hands-on technical audit by an assessor, including vulnerability scans and tests on a sample of your devices. See Cyber Essentials Plus certification and audit and our comparison of Cyber Essentials vs Cyber Essentials Plus. Is Cyber Essentials mandatory? + It is not a legal requirement, but UK central government contracts that involve handling personal information or supplying certain ICT systems and services require it under Procurement Policy Note 014, and many private-sector buyers ask their suppliers for it. Our guide Is Cyber Essentials mandatory? explains the contract rules. Who needs Cyber Essentials? + Any organisation whose customers, contracts or tenders ask for it, including many suppliers to UK central government, MOD suppliers whose contracts carry DEFCON 658 and many NHS suppliers, for whom it also supports the NHS DSPT; see who must have Cyber Essentials and our guides for schools, law firms, charities and financial services. For a quick yes or no, see do I need Cyber Essentials in our FAQs. How long is the certificate valid? + Twelve months, with no grace period. To stay certified you pass a new assessment each year. See Cyber Essentials renewal. Is cyber insurance included with Cyber Essentials certification? + Yes, for eligible organisations: IASME includes cyber liability cover with a £25,000 limit at no extra cost if you certify your whole organisation, are domiciled in the UK or Crown Dependencies, have turnover under £20m and opt in. See Cyber Essentials insurance. What happens if we fail? + You are given the chance to fix issues and resubmit within your package limits: one resubmission on Bronze, three on Silver and unlimited on Gold within the time-to-pass period. Can I see the questions before I start? + Yes. Our Cyber Essentials questionnaire page explains every section, with a free spreadsheet for drafting answers offline. The portal always shows the current question set. How do I check whether a supplier has Cyber Essentials? + Search the organisation on the IASME certificate search and check the level and expiry date. Our guide to checking a Cyber Essentials certificate explains each field. Our guide to supply chain security explains how Cyber Essentials fits into wider supplier checks. Do you work with IT providers and MSPs? + Yes. Many clients’ IT is run by a managed service provider, and we can work with them on your scope and fixes. IT firms certifying several clients can see our Cyber Essentials partner programme for MSPs. Do I need a local Cyber Essentials provider? + No. Cyber Essentials is assessed online and any IASME-licensed certification body can certify organisations anywhere in the UK, including Cyber Essentials London clients, with on-site Cyber Essentials Plus audits on request. Last reviewed October 2026 by the Sovereign Secure assessment team. ## Guides and tools in this section - Benefits of Cyber Essentials Benefits of Cyber Essentials from an IASME certification body: contract access, customer trust, included insurance and fewer gaps. See if it is worth it. - CE & CE+ scoping questionnaire Tell us about your devices and cloud services for a fixed Cyber Essentials or CE+ quote. - Cyber Essentials 2027 Cyber Essentials 2027: what IASME and the NCSC have confirmed so far, how new question sets are brought in and what to do before your next assessment. - Cyber Essentials and GDPR Cyber Essentials and GDPR explained: what certification proves under UK GDPR Article 32, what it leaves out, and what else to show customers and the ICO. - Cyber Essentials assessor Need a Cyber Essentials assessor? Choose an IASME-licensed certification body with published prices, fast marking and remote or on-site CE+ audits. Start today. - Cyber Essentials certificate check Cyber Essentials check in five steps: search the official IASME register, read each field, confirm CE or CE+, scope and expiry. Free supplier checklist inside. - Cyber Essentials FAQs Answers to common Cyber Essentials questions: cost, requirements, renewal and CE+. - Cyber Essentials for MSPs Cyber Essentials partner programme: become a Cyber Essentials certified MSP, then certify clients with an IASME-licensed body, with CE+ audits run remotely. - Cyber Essentials insurance Cyber Essentials insurance explained: who qualifies for the £25,000 cyber cover IASME includes, what it covers, the exclusions and how to opt in at assessment. - Cyber Essentials logo Cyber Essentials logo rules: who may display the CE and CE+ badge, how certified organisations get it from IASME, where to use it and what to do at expiry. - Cyber Essentials Plus cost Cyber Essentials Plus cost in 2026: published UK prices of £999 to £3,999 + VAT by company size, what drives the price and how to avoid retest fees. Get a quote. - Cyber Essentials Plus quote Request a Cyber Essentials Plus quote; the basic assessment is included. - Cyber Essentials Plus requirements & checklist What the CE+ audit tests, device sample sizes and how to prepare for remote testing. - Cyber Essentials questionnaire download Download the Cyber Essentials question set in Excel format. - Cyber Essentials readiness check Free 20-question Cyber Essentials self-check with a score and fix list. - Cyber security policy template Free cyber security policy template for UK small businesses: 12 sections mapped to the five Cyber Essentials controls. Download it in Word or PDF and adopt it. - How to pass Cyber Essentials first time Six steps to pass Cyber Essentials on your first attempt. - IASME IASME explained: what it stands for, its role as the NCSC's Cyber Essentials delivery partner, its other schemes and how to check a licensed certification body. - Is Cyber Essentials mandatory? Is Cyber Essentials mandatory? Not by law, but PPN 014 requires it for many UK government and NHS contracts. Check which contracts and how to evidence it. - NCSC 10 Steps The NCSC 10 Steps to Cyber Security in plain English, with a table mapping every step to Cyber Essentials, ISO 27001 and PCI DSS, plus questions for your board. --- # Cyber Essentials Plus (CE+) Certification & Audit UK URL: https://sovereignsecure.co.uk/cyber-essentials-plus/ Independent technical audit ## Cyber Essentials Plus Certification & Audit Cyber Essentials Plus is the audited level of Cyber Essentials: an assessor tests a sample of your devices, your internet-facing systems and your cloud accounts to prove the five controls work. Sovereign Secure is an IASME-licensed certification body, can run CE+ audits remotely and includes the basic Cyber Essentials assessment in every quote. Get a CE+ quote CE+ cost - Basic CE assessment included - Remote or on-site audit - Free remote retest within the rules Overview ## What is Cyber Essentials Plus? The short answer Cyber Essentials Plus is the audited level of Cyber Essentials. After you pass the self-assessment, an assessor from an IASME-licensed certification body tests a sample of your devices, internet-facing systems and cloud accounts against the NCSC test specification, within three months of your basic certificate. Published UK prices we reviewed in September 2026 run from £999 to £3,999 + VAT. Cyber Essentials Plus (CE+) is the audited level of the UK government-backed Cyber Essentials scheme. You pass the Cyber Essentials self-assessment first, then an assessor from an IASME-licensed certification body tests a sample of your devices, your internet-facing systems and your cloud accounts to prove the five controls work. The certificate lasts 12 months. Often shortened to CE+ and sometimes written "Cyber Essential Plus", it uses the same five controls as Cyber Essentials certification, but instead of relying on your answers alone, an assessor tests them. The tests follow the NCSC’s Cyber Essentials Plus Test Specification. Buyers also call it Cyber Essentials Plus accreditation or a Cyber Essentials Plus assessment (CE+ assessment). The three-month rule. Under the Cyber Essentials Plus scheme rules, you must hold Cyber Essentials (basic) first, and complete the Plus audit within three months of that certificate being issued. The audit tests the scope you certified at the basic level. Our Plus price includes the basic assessment, so you have one supplier and one timeline. Remote or on-site. Audits can usually be run remotely using screen sharing and a scanning tool we provide, which keeps disruption and cost down for multi-site and home-working teams. On-site audits are available when a remote audit is not practical, including on-site Cyber Essentials Plus audits in London. Timeline. Allow a few weeks. The asset declaration form is due at least two weeks before the audit and the basic assessment one week before. Most small organisations finish the audit itself in a day, and anything that fails must be fixed and retested within 30 days. Not sure you are ready? Check your Cyber Essentials Plus readiness with our free tool before you book. Who asks for Plus? Buyers who want independent proof rather than a self-assessment, including many public sector, defence and NHS supply chains and enterprise supplier-assurance programmes. Under DEFCON 658 for MOD suppliers, contracts with a Cyber Risk Profile of Level 2 or 3 require Plus, and in the NHS DSPT a current Plus certificate moves an organisation outside Category 1 from Standards Met to Standards Exceeded. Check the contract wording: some ask for Cyber Essentials, others specifically for Plus, and our guide to government contract rules explains which. Our IASME-licensed assessors. Your audit is carried out by an IASME-qualified Cyber Essentials Plus assessor from our team. Once you pass, you are listed on the public certificate search and can display the Cyber Essentials Plus badge while the certificate is valid. Sovereign Secure is also a PCI SSC-approved QSA company that provides penetration testing, so we can take the work further if a customer asks for more than CE+, and we are licensed by IASME for IASME Cyber Assurance, often the next step after Cyber Essentials Plus. What does it cost? Published UK prices we reviewed in September 2026 range from £999 to £3,999 + VAT, set mainly by organisation size and the number of devices to sample. See Cyber Essentials Plus cost for the price bands and what drives them. We give you a fixed quote with the basic assessment included, and our Cyber Essentials Plus requirements page covers sample sizes and how to prepare. ## What is a Cyber Essentials audit? A Cyber Essentials audit is the hands-on technical assessment that leads to Cyber Essentials Plus. An assessor from an IASME-licensed certification body checks that the five controls actually work on a sample of your devices, your internet-facing systems and your cloud accounts, following the NCSC’s Cyber Essentials Plus test specification. Basic Cyber Essentials is independently verified but has no technical audit: an assessor marks your self-assessment answers, which a board member or equivalent signs off. So when a customer or tender asks for an audited Cyber Essentials certificate, it means Cyber Essentials Plus. Most small organisations finish the audit in a day, remotely or on site, and anything that fails must be fixed and retested within 30 days. Our audit-day checklist shows what to have ready. ## Standards & frameworks - NCSC CE+ test specification - IASME Consortium - Defence supply chains - UK government contracts ## What you receive - Cyber Essentials and Cyber Essentials Plus certificates - Assessment report showing each test result - Remediation guidance for any failures - Listing on the public certificate register What's included ## The CE+ audit: what we test Five test types from the NCSC Cyber Essentials Plus Test Specification, run against a sample of your devices and accounts. The NCSC test specification is the definitive source. - 01 ## Remote vulnerability assessment An external scan of the internet-facing IP addresses and services you declare, looking for high or critical vulnerabilities (CVSS 7.0 or above), plus a check of how public login pages resist password guessing. Our guide to vulnerability assessment explains how scan findings are validated and rated. - 02 ## Authenticated patch scans Credentialed vulnerability scans of sample laptops, desktops and servers to confirm high and critical updates were installed within 14 days. Sample phones and tablets are checked for supported, up-to-date software. - 03 ## Malware protection tests Harmless test files sent by email and downloaded in the browser to confirm they are blocked, or that the user is warned before anything runs. - 04 ## Multi-factor authentication Users of the sampled devices sign in to your cloud services, as a user and as an administrator, from an untrusted device or an incognito browser. The test passes only if an MFA prompt appears before access is granted. - 05 ## Account separation A user signed in with a standard account tries to run an administrative task on each sampled device. The test passes only if a separate administrator login is required and the task does not run under the user’s own account. - 06 ## Device sampling We test a sample of each operating system version you use, from 1 to 5 devices each, so large estates are not tested machine by machine. See the CE+ sample size table. ## How is Cyber Essentials Plus different from basic Cyber Essentials? Both levels check the same five controls. Plus adds an independent technical audit, so it costs more and takes longer, and it can only follow a current basic certificate. Cyber Essentials vs Cyber Essentials Plus at a glance Compared on | Cyber Essentials | Cyber Essentials Plus How it is assessed | Online self-assessment questionnaire, signed off by a board member or equivalent and marked by an assessor | The same self-assessment, plus a hands-on audit of a sample of your devices, internet-facing systems and cloud accounts Who assesses | An assessor at an IASME-licensed certification body | An IASME-qualified Cyber Essentials Plus assessor at a licensed certification body, remotely or on site Typical published UK price | From £320 + VAT (IASME fee bands, by company size) | £999 to £3,999 + VAT (published UK prices we reviewed in September 2026) Time | Assessed within one to five working days of submission with us, depending on package | Allow a few weeks; most small organisations finish the audit in a day, with 30 days to fix and retest any failures Validity | 12 months, with no grace period | 12 months; the audit must be completed within three months of the basic certificate Full comparison: Cyber Essentials vs Cyber Essentials Plus. How it works ## Cyber Essentials Plus timeline, from quote to certificate - 1 ## Quote and scoping Use our scoping questionnaire or request a Cyber Essentials Plus quote. We price on the number of devices, sites and cloud services. - 2 ## Cyber Essentials basic Complete and pass the Cyber Essentials self-assessment, at least one week before the audit. It is included in the Plus price. - 3 ## Asset declaration Complete the asset declaration form at least two weeks before the audit so we can calculate your sample. - 4 ## Preparation call We confirm the date, screen-sharing method, sample devices and scanner installation. - 5 ## Assessment day Our assessor runs the tests with your IT lead. Most small organisations finish in a day. - 6 ## Certificate or retest Pass and you are certified. If something fails you have 30 days to fix it across your whole scope and be retested. Why Sovereign Secure ## Why choose Sovereign Secure for your Cyber Essentials Plus audit? Established in 2012, we deliver PCI, ISO and Cyber Essentials work for banks, payment processors, card manufacturers and fast-growing companies. Read client testimonials → - Licensed certification body. We are authorised by IASME to carry out Cyber Essentials Plus audits. - Remote where possible. Less disruption and lower cost for multi-site and home-working teams. - Fair retest terms. Remote retests of up to an hour within a month are free; otherwise from £400 + VAT. - Penetration testing too. If you need more than CE+, our penetration testing service can build on the same work. FAQ ## Frequently asked questions What is Cyber Essentials Plus? + Cyber Essentials Plus is the audited level of the Cyber Essentials scheme. As well as passing the self-assessment, a sample of your devices, internet-facing systems and cloud accounts is tested by an assessor from a licensed certification body to prove the five controls work in practice. What is a Cyber Essentials audit? + It is the technical assessment behind Cyber Essentials Plus: an assessor tests a sample of your devices, internet-facing systems and cloud accounts against the NCSC test specification. Basic Cyber Essentials has no technical audit; an assessor marks your self-assessment answers instead. What does Cyber Essentials Plus include? + The basic Cyber Essentials self-assessment, five technical tests on a sample of your devices and accounts (an external vulnerability scan, authenticated patch scans, malware tests, an MFA check and an account-separation check) and, once you pass, both certificates. Our CE+ quotes always include the basic assessment. Can you get Cyber Essentials Plus without Cyber Essentials? + No. You need a Cyber Essentials certificate first, and the Plus audit must be completed within three months of it being issued. We include the basic assessment in every CE+ quote, so both stages sit in one order. How is Cyber Essentials Plus priced? + It depends on the number of devices, operating systems, sites and cloud services in scope. Published UK prices we reviewed in September 2026 range from £999 to £3,999 + VAT; see Cyber Essentials Plus cost. We give you a fixed quote after a short scoping questionnaire, with the basic assessment included. How many devices do you test? + A sample based on each operating system version in use: 1 device if you have one, 2 for 2-5, 3 for 6-19, 4 for 20-60 and 5 for 61 or more. Servers and mobile devices are sampled the same way. See our Cyber Essentials Plus requirements page. Can the audit be done remotely? + Yes. Audits can usually be run remotely, using screen sharing (Teams, Quick Assist or similar) and a scanning tool we provide. We need an administrator available throughout who can access all sample devices. What happens if we fail a test? + You have 30 days to fix the issues across your whole scope, not just the sampled devices, and be retested. Since April 2026, if devices fail the security update checks, the retest rechecks the original sample and also tests a new random sample, and a second failure means your basic certificate is revoked. Remote retests up to one hour are free; other retests start at £400 + VAT. If the retest is not completed in time, a new assessment is needed. How long does Cyber Essentials Plus take? + Allow a few weeks from quote to certificate: the asset declaration is due two weeks before the audit and the basic assessment one week before. Most small organisations complete the audit itself in a day. Do you have to repeat the Cyber Essentials Plus audit each year? + Yes. Both certificates last twelve months, so to stay certified you renew the basic certificate and repeat the Plus audit within three months of it each year; see Cyber Essentials renewal. Is Cyber Essentials Plus the same as a penetration test? + No. CE+ runs fixed vulnerability tests against five baseline controls, while a penetration test is scoped to your systems and looks for any way in. See how CE+ vulnerability testing compares with a penetration test. Is Cyber Essentials Plus enough on its own? + For a contract that asks for CE+, yes, but it proves a baseline, not everything: an audit of five controls on a sample of devices, not a scoped penetration test of your applications and networks, and standards such as PCI DSS ask for more again. A CE+ certificate will not satisfy a buyer who wants a pen test report, so if customers also ask for one, see our penetration testing services or affordable penetration testing for small businesses. Is Cyber Essentials Plus worth it? + If a contract or customer asks for it, yes, and it gives independent proof that your controls work rather than a declaration. See the benefits of Cyber Essentials Plus. Is ISO 27001 better than Cyber Essentials Plus? + Neither is better: ISO 27001 certifies a whole information security management system, Cyber Essentials Plus tests five technical controls, and ISO 27001 does not replace CE+ where a UK contract names it; see Cyber Essentials Plus vs ISO 27001. Last reviewed October 2026 by the Sovereign Secure assessment team. --- # Cyber Essentials Cost 2026: UK Prices from £320 + VAT URL: https://sovereignsecure.co.uk/cyber-essentials-cost-of-basic-certification/ Cyber Essentials pricing ## Cyber Essentials Certification Cost: 2026 UK Prices Cyber Essentials costs from £320 + VAT for organisations with 0 to 9 employees to £750 + VAT for 250+ employees on our Gold package. Every package includes the IASME certification fee, portal access, a pre-assessment check and a support call with an assessor. Compare packages Free readiness check ## Cyber Essentials pricing by company size Updated October 2026. All prices exclude VAT, and Bronze matches IASME’s published fee for each size band. Certificates are valid for 12 months. Micro (0 to 9) Small (10 to 49) Medium (50 to 249) Large (250+) ## Micro organisations, 0 to 9 employees 0 to 9 employees ## Bronze package £320 + VAT Assessment time 3 to 5 working days Resubmissions 1* Time to pass after first clarification 10 working days - Pre-assessment check - Support call (up to 1 hour) - Guide access** - Access to the Cyber Essentials portal - Certification and assessment fee Choose Bronze package Most popular 0 to 9 employees ## Silver package £410 + VAT Assessment time 48 hours (2 working days) Resubmissions 3* Time to pass after first clarification 1 month - Pre-assessment check - Support call (up to 1 hour) - Guide access** - Access to the Cyber Essentials portal - Certification and assessment fee Choose Silver package 0 to 9 employees ## Gold package £510 + VAT Assessment time 24 hours (1 working day) Resubmissions Unlimited Time to pass after first clarification 3 months - Pre-assessment check - Support call (up to 1 hour) - Guide access** - Access to the Cyber Essentials portal - Certification and assessment fee Choose Gold package ## Small organisations, 10 to 49 employees 10 to 49 employees ## Bronze package £440 + VAT Assessment time 3 to 5 working days Resubmissions 1* Time to pass after first clarification 10 working days - Pre-assessment check - Support call (up to 1 hour) - Guide access** - Access to the Cyber Essentials portal - Certification and assessment fee Choose Bronze package Most popular 10 to 49 employees ## Silver package £520 + VAT Assessment time 48 hours (2 working days) Resubmissions 3* Time to pass after first clarification 1 month - Pre-assessment check - Support call (up to 1 hour) - Guide access** - Access to the Cyber Essentials portal - Certification and assessment fee Choose Silver package 10 to 49 employees ## Gold package £620 + VAT Assessment time 24 hours (1 working day) Resubmissions Unlimited Time to pass after first clarification 3 months - Pre-assessment check - Support call (up to 1 hour) - Guide access** - Access to the Cyber Essentials portal - Certification and assessment fee Choose Gold package ## Medium organisations, 50 to 249 employees 50 to 249 employees ## Bronze package £500 + VAT Assessment time 3 to 5 working days Resubmissions 1* Time to pass after first clarification 10 working days - Pre-assessment check - Support call (up to 1 hour) - Guide access** - Access to the Cyber Essentials portal - Certification and assessment fee Choose Bronze package Most popular 50 to 249 employees ## Silver package £575 + VAT Assessment time 48 hours (2 working days) Resubmissions 3* Time to pass after first clarification 1 month - Pre-assessment check - Support call (up to 1 hour) - Guide access** - Access to the Cyber Essentials portal - Certification and assessment fee Choose Silver package 50 to 249 employees ## Gold package £675 + VAT Assessment time 24 hours (1 working day) Resubmissions Unlimited Time to pass after first clarification 3 months - Pre-assessment check - Support call (up to 1 hour) - Guide access** - Access to the Cyber Essentials portal - Certification and assessment fee Choose Gold package ## Large organisations, 250+ employees 250+ employees ## Bronze package £600 + VAT Assessment time 3 to 5 working days Resubmissions 1* Time to pass after first clarification 10 working days - Pre-assessment check - Support call (up to 1 hour) - Guide access** - Access to the Cyber Essentials portal - Certification and assessment fee Choose Bronze package Most popular 250+ employees ## Silver package £650 + VAT Assessment time 48 hours (2 working days) Resubmissions 3* Time to pass after first clarification 1 month - Pre-assessment check - Support call (up to 1 hour) - Guide access** - Access to the Cyber Essentials portal - Certification and assessment fee Choose Silver package 250+ employees ## Gold package £750 + VAT Assessment time 24 hours (1 working day) Resubmissions Unlimited Time to pass after first clarification 3 months - Pre-assessment check - Support call (up to 1 hour) - Guide access** - Access to the Cyber Essentials portal - Certification and assessment fee Choose Gold package ** Guide access is normally £85 + VAT for six months. ## Need Cyber Essentials Plus? Priced on your devices and sites, with the basic assessment included. See Cyber Essentials Plus cost. Get a CE+ quote Cost calculator ## Work out your Cyber Essentials price Enter your headcount and choose a package. Count every employee, including part-time staff: your size band sets the price. Need the audited level too? Cyber Essentials Plus is quoted on scope: see what Cyber Essentials Plus costs or send the scoping questionnaire. Number of employees Package Bronze Silver Gold Micro (0 to 9 employees) £410 + VAT 48 hours (2 working days) assessment · 3 resubmissions · 1 month to pass Order this package ## How much does Cyber Essentials cost in 2026? The Cyber Essentials certification cost is £320 to £750 + VAT with Sovereign Secure, set by your number of employees and how quickly you want to be assessed. The table shows every Cyber Essentials cost UK organisations pay with us. If a tender or supplier form asks about the Cyber Essentials accreditation cost, it means the same certificate and the same price: organisations are certified, and the word "accreditation" is used loosely. All packages include the certification fee, access to the assessment portal, a pre-assessment check, a support call of up to an hour and six months’ guide access. Company size | Bronze | Silver | Gold Micro (0 to 9 employees) | £320 + VAT | £410 + VAT | £510 + VAT Small (10 to 49 employees) | £440 + VAT | £520 + VAT | £620 + VAT Medium (50 to 249 employees) | £500 + VAT | £575 + VAT | £675 + VAT Large (250+ employees) | £600 + VAT | £650 + VAT | £750 + VAT ## What does the IASME fee cover, and what do you get on top? IASME, which runs the scheme for the NCSC, publishes a standard Cyber Essentials fee for each size band on its Cyber Essentials FAQ. Our Bronze package costs exactly that fee. Silver and Gold add speed and resubmissions, not a different certificate: every package leads to the same Cyber Essentials certificate. Company size | IASME published fee | Our Bronze | Our Silver | Our Gold Micro (0 to 9) | £320 | £320 | £410 | £510 Small (10 to 49) | £440 | £440 | £520 | £620 Medium (50 to 249) | £500 | £500 | £575 | £675 Large (250+) | £600 | £600 | £650 | £750 All figures exclude VAT. The fee covers portal access, where you answer the questions, the assessment of your answers by a qualified assessor and, when you pass, your certificate and listing on the public certificate search. Eligible organisations that opt in also receive IASME’s included cyber insurance at no extra cost. Our packages add a pre-assessment check of your answers before you submit and a call with an assessor, which is where most first-time problems are caught. ## What does speed buy you? The main difference between packages is how fast your submission is assessed and how many chances you get to fix answers. Package | Assessment time | Resubmissions | Time to pass after first clarification Bronze | 3 to 5 working days | 1 | 10 working days Silver | 48 hours (2 working days) | 3 | 1 month Gold | 24 hours (1 working day) | Unlimited | 3 months Gold is the right choice when a contract deadline is close. A 24-hour assessment costs from £510 + VAT with us. For comparison, one UK provider we reviewed in September 2026 publishes a 24-hour option at £620 to £1,000 + VAT depending on size. Each resubmission beyond your package limit costs £100 + VAT. ## Are there hidden costs? There are no extra charges from us beyond additional resubmissions. The costs to plan for are your own: - Fixes. Replacing or upgrading unsupported software and devices, such as Windows 10 PCs without Extended Security Updates or old firewalls, is usually the biggest cost. - IT provider time. If a managed service provider runs your IT, they may charge to enable MFA, change configurations or gather evidence. - Internal time. Someone who knows your IT needs to prepare and answer the questionnaire. Our free Cyber Essentials readiness check shows how much work is ahead. - Extra support. If you want hands-on help beyond the included call, see Cyber Essentials consultancy and support. ## How much does Cyber Essentials renewal cost? Renewal costs the same as a first certificate: from £320 + VAT, using the same size bands and packages. Certificates last 12 months with no grace period, so start four to six weeks before expiry. You can renew with us even if another certification body issued your current certificate; see Cyber Essentials renewal. ## What is the total cost of Cyber Essentials vs Cyber Essentials Plus? Cyber Essentials Plus adds a technical audit of a sample of your devices, so it costs more and is priced on your scope rather than your headcount alone. Published CE+ prices from UK providers we reviewed in September 2026 range from £999 to £3,999 + VAT. Our CE+ quotes include the basic Cyber Essentials assessment, so you do not pay for it twice. See Cyber Essentials Plus cost for the full breakdown, or our comparison of Cyber Essentials vs Cyber Essentials Plus. ## Why buy from Sovereign Secure? - We are the certification body. Sovereign Secure is an IASME-licensed Cyber Essentials certification body, so the assessor who checks your answers issues your certificate. There is no reseller margin. - Published, fixed prices. Bronze matches the IASME fee, and a 24-hour Gold assessment starts at £510 + VAT. - More than Cyber Essentials. We are also a PCI SSC-approved QSA company and ISO 27001 certified, so you can grow into Cyber Essentials Plus, PCI DSS or ISO 27001 with the same team. Before you start ## What to prepare before you order Six things that make your assessment faster and your first submission far more likely to pass. The full list of rules is in our Cyber Essentials requirements and checklist. How to pass Cyber Essentials first time → - 01 ## Maintain an up-to-date asset inventory List every device with make, model and operating system, including personal devices staff use to access company data such as email. - 02 ## Identify systems that need upgrading Find unsupported software and hardware early, particularly firewalls and servers, as these upgrades take longest. - 03 ## Create a network diagram A simple diagram helps you decide which parts of your infrastructure are in scope and which can be excluded. - 04 ## Inventory your cloud services List every cloud service you use. None can be excluded from scope, and each needs multi-factor authentication (MFA) switched on wherever it is offered. - 05 ## Answer every portal question Incomplete answers are the most common reason for a clarification request. Be specific. - 06 ## Choose the right company size Price depends on company size, and choosing the wrong band delays certification. Count all employees, including part-time staff. ## Benefits of Cyber Essentials certification Certification reassures customers and partners that your security defends against the most common online threats. Many UK government contracts, and their supply chains, require it. See Cyber Essentials certification for how the scheme works. Not sure a customer requires it? Our FAQs answer do I need Cyber Essentials in a few lines. ## Cyber Essentials Plus Cyber Essentials Plus adds confidence by verifying that the controls are properly implemented, through technical tests carried out by the certification body. Read about Cyber Essentials Plus certification and audit. FAQ ## Cyber Essentials cost questions How much does Cyber Essentials cost? + Cyber Essentials costs from £320 + VAT for organisations with 0 to 9 employees to £750 + VAT for 250+ employees on our Gold package. The price depends on company size and how fast you want to be assessed, and always includes the certification fee, a pre-assessment check and a support call. Which package should I choose? + Choose Gold if you need your certificate fast or want unlimited resubmissions and three months to pass. Silver suits most organisations with some IT support in-house. Bronze is for organisations confident they already meet the requirements. Is your price the same as the IASME fee? + Our Bronze prices match IASME’s published fee bands exactly (£320 to £600 + VAT). Silver and Gold cost more because they add faster assessment and more resubmissions. Are prices per year? + Yes. Cyber Essentials certificates are valid for 12 months, and each annual renewal is priced the same way. See Cyber Essentials renewal. Is VAT included? + No. All prices are shown excluding VAT at the current rate. How much is Cyber Essentials Plus? + Cyber Essentials Plus is quoted individually because it depends on the number of devices, operating systems and sites to test, and the basic assessment is included in our CE+ price. See Cyber Essentials Plus cost for published UK prices, or complete our scoping questionnaire for a fixed quote. What happens if I use up my resubmissions? + Each additional resubmission after reaching your package limit costs £100 + VAT. Are there any other costs? + Only extra resubmissions beyond your package limit (£100 + VAT each). Guide access (normally £85 + VAT for six months) is included in every package. Your own costs are internal time and any fixes, such as replacing unsupported software or paying your IT provider to enable MFA. Is Cyber Essentials worth the cost? + For most organisations, yes: from £320 + VAT it opens contracts that require it and puts in place controls that guard against the most common cyber attacks. Our guide answers is Cyber Essentials worth it in more detail. How hard is it to get Cyber Essentials? + Not hard if your scope is right, MFA is on for every cloud service and your software is still supported. Our guide explains how hard it is to get Cyber Essentials and what to fix first. Does the price include cyber insurance? + Yes, for eligible organisations, at no extra cost. IASME includes cyber liability cover with a £25,000 limit if you certify your whole organisation, are domiciled in the UK or Crown Dependencies, have annual turnover under £20m and opt in. See Cyber Essentials insurance. Can you get Cyber Essentials for free? + Not at the moment. The NCSC’s Funded Cyber Essentials Programme, which gave eligible micro and small organisations free support towards certification, is closed (checked 13 October 2026). If a new round opens, IASME will announce it; our guide to Cyber Essentials for charities lists the free help that is still available. --- # Cyber Essentials Plus Cost 2026: UK Prices by Size URL: https://sovereignsecure.co.uk/cyber-essentials-plus-cost/ Cyber Essentials Plus ## Cyber Essentials Plus Cost (2026 UK Prices) Updated October 2026 What Cyber Essentials Plus costs at UK providers, why two quotes for the same organisation can differ by £500 or more, and how to scope the audit so you only pay for what needs testing. Get a fixed CE+ quote Free readiness check - Sourced UK prices by company size - Basic CE included in every Sovereign CE+ quote - Free remote retests of up to one hour The short answer The Cyber Essentials Plus certification cost at UK providers we reviewed in September 2026 runs from £999 to £3,999 + VAT, set mainly by size: £999 to £1,499 for micro businesses, £1,999 for small, £2,399 to £2,499 for medium and £2,999 to £3,199 for large, with one provider charging £3,999 for its top band. Some prices exclude the basic Cyber Essentials assessment. Cyber Essentials Plus costs between £999 and £3,999 + VAT at the UK providers we reviewed in September 2026, and organisation size accounts for most of the difference. A micro business (0 to 9 staff) pays £999 to £1,499 for the audit; an organisation with 250 or more staff pays £2,999 or more. Beyond size, your actual Cyber Essentials Plus cost depends on how many operating system versions need testing, whether the basic Cyber Essentials assessment is included, whether the audit is remote or on-site, and whether anything fails and needs a retest. Sovereign Secure is an IASME-licensed Cyber Essentials certification body. We don’t publish a CE+ price list, because two 40-person companies can need very different audits. We give you a fixed quote after a five-minute scoping questionnaire, and every quote includes the basic Cyber Essentials assessment. ## How much does Cyber Essentials Plus cost in 2026? The table shows the prices UK providers publish on their own websites, collected in September 2026. All figures exclude VAT and are per certification. Organisation size | Staff | CE+ audit (published range) | CE + CE+ bundle (one provider) | Basic CE alone (IASME fee band) Micro | 0 to 9 | £999 to £1,499 | £1,299 | £320 Small | 10 to 49 | £1,999 | £2,400 | £440 Medium | 50 to 249 | £2,399 to £2,499 | £2,800 | £500 Large | 250+ | £2,999 to £3,199 | £3,700 | £600 Sources: published prices from UK providers we reviewed in September 2026; basic Cyber Essentials fee bands as published by IASME. One provider also lists an “Enterprise” band above Large at £3,999, and a third provider advertises CE+ from £1,475. Three things are worth knowing before you compare numbers: - The headline price is not always the total. One provider sells the basic self-assessment as a £320 add-on to its CE+ product, so a micro business pays £1,819 there, not £1,499. - Size bands follow the basic scheme. Providers that price by size use the same micro, small, medium and large bands IASME uses for basic Cyber Essentials, so the staff count you declare sets your band. - Quote-based pricing is normal. IASME sets fixed fee bands only for basic Cyber Essentials; certification bodies price the Plus audit themselves, based on how much there is to test. The NCSC Cyber Essentials overview explains how the two levels differ. Size bands are a starting point, not the final figure. For the basic scheme on its own, see our Cyber Essentials cost page, with packages from £320 + VAT. ## Does the Cyber Essentials Plus price include Cyber Essentials? Not always, so check before you compare quotes. You must achieve Cyber Essentials basic certification before the Plus audit, and the audit must be completed within three months of that certificate. Some certification bodies price the two separately; others bundle them. Sovereign Secure includes the basic Cyber Essentials assessment in every Cyber Essentials Plus quote, so you deal with one certification body and one timeline. Whoever you use, ask these questions before you sign: Question to ask | Why it changes the price Is the basic Cyber Essentials assessment included? | If not, add £320 to £600 + VAT (the IASME bands) How many devices will be sampled? | More devices mean a longer audit Is the audit remote or on-site? | On-site adds travel time and expenses How many retests are included, and on what terms? | Paid retests start from £400 + VAT with us How long do we have to fix failures? | Missing the deadline can mean paying for a new assessment Are fast-track dates or pre-audit checks extra? | Published add-ons run from £300 to £1,200 ## What drives the cost of Cyber Essentials Plus? Assessor time. The CE+ audit is a hands-on test of a sample of your devices, your internet-facing IP addresses and your cloud accounts, following the NCSC Cyber Essentials Plus Test Specification. Anything that adds devices, locations or checks adds time, which is why we price on the number of devices, sites and cloud services in scope. Cost driver | What pushes the price up | How to keep it down Operating system variety | Each OS version is sampled separately, so Windows 11 Pro 24H2 and 25H2 count as two groups | Bring devices onto the same build before the audit Devices per OS version | The sample rises from 1 device to 5 as numbers grow | Retire devices you no longer use Servers and mobiles | Servers, and phones that access company data such as email, are sampled the same way | Keep mobile OS versions current and consistent Number of sites | The assessor must reach sample devices at every site | Make one machine able to reach all the others Cloud services | MFA and admin-account checks on each cloud service in scope | Enforce MFA on every service before audit day Remote or on-site | On-site adds assessor travel time and expenses | Choose remote unless you have a reason not to Retests | Each failure needs fixing and retesting | Check patching and anti-malware yourself first Speed | One provider charges £800 to audit within a week | Book the audit when you submit basic CE ## How the device sample is calculated The sample is set per operating system version, not per organisation: Devices running the same OS version | Devices tested 1 | 1 2 to 5 | 2 6 to 19 | 3 20 to 60 | 4 61 or more | 5 Here is an illustrative 40-person firm, before and after moving every Windows laptop to the same feature release: Device group | Devices before | Tested before | Devices after | Tested after Windows 11 Pro 24H2 laptops | 14 | 3 | 0 | 0 Windows 11 Pro 25H2 laptops | 22 | 4 | 36 | 4 macOS laptops (one version) | 4 | 2 | 4 | 2 iPhones (one iOS version) | 30 | 4 | 30 | 4 Android phones (one version) | 10 | 3 | 10 | 3 Windows Server 2022 | 1 | 1 | 1 | 1 Total devices tested | | 17 | | 14 Three fewer devices means a shorter audit and three fewer chances to fail a patching test. Our scoping questionnaire estimates your sample automatically as you enter device numbers. ## Is an on-site Cyber Essentials Plus audit more expensive? Usually, yes. An on-site audit adds the assessor’s travel time and expenses, and a multi-site organisation may need more than one visit. Most of our audits are remote: we provide a scanning tool, and your administrator shares their screen (Microsoft Teams, Quick Assist or similar) while we test the sample devices. A remote audit works when you have: - an administrator available throughout, able to view or control every sample device at every site; - our scanning software installed on one designated machine before the day; - the asset declaration form returned at least two weeks before the audit. On-site audits are available when remote access isn’t practical, including on-site audits in London. Say so in the scoping questionnaire and the quote will reflect it. ## What does a Cyber Essentials Plus retest cost? At Sovereign Secure, a remote retest of up to one hour within one month of the audit is free. Other retests start at £400 + VAT. You provide evidence of the fix and we retest the failed items. If the retest isn’t completed within the month, a full new assessment and a new quote are needed. Retest terms vary between providers, so read them before you buy. Among the providers we reviewed, one includes “several free rescans” only in a £1,200 extra-help package and allows 30 days for remediation. Failures come from the things the audit tests directly: - a sample device missing a high or critical security update (Cyber Essentials requires these within 14 days of release); - anti-malware that doesn’t block the test files we send by email and download in the browser; - a browser that runs downloaded files without a warning; - a cloud service without multi-factor authentication enforced. Work through our Cyber Essentials Plus requirements checklist before audit day to catch these early. ## How does the three-month rule affect the cost? The CE+ audit must be completed within three months of your Cyber Essentials certificate being issued. If the window closes, the basic assessment has to be repeated before the audit can go ahead, so you pay for it twice. To stay inside the window: - Book the CE+ audit date before you submit the basic assessment. - Return the asset declaration form at least two weeks before the audit. - Submit the basic Cyber Essentials assessment at least one week before the audit. - Leave time to fix and retest within a month if anything fails. Audit availability is the main timing risk. One provider we reviewed quotes a 2 to 3 week waiting list and charges £800 to audit within a week. ## Are mock audits, fast track and multi-year plans worth paying for? These are the add-on prices published by the providers we reviewed (ex VAT): Add-on | Published price | What you get Mock audit added to CE+ | +£300 to +£600, by size | A practice run before the real audit Standalone CE+ pre-assessment | £1,000 | A pre-audit check sold as a separate service Fast track | +£800 | Audit within one week Extra help package | +£1,200 | Pre-audit meeting and several free rescans CE + CE+ with pre-assessment and mock audit | £1,549 (micro) to £4,500 (large) | The full bundle from one provider Multi-year CE + CE+ | £4,180 to £8,550 for 2 years; £5,940 to £12,150 for 3 years | Two or three annual certifications bought up front A mock audit makes most sense for a first CE+ when you have no in-house IT team or many operating system versions. If your IT provider already applies updates within 14 days and you have passed before, it is often an avoidable cost, because a free remote retest covers small slips. Before you pay for one, try our free readiness check to see where the gaps are. If you want help getting ready, see our Cyber Essentials consultancy support. ## How does the total cost compare with basic Cyber Essentials? Aspect | Cyber Essentials | Cyber Essentials Plus How it’s assessed | Verified self-assessment questionnaire | Self-assessment plus a hands-on technical audit Published UK price (ex VAT) | £320 to £600 at the IASME bands; our packages £320 to £750 | £999 to £3,999 for the audit; basic CE may be extra Your team’s time | Answering the questionnaire | Questionnaire, asset declaration, an administrator on audit day, any fixes If something fails | Resubmission (extra ones £100 + VAT with us) | Retest: free remote up to one hour within a month with us, otherwise from £400 + VAT Validity | 12 months | 12 months; renew both each year The extra spend buys independent evidence that your controls work in practice, which is what some public sector, defence and enterprise contracts ask for. Our Cyber Essentials Plus certification page explains what the audit covers, and our Cyber Essentials Plus comparison guide helps you decide which level you need. ## Why get your Cyber Essentials Plus quote from Sovereign Secure? Sovereign Secure Ltd is an IASME-licensed Cyber Essentials certification body, established in 2012 and based in Accrington, Lancashire. - One supplier for CE and CE+. We issue both certificates, and the basic assessment is included in every CE+ quote. - Remote by default. Less disruption for multi-site and home-working teams, with on-site audits when you need them. - Clear retest terms. A free remote retest of up to one hour within a month; otherwise from £400 + VAT. - More than Cyber Essentials. We are also a PCI SSC Qualified Security Assessor (QSA) company and ISO 27001 certified, and our penetration testing team can take you further than CE+ when a customer asks for it. ## Get a fixed Cyber Essentials Plus quote Complete our Cyber Essentials scoping questionnaire. It takes about five minutes, rough numbers are fine, and it estimates your device sample as you go. We confirm your scope and send a fixed quote with the basic Cyber Essentials assessment included. Prefer to talk it through? Call +44 161 523 5276 or use the CE+ quote request form. Last reviewed October 2026 by the Sovereign Secure assessment team. div]:shrink-0 xl:[&>nav]:min-h-0 xl:[&>nav]:overflow-y-auto hidden"> FAQ ## Frequently asked questions How much does Cyber Essentials Plus cost? + Published UK prices we reviewed in September 2026 range from £999 to £3,999 + VAT, depending mainly on organisation size. Your exact price depends on the device sample, number of sites, cloud services and whether the audit is remote. Our scoping questionnaire gets you a fixed figure. Does the Cyber Essentials Plus price include Cyber Essentials? + Not always. Some providers sell the basic Cyber Essentials self-assessment as an extra on top of the CE+ audit. Sovereign Secure includes the basic assessment in every Cyber Essentials Plus quote. What happens if I fail a Cyber Essentials Plus test? + You fix the issue, provide evidence and are retested within 30 days. With us, remote retests of up to one hour are free; other retests start at £400 + VAT, and missing that deadline means a new assessment and a new quote. Is an on-site audit more expensive than a remote one? + Usually, because an on-site audit adds the assessor's travel time and expenses. Most of our audits are remote, using screen sharing and a scanning tool we provide, with on-site visits available when needed. Do I pay for Cyber Essentials Plus every year? + Yes. Certificates are valid for 12 months, so you renew Cyber Essentials and repeat the CE+ audit each year. See Cyber Essentials renewal for how to plan it. Why do Cyber Essentials Plus quotes vary so much? + Providers differ on whether the basic assessment, retests, mock audits and fast-track dates are included. Compare the total cost for the same scope, not the headline price. Is Cyber Essentials Plus worth the cost? + If a contract or customer asks for CE+, or you want independent proof that your controls work rather than a declaration, usually yes. See the benefits of Cyber Essentials Plus. What does the Cyber Essentials Plus price include? + With us: the basic Cyber Essentials assessment, the CE+ audit of your device sample (external scan, patch scans, malware, MFA and account-separation tests), both certificates and a free remote retest of up to one hour within a month. Elsewhere, check whether the basic assessment, retests and mock audits are included. How long does it take to get Cyber Essentials Plus? + Allow a few weeks: the asset declaration is due two weeks before the audit and the basic assessment one week before, most small organisations finish the audit in a day, and failures must be fixed and retested within 30 days. See the Cyber Essentials Plus timeline. --- # Cyber Essentials Checklist 2026: Every v3.3 Requirement URL: https://sovereignsecure.co.uk/cyber-essentials-checklist/ Cyber Essentials guide ## Cyber Essentials Checklist and Requirements (2026) Updated October 2026 This Cyber Essentials checklist turns every requirement in the NCSC's Requirements for IT Infrastructure v3.3 into checks you can work through device by device, with the evidence to have ready and the answers that most often fail. Free readiness check Get a CE quote - Checked against NCSC v3.3 (April 2026) - Written by an IASME-licensed certification body - Cyber Essentials from £320 + VAT The short answer The Cyber Essentials certification requirements are the NCSC Requirements for IT Infrastructure v3.3, across five controls: firewalls, secure configuration, security update management, user access control and malware protection. They cover every in-scope device, account and cloud service. The rules most often missed: MFA on all cloud services, high and critical updates within 14 days, and no unsupported software. A Cyber Essentials checklist lists what every in-scope device, account and cloud service must have in place before a certification body can certify you. Since 27 April 2026 the rules come from the NCSC’s Requirements for IT Infrastructure v3.3: five technical controls (firewalls, secure configuration, security update management, user access control and malware protection) applied across a scope you agree with your assessor. Each requirement below is a check, with the evidence to have ready and the mistake that most often fails it. Work through it for every device type and cloud service: one unsupported operating system or one cloud app without MFA can be enough to fail. The five controls at a glance, with the checks an assessor looks for. Select the image to open it full size. Need a Cyber Essentials checklist PDF to share with your IT provider or board? Save or print this page, with every table below, as a PDF. Save this checklist as a PDF ## What are the Cyber Essentials requirements? The NCSC sets the requirements and IASME runs the scheme through licensed certification bodies. The current document is Requirements for IT Infrastructure v3.3, answered through IASME’s Danzell question set. This requirements table covers the five controls and the three rules applicants ask about most, with a link to the full explanation of each: Requirement | What it asks | The rule most often missed | Read more Firewalls | Only secure, necessary services reachable from the internet | A software firewall on laptops used at home or on public wifi | Firewall requirements Secure configuration | Remove what you don’t need and lock devices | Default passwords and unused admin accounts left in place | Secure configuration; in Microsoft 365, tenant and device settings Security update management | Supported software, patched quickly | High and critical updates installed within 14 days | Security update management User access control | The right people, least privilege, separate admin accounts | Leavers’ accounts still active | User access control Malware protection | Stop malware from running | Protection active on every device, not most | Malware protection Passwords | Minimum lengths and protection against password guessing | Short passwords on accounts without MFA | Cyber Essentials password policy Multi-factor authentication (MFA) | MFA wherever it is available, and always on cloud services | MFA on email but not on other cloud apps | Cyber Essentials MFA; for Microsoft 365, MFA through security defaults or Conditional Access Mobile devices | Supported, updated and locked phones and tablets that only run approved apps | Old phones that no longer receive updates | Cyber Essentials mobile device requirements The checks for each control, with the evidence to have ready, are in the checklist below. ## What changed in April 2026 (v3.3 and Danzell)? Assessment accounts opened from 27 April 2026 follow v3.3 and the Danzell question set, which replaced Willow (v3.2). IASME gave organisations with an assessment account opened before then six months to certify against the previous version. Most changes are clarifications, but these change results: - MFA on cloud services is enforced. Authentication to cloud services must always use MFA, and IASME has confirmed that missing MFA where a cloud service offers it is now an automatic fail. - 14-day patching is an automatic fail. Questions A6.4 (operating systems and router and firewall firmware) and A6.5 (applications, including associated files and extensions) fail the whole assessment if high-risk or critical updates are not installed within 14 days of release. - Cyber Essentials Plus retests are stricter. If sampled devices fail the security update tests, the retest rechecks the original sample and also tests a new random sample. A second failure revokes the basic certificate, and your basic answers must be finalised and left unchanged before Plus testing starts. The rest clarify rather than change the rules: - Cloud services are now defined. v3.3 defines a cloud service as an on-demand, scalable service on shared infrastructure, reached over the internet through an account. Any service that fits and holds or processes your data is in scope. Cloud services have not been excludable since v3.0 (January 2022), so check you haven’t left any out. - FIDO2 authenticators (passkeys) are now named as passwordless authentication and count as MFA. - Scope no longer refers to “untrusted connections”, and backups get more emphasis (recommended, still not required). More detail: Cyber Essentials changes 2026. For what may change next, see Cyber Essentials 2027. ## Which devices and services must meet these checks? Your scope is the whole IT infrastructure you use to run the business, or a separately managed sub-set segregated by a firewall or VLAN, agreed with your certification body before assessment. It includes end-user devices, home workers’ devices, servers and staff-owned devices (BYOD) that access organisational data or services, and every cloud service, which can never be excluded. Our Cyber Essentials scope questionnaire explains what is in and out, with the conditions for each, and helps you draw the boundary. ## The Cyber Essentials checklist, control by control Work through these five tables for every device type and cloud service in scope. Each row is one check, with the evidence to have ready and the most common failure. For why each control exists, follow the link under each heading. ## Firewall checks Every in-scope device must sit behind a correctly configured firewall: a boundary firewall or router, or a software firewall on the device when you don’t control its network. The NCSC advises using the firewall built into desktop and laptop operating systems. More on the control: firewall requirements. Check | Evidence to have ready | Common failure Default admin password changed to a strong, unique one, or remote admin disabled | Make and model of each firewall and router | Router still on the password printed on its label Admin interface not reachable from the internet, unless a documented business need exists and MFA or an IP allow list plus a managed password protects it | Remote management setting | Remote management left on by the ISP or a former IT provider Unauthenticated inbound connections blocked by default | Default inbound policy | Old port forwards for CCTV or remote desktop Every inbound rule approved by an authorised person and documented with its business need | Rule list with owner and reason | Nobody can explain why a rule exists Rules removed or disabled when no longer needed | Date of last rule review | Rules for suppliers you stopped using Software firewall on devices used on untrusted networks such as public wifi | Firewall status by device type | Firewall switched off because it “blocked something” ## Secure configuration checks Remove what you don’t need and make sure only authenticated users get in. More on the control: secure configuration. Check regularly that: Check | Evidence to have ready | Common failure Unnecessary accounts, such as guest and unused admin accounts, are removed or disabled | User list per device and service | Leavers’ and vendor default accounts still active Default or guessable passwords are changed | Build or set-up procedure | Printers and NAS boxes on factory logins Unnecessary software, utilities and network services are removed or disabled | Software inventory | Old remote-access tools left installed Auto-run can’t execute files without the user’s authorisation | Group policy or MDM setting | Defaults never reviewed Users are authenticated before reaching organisational data or services | Sign-in method per system | A shared login on a reception PC Devices are locked with a biometric, password or PIN, with brute-force protection | Lock-screen and lock-out policy | Tablets with no PIN Brute-force protection means throttling to no more than 10 guesses in 5 minutes, or locking after no more than 10 failed attempts; where the vendor doesn’t allow either, its default is accepted. A PIN or password that only unlocks the device needs at least 6 characters. If it also signs the user in to services, the full password rules apply. ## Security update checks All software on in-scope devices must be licensed and supported, and high-risk or critical updates must be installed within 14 days of release. Software includes operating systems, off-the-shelf applications, extensions, interpreters, scripts, libraries, network software, and firewall and router firmware. More on the control: security update management. Check | Evidence to have ready | Common failure All software licensed and supported, so it still receives vendor security updates | OS and software inventory with versions | An old OS, or a phone that no longer gets updates Unsupported software removed, or moved to a sub-set with no internet traffic | Decommissioning record or network diagram | One legacy PC kept “for a single application” Automatic updates on where possible | Update policy per platform | Updates deferred indefinitely Critical and high-risk updates installed within 14 days | Patch reports showing install dates | Windows patched, but firmware and third-party apps missed An update falls under the 14-day rule if the vendor calls it critical or high risk, if it fixes a vulnerability with a CVSS v3 base score of 7 or above, or if the vendor gives no severity. If one update bundles mixed-severity fixes and any is high or critical, the whole update is due within 14 days. The NCSC recommends, but doesn’t require, installing every update within 14 days. ## User access control checks You must control who has an account and what it can reach, including accounts your IT provider or MSP uses. More on the control: user access control. Check | Evidence to have ready | Common failure A process to create and approve user accounts | Joiner form or ticket | Accounts created with no approval Unique credentials for every user | Account list | Shared “office” or “admin” logins Accounts removed or disabled when no longer needed | Leaver process and last review date | Former staff still active in Microsoft 365 MFA wherever available, and always on cloud services | MFA enforcement report per service | MFA on email but not on the HR or file-sharing app Separate admin accounts, never used for email or browsing | List of admin accounts and owners | The IT lead’s everyday account is a global admin Special privileges removed when no longer needed | Role-change process | Admin rights kept after a move of team Passwords and MFA each have their own guide. Our password policy guide sets out the full password rules, and our guide to multi-factor authentication explains which accounts need it and which factors count. ## Malware protection checks A malware protection mechanism must be active and kept up to date on every in-scope device, using at least one of two options. More on the control: malware protection. Option | Where it can be used | It must Anti-malware software | Windows and macOS devices, including servers | Update in line with the vendor; stop malware and malicious code running; block connections to malicious websites Application allow listing | Any in-scope device | Allow only approved, code-signed apps; approve apps before deployment; keep a current list; stop users installing unsigned apps Typically, computers run anti-malware and phones and tablets use allow listing through device management. Common failures: protection off on a server, web protection disabled, and staff installing unapproved apps. ## How to use this Cyber Essentials checklist - Agree your scope and list every device type, operating system version, cloud service and admin account. - Work through the five control tables and fix gaps first. Turning on MFA takes days; replacing unsupported hardware can take weeks. - Preview the questions on our Cyber Essentials questionnaire page and prepare answers offline. - Complete the self-assessment in the IASME portal. Your certification body’s assessor marks it, and you fix and resubmit anything flagged. - Get certified. The certificate is valid for 12 months. If a customer needs independent testing, the Cyber Essentials Plus requirements add a technical audit of the same five controls. - Write the rules down. Adopt our free cyber security policy template so the controls stay in place between renewals, and use our map of the NCSC 10 Steps to Cyber Security for the areas beyond the five controls. ## Why use Sovereign Secure for Cyber Essentials? Sovereign Secure Ltd is an IASME-licensed certification body that issues Cyber Essentials and Cyber Essentials Plus certificates. We are ISO 27001 certified, a PCI SSC Qualified Security Assessor (QSA) company and a member of the PCI SSC Global Executive Assessor Roundtable for 2026-2028. Every Cyber Essentials certification package includes a pre-assessment check, a support call of up to an hour, guide access and the certification fee. Packages start at £320 + VAT, and Gold includes assessment within one working day (24 hours) and unlimited resubmissions. ## Ready to certify? If every row above is a tick, choose a package on our Cyber Essentials cost page. Not sure? Our free Cyber Essentials readiness check scores you against the same v3.3 rules in about five minutes. Still checking whether a customer requires it? See do I need Cyber Essentials in our Cyber Essentials FAQs. If you found gaps you can’t close alone, our Cyber Essentials consultancy team can help you close them before you submit. Or call +44 161 523 5276 to talk it through with an assessor. Last reviewed October 2026 by the Sovereign Secure assessment team. div]:shrink-0 xl:[&>nav]:min-h-0 xl:[&>nav]:overflow-y-auto hidden"> FAQ ## Frequently asked questions What are the 5 Cyber Essentials controls on this checklist? + Firewalls, secure configuration, security update management, user access control and malware protection; our guide to the 5 Cyber Essentials controls explains each one. What does Cyber Essentials cover? + Five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. They apply to every device, account and cloud service in your scope. Backups are strongly recommended by the NCSC but are not a Cyber Essentials requirement. When do these requirements become mandatory? + When a contract requires Cyber Essentials: most often a UK central government or NHS contract covered by PPN 014, though many other buyers ask for it too. No UK law requires it of organisations in general; see Is Cyber Essentials mandatory? How do I become Cyber Essentials certified? + Work through this checklist, answer the self-assessment questions and submit them to a licensed certification body for assessment; our guide on how to get Cyber Essentials certification covers each step. Do I need Cyber Essentials if I have ISO 27001? + Usually, if a customer asks for it: ISO 27001 certification does not automatically meet Cyber Essentials, because its scope may leave out some of the five controls; see Cyber Essentials vs ISO 27001. Which password rules are on the checklist? + At least 8 characters with MFA, or 12 without (8 if common passwords are blocked), plus protection against guessing; our Cyber Essentials password policy guide has the full rules. Are mobile devices in scope for Cyber Essentials? + Yes, if they access organisational data or services such as email, whoever owns them; see Cyber Essentials mobile device requirements for the rules they must meet. Is BYOD in scope for Cyber Essentials? + Yes. Staff, volunteer and trustee-owned devices that access organisational data or services are in scope. Devices used only for native calls, texts or an MFA app are out of scope, and so are devices owned by students, customers, contractors or your MSP. What is the Cyber Essentials patching deadline? + 14 days from release for any update that fixes a vulnerability the vendor rates critical or high risk, that scores 7 or more on CVSS v3, or where the vendor gives no severity. If one update bundles fixes of mixed severity, the whole update falls under the 14-day rule. Can cloud services be excluded from Cyber Essentials scope? + No. Cloud services that hold or process your data have had to be in scope, with no option to exclude them, since v3.0 (January 2022). v3.3 (April 2026) adds a formal definition of a cloud service, and authentication to cloud services must always use MFA. IASME has confirmed that missing MFA on a cloud service that offers it is now an automatic fail. Do home workers' routers have to meet the firewall rules? + Only if your organisation supplied the router. Home workers' own ISP routers are out of scope, so the firewall control moves to the device: a correctly configured software firewall, or a corporate VPN that puts the boundary on your company firewall. Is there an official Cyber Essentials checklist? + Not as such. The NCSC publishes the requirements and IASME publishes the question set you answer. This page turns the requirements into checks, and you can preview the questions on our Cyber Essentials questionnaire page. --- # PCI DSS Consultancy & Consulting UK | QSA-Led Consultants URL: https://sovereignsecure.co.uk/pci-services/pci-dss-consultancy/ PCI DSS consultancy · v4.0.1 ## PCI DSS Consultancy and Consultants from a QSA Company Scoping, gap analysis, remediation and SAQ support for PCI DSS v4.0.1, from a PCI SSC-approved QSA company that knows what assessors will ask for. Get a PCI quote Free PCI compliance check - PCI SSC-approved QSA, QPA and CPSA company - PCI SSC GEAR member 2026 to 2028 - Scoping, gap analysis, remediation and SAQ support The short answer A PCI DSS consultant gets you ready before you are formally assessed. They confirm your scope, run a gap analysis against the 12 requirements of PCI DSS v4.0.1, manage remediation, write policies and prepare your SAQ or ROC evidence. A QSA assessment is the separate test that follows. Timing depends on your scope and gaps. A PCI DSS consultant gets your business ready for PCI DSS before anyone formally assesses it. The work covers confirming what is in scope, finding the gaps against PCI DSS v4.0.1, planning and managing the fixes, writing policies, and preparing evidence for your Self-Assessment Questionnaire (SAQ) or Report on Compliance (ROC). Sovereign Secure is a PCI SSC-approved Qualified Security Assessor (QSA) company, so our PCI DSS consultancy is shaped by how assessments are actually run. ## What does a PCI DSS consultant do? A PCI DSS consultant turns the standard into a plan for your business: what applies, what is missing, who fixes it and by when. Our PCI DSS consulting services cover eight areas. Take one, or all of them. Service | What it involves | What you get Scoping and scope reduction | Data-flow workshops to find everywhere card data is stored, processed or transmitted, then ways to shrink it: segmentation, PCI DSS tokenisation or outsourcing | A documented cardholder data environment (CDE) and a scope-reduction plan Gap analysis and readiness | A requirement-by-requirement review against PCI DSS v4.0.1 | A gap report with priorities, owners and timescales Remediation programme management | Running the fix list with your IT team and third parties, reviewing evidence as it arrives | Tracked progress and no surprises on assessment day Policies and procedures | Writing the PCI DSS policies and procedures the standard requires, fitted to how you work | Documents staff can follow and an assessor can test Targeted risk analysis (TRA) | The risk analyses v4.0.1 requires wherever you set your own frequency for a control (Requirement 12.3.1) | Documented TRAs that justify each frequency you choose SAQ completion support | Confirming the right SAQ, checking eligibility, and reviewing answers and evidence before you sign | An SAQ and Attestation of Compliance (AOC) you can stand behind v4.0.1 future-dated requirements | Closing the requirements that became mandatory on 31 March 2025, such as MFA for all non-console access into the CDE (8.4.2) and payment page script controls (6.4.3 and 11.6.1) | Working controls and evidence for the newest requirements Service provider readiness | Preparing for SAQ D for Service Providers or a ROC, including six-monthly scope confirmation (12.5.2.1) and segmentation testing (11.4.6) | A realistic route to the AOC your customers ask for Whether you call the review a gap assessment or a readiness assessment, our guide to PCI DSS gap analysis explains what it covers, and our PCI DSS scoping guide explains the step before it. ## PCI DSS consultancy or QSA assessment: which do you need? You need a consultant to get ready and a PCI compliance audit to prove it. A consultant works alongside you and recommends. In a PCI QSA assessment, the assessor tests independently, through interviews, document review, sampling and observation, and reports. Most first-time programmes need both, in that order. Aspect | PCI DSS consultancy | QSA assessment Purpose | Get ready: scope, gaps, fixes and documentation | Validate compliance formally Output | Scope documents, gap report, remediation plan, policies, TRAs | ROC and AOC, or an SAQ validated by a QSA Who relies on it | You and your project team | Your acquirer, the card brands and your customers When | Before an assessment, or when something changes | On an annual cycle Required? | No, it is optional | A ROC is required for Level 1 merchants (over 6 million card transactions a year) and Level 1 service providers (over 300,000), normally completed by a QSA; acquirers may ask for QSA involvement at other levels If you are new to PCI, our guide to PCI compliance in the UK explains who needs it, the merchant levels and what your acquirer expects. ## Can the same company consult and assess? Yes, with safeguards. The principle is simple: nobody should assess work they designed or built. PCI SSC sets independence requirements for QSA companies, and any firm offering both services should be able to tell you plainly how it meets them. Before any engagement, we will explain how we keep advisory and assessment work separate for your organisation: who advises, who assesses, and how the two are kept apart. You are also free to use us for consultancy and a different QSA for your assessment, or the other way round. Whoever you choose, ask these four questions: - Will anyone who designed or implemented our controls be on the assessment team? - Who reviews the assessment findings before the report is issued? - Is any consultancy fee linked to the assessment outcome? - Can we appoint a different QSA for the assessment if we prefer? ## When do businesses bring in a PCI DSS consultant? Most engagements start with a deadline, an acquirer letter or a customer questionnaire. Common triggers: Situation | What a consultant does first A customer asks your business, as a service provider, for a PCI AOC for the first time | Confirms that you are a service provider, your level, and whether SAQ D for Service Providers or a ROC applies Your acquirer is charging a monthly PCI non-compliance fee | Identifies the right SAQ, closes the gaps blocking it and gets it submitted A previous assessment failed or stalled | Reviews the findings, separates real control gaps from evidence problems, and builds a remediation plan Your e-commerce payment pages must meet 6.4.3 and 11.6.1 | Inventories payment page scripts, checks SAQ eligibility and sets up change- and tamper-detection Your team takes card payments by phone | Maps where card numbers and security codes are spoken, keyed and recorded, and weighs descoping options such as payment links or DTMF masking (see our guide to taking card payments over the phone) You are adding a payment channel, moving to the cloud or merging | Re-confirms scope before the change goes live, as Requirement 12.5.2 expects A note for e-commerce merchants: PCI SSC’s January 2025 update to SAQ A replaced requirements 6.4.3 and 11.6.1 with an eligibility criterion confirming your site is not susceptible to attacks from scripts. You still need to be able to justify that confirmation. ## How does PCI DSS implementation work with a consultant? Most engagements follow the same path, and you choose how much help you need along it. - Discovery call. How you take payments, your merchant or service provider level, and your deadline. - Scoping workshop. Data flows, systems and third parties, ending in a documented CDE. - Gap analysis. A gap report and a prioritised plan with owners. - Remediation. You close the gaps with our guidance, and we review evidence as it arrives. - Readiness review. A final check before you sign your SAQ or your assessment begins. Our PCI DSS compliance roadmap sets out the same path as a five-phase plan, with a free spreadsheet of tasks, owners and deadlines. Engagement model | Best for | How we quote Fixed-scope gap analysis | Businesses that want a clear picture and will fix gaps themselves | Fixed quote after a scoping call Retained consultant | Teams that want expert answers on demand through the year | An agreed allocation of days per month or quarter Full programme management | First-time ROCs, service providers, and multi-site or multi-country estates | Fixed quote for each phase Cost depends on scope: payment channels, the number of locations and systems in the CDE, merchant or service provider status, and how much documentation already exists. Our page on PCI compliance cost shows how these drivers add up. Where testing is part of the gap, we also provide PCI DSS penetration testing. External ASV scans are delivered through our PCI SSC Approved Scanning Vendor partner. If your card data environment runs in the cloud or with a hosting provider, our guides to AWS PCI compliance and PCI compliant hosting explain how responsibility is split. ## What should you look for in a PCI compliance consultant? Look for listed credentials, current v4.0.1 knowledge and a straight answer on independence. - Listed credentials. Check the firm on the PCI SSC Qualified Security Assessor list. A QSA company knows what assessors test and what evidence they accept. - v4.0.1 depth. Ask how they handle targeted risk analyses, the customised approach and payment page scripts. - Scope first. A good consultant shrinks your scope before adding controls. - Independence. Ask the four questions above. - Defined deliverables. Scope documents, a gap report and a plan with owners, not open-ended days. ## PCI compliance consulting for US merchants and service providers PCI DSS is one global standard, so our PCI consulting works the same way in the US. Sovereign Secure has an office in Los Angeles, plus offices in Singapore, Dubai and Dhaka for multi-country estates. ## Why Sovereign Secure - A PCI SSC-approved assessor. Sovereign Secure Ltd (company no. 08334453, est. 2012, Accrington, Lancashire) is a Qualified Security Assessor (QSA), Qualified PIN Assessor (QPA) and Card Production Security Assessor (CPSA) company. - Part of the assessor community. We are a member of the PCI SSC Global Executive Assessor Roundtable for 2026 to 2028. - The whole payments chain. We also assess PCI PIN and card production, so we see how card data moves beyond the web shop. - Security we practise. We are ISO 27001 certified and also provide penetration testing and vulnerability scanning. - Clients include Accor, Fiserv, Ticketmaster, Cashplus and Kuwait Finance House. See our full range of PCI DSS compliance services. ## How to get started Need PCI compliance help? For a quick first view, try our free PCI compliance check. Then tell us how you take card payments and when you need to be compliant. We will confirm what applies to you, recommend the smallest engagement that gets you there, and send a fixed quote. Contact our PCI team or call +44 161 523 5276. Last reviewed October 2026 by the Sovereign Secure assessment team. div]:shrink-0 xl:[&>nav]:min-h-0 xl:[&>nav]:overflow-y-auto"> FAQ ## Frequently asked questions What does a PCI DSS consultant do? + A PCI DSS consultant helps you get ready for compliance: confirming scope, running a gap analysis against PCI DSS v4.0.1, planning remediation, writing policies and preparing SAQ or ROC evidence. They advise. A QSA assessment is the separate, formal test that follows. Can the same company consult and assess? + Yes, with safeguards. Nobody should assess work they designed or built, and PCI SSC sets independence requirements for QSA companies. Before any engagement we will explain how we keep advisory and assessment work separate, and you are free to use a different QSA for your assessment. How much does PCI DSS consultancy cost? + It depends on scope: your payment channels, how many systems and locations sit in the cardholder data environment, whether you are a merchant or a service provider, and how much documentation already exists. We send a fixed quote after a short scoping call. Our PCI compliance cost page explains the main drivers. How long does it take to become PCI DSS compliant? + A merchant with a simple, outsourced payment setup can often complete an SAQ within a few weeks. A first Report on Compliance (ROC) programme, including gap analysis and remediation, usually takes several months, depending on scope and how many gaps the analysis finds. What should I look for in a PCI DSS consultant? + Check the firm is listed by PCI SSC, ask how it handles v4.0.1 requirements such as targeted risk analysis and payment page scripts, and ask how it keeps consultancy separate from assessment. A good consultant will try to reduce your scope before adding controls. Do I need a consultant to complete an SAQ? + Not always. Many small merchants can complete an SAQ themselves once they know which SAQ applies. A consultant helps when eligibility is unclear, your acquirer has rejected a submission, or you are paying monthly non-compliance fees. Do you provide PCI compliance consulting in the US? + Yes. PCI DSS is the same global standard in the US and the UK. Sovereign Secure has an office in Los Angeles and works with US merchants and service providers on scoping, gap analysis and SAQ or ROC readiness. --- # PCI Penetration Testing UK: PCI DSS 11.4 Pen Tests URL: https://sovereignsecure.co.uk/pci-services/pci-penetration-testing/ PCI DSS Requirement 11.4 ## PCI DSS Penetration Testing Internal, external, application-layer and segmentation testing scoped to PCI DSS v4.0.1 Requirement 11.4, from a PCI SSC-approved QSA company that knows what your assessor will check. Get a PCI quote Free PCI compliance check - Scoped to 11.4.1 to 11.4.7 of PCI DSS v4.0.1 - PCI SSC QSA company and GEAR member 2026 to 2028 - Report with a sub-requirement evidence map The short answer PCI compliance penetration testing is required by PCI DSS Requirement 11.4: an internal and an external PCI pen test at least once every 12 months and after any significant change, including application-layer testing. If segmentation reduces your scope, it must be tested every 12 months, or every 6 months for service providers. Exploitable findings must be fixed and retested. PCI DSS penetration testing, also called PCI pen testing or PCI compliance penetration testing, is the manual testing Requirement 11.4 of PCI DSS v4.0.1 demands: internal and external tests of your cardholder data environment (CDE) at least every 12 months and after any significant change, application-layer testing, and proof that any segmentation you rely on isolates the CDE. Exploitable findings must be fixed and retested. Sovereign Secure is a PCI SSC-approved Qualified Security Assessor (QSA) company. We scope each test against the sub-requirement your assessor will check, and report so the evidence drops straight into your SAQ or Report on Compliance (ROC). It is part of our PCI DSS compliance services. ## What are the PCI DSS penetration testing requirements? Requirement 11.4 has seven parts (11.4.1 to 11.4.7). In plain English: Sub-requirement | What it asks for | Applies to | Frequency 11.4.1 Methodology | A documented, industry-accepted approach covering the CDE perimeter and critical systems, inside and outside, at application and network layers; results kept for 12 months | Everyone validating 11.4 | Kept current 11.4.2 Internal test | Testing from inside your network towards the CDE | Merchants and service providers | Every 12 months and after significant change 11.4.3 External test | Testing of the internet-facing perimeter and exposed services | Merchants and service providers | Every 12 months and after significant change 11.4.4 Fix and retest | Exploitable vulnerabilities corrected according to your risk ranking (Req. 6.3.1), then retested | Everyone | After every test 11.4.5 Segmentation | Proof that segmentation controls isolate the CDE from all out-of-scope systems | Anyone using segmentation to reduce scope | Every 12 months and after segmentation changes 11.4.6 Segmentation (service providers) | As 11.4.5, but more often | Service providers | Every 6 months and after segmentation changes 11.4.7 Multi-tenant support | Help customers carry out their own external testing | Multi-tenant service providers | Mandatory since 31 March 2025 Three details catch people out. The tester must be qualified and organisationally independent, but need not be a QSA or Approved Scanning Vendor (ASV). Application testing must cover at least the attack types in Requirement 6.2.4, such as injection, access control and business logic. And the methodology must consider threats from the last 12 months. The PCI SSC’s Penetration Testing Guidance information supplement sets out what assessors expect. ## What is PCI testing? Scans, pen tests and segmentation tests PCI testing is the regular security testing PCI DSS Requirement 11 asks for: vulnerability scans, penetration tests, segmentation tests and wireless checks, each producing evidence for your SAQ or Report on Compliance. The four parts are: - Vulnerability scans (11.3). Internal scans at least every three months by a qualified internal or external resource (11.3.1), and external scans at least every three months by a PCI SSC Approved Scanning Vendor (11.3.2). We run internal vulnerability scanning and deliver ASV scans through our PCI SSC Approved Scanning Vendor partner. - Penetration tests (11.4.1 to 11.4.4). Manual internal, external and application-layer testing every 12 months and after significant change, with exploitable findings fixed and retested. This is the focus of this page. - Segmentation tests (11.4.5 and 11.4.6). Proof that out-of-scope networks cannot reach the CDE, every 12 months for merchants and every 6 months for service providers. - Wireless checks (11.2). Testing for authorised and unauthorised wireless access points at least every three months, whether or not you use wireless in the CDE. Our wireless penetration testing service includes these rogue access point checks, and our wireless security audit checklist covers what to review in between. Requirement 11 also covers intrusion and change detection (11.5) and payment page tamper detection (11.6). Scans and tests are planned together, so dates and scope line up. A penetration test is also a practical check on your logging: compare the testers’ timeline with your alerts to see whether your PCI DSS Requirement 10 logging and monitoring caught them. Testing is not the same as validating compliance. It produces evidence for your SAQ or Report on Compliance; validation comes from the SAQ itself or from a PCI compliance audit. For a quick view of how ready you are before you book anything, try our free PCI compliance test. ## What does a PCI penetration test cover? The routes an attacker would take to card data, each mapped to its sub-requirement: Area | What we look at | Maps to External perimeter | Internet-facing IPs, firewalls, VPN and remote access, web servers in or connected to the CDE | 11.4.3 Internal network | Starting from a corporate foothold: Active Directory, lateral movement and paths into CDE systems and databases | 11.4.2 Segmentation controls | Firewall rules, VLAN access lists and cloud security groups, tested from every out-of-scope segment | 11.4.5 / 11.4.6 Payment applications and APIs | Manual testing following the OWASP Web Security Testing Guide, including authentication, authorisation and business logic | 11.4.1, 6.2.4 E-commerce pages | The servers and code that deliver or redirect to your payment form | 11.4.3 Card-present estates | Store and POS networks; POS and PIN device testing where needed | 11.4.2 / 11.4.5 Network work follows our infrastructure penetration testing method and application work our web application penetration testing service, in one engagement. Where customers pay through your own iOS or Android app, our mobile app penetration testing covers the app and the APIs behind it. ## What is PCI segmentation testing? Segmentation testing proves that systems outside your CDE cannot reach it. Without effective segmentation, your whole network is in PCI DSS scope. From each out-of-scope network, we scan TCP and UDP ports towards the CDE ranges and compare the results with your approved, documented flows. Any unexpected route is a failure to fix and retest. Merchants repeat this every 12 months and service providers every 6 months, plus after any change to the controls; our guide to PCI DSS for service providers covers the other requirements that apply only to them. Our PCI DSS scoping guide explains how to draw the boundary first, and our guide to PCI network segmentation shows how to design it. ## Which SAQ types need a penetration test? It depends on which SAQ you complete, or whether you need a ROC: Validation | Typical PCI penetration testing scope | Segmentation test SAQ A (full redirect or iframe) | No penetration testing in the SAQ. If your site builds the payment form (direct post or JavaScript), you are likely SAQ A-EP | Not in SAQ SAQ A-EP | External test and application testing of the web servers and site that deliver or affect the payment page | If segmentation limits scope SAQ B-IP or SAQ C | No internal or external penetration test in the SAQ | Every 12 months, if segmentation reduces scope (11.4.5) SAQ D merchant or ROC merchant | Internal and external tests of the CDE and connected systems, plus payment applications and APIs | Every 12 months, if segmentation reduces scope Service provider (SAQ D or ROC) | As above, across the whole service environment, including customer-facing APIs; multi-tenant providers also need an 11.4.7 process | Every 6 months, if segmentation reduces scope ## How often is PCI DSS penetration testing required? At least every 12 months and after any significant change. Scanning runs on its own cycle: Activity | Requirement | Minimum frequency | Performed by Internal and external penetration test | 11.4.2, 11.4.3 | 12 months and after significant change | Qualified, independent tester Segmentation test | 11.4.5 / 11.4.6 | 12 months (merchants) or 6 months (service providers) | Qualified, independent tester Internal vulnerability scan | 11.3.1 | Every 3 months and after significant change | Qualified internal or external resource External vulnerability scan | 11.3.2, 11.3.2.1 | Every 3 months (ASV), and after significant change | A PCI SSC Approved Scanning Vendor for the quarterly scans PCI DSS guidance gives examples of significant change: new or replaced CDE systems, changes to how account data flows or is stored, a new CDE boundary, and changes to supporting infrastructure or service providers. An ASV scan is not a penetration test; we deliver quarterly ASV scans through our PCI SSC Approved Scanning Vendor partner. ## What should a PCI penetration test report include? - Executive summary for management: overall risk and status per sub-requirement. - Technical findings with CVSS scores, reproduction steps and remediation advice, ready for your 6.3.1 risk ranking. - Segmentation results: every segment tested, ports and protocols checked, pass or fail. - Methodology and independence statement covering the 11.4.1 methodology and the tester independence that 11.4.2, 11.4.3 and 11.4.5 require. - Retest of remediated findings, with a letter confirming exploitable issues are closed (11.4.4). Every report includes an evidence map, laid out like this: PCI DSS sub-requirement | Where the evidence sits 11.4.1 Methodology | Methodology section: approach, standards, threats considered 11.4.2 / 11.4.3 Internal and external | Findings sections: scope, dates, results 11.4.4 Remediation | Retest section and retest letter 11.4.5 / 11.4.6 Segmentation | Segmentation section: results per segment ## Black box, grey box or white box: which does a PCI pen test need? Grey box or white box, in practice. PCI DSS v4.0.1 does not name an approach, but Requirement 11.4.1 expects the test to cover the entire CDE perimeter and critical systems, from inside and outside the network, and 11.4.5 expects every segmentation control to be checked. A tester can only do that if they know where the CDE is. Approach | What the tester is given | Where it fits in a PCI pen test Black box | Little or nothing beyond target addresses or URLs | Shows what an outsider can find on your perimeter, but on its own can miss in-scope systems, which an assessor comparing scope with your CDE diagram will notice Grey box | CDE IP ranges, network and data-flow diagrams, and accounts for each application role | The usual choice: internal, external, application and segmentation testing aimed at the documented scope White box | Full documentation and configurations, and often source code | The deepest option for bespoke payment applications, often combined with source code review The PCI SSC’s Penetration Testing Guidance supplement describes all three approaches. Our guide to black box vs white box penetration testing compares coverage, realism and cost in more detail. ## How does PCI penetration testing fit your QSA assessment? Test early enough to fix and retest before your assessment. Your assessor will compare the test scope with your network and data-flow diagrams, read the methodology and ask for retest evidence. Common reasons assessors reject pen test evidence: - the scope misses systems shown on the CDE diagram; - segmentation was tested from only some out-of-scope networks; - there is no retest evidence for exploitable findings; - the test is more than 12 months old; - the tester was not independent, for example the administrator who manages the firewall. If we also carry out your PCI DSS audit, we plan both together so dates and scope line up. ## How much does a PCI pen test cost? Cost follows scope, so we quote a fixed price after scoping. The main drivers: Cost driver | Why it changes the effort External IP addresses and exposed services | Each live host and service must be tested Internal CDE hosts and network segments | More segments mean more segmentation paths to prove Web applications, APIs and user roles | Application testing is manual and scales with functionality Segmentation frequency | Service providers test segmentation twice a year Card-present estate | Store networks and POS or PIN devices add test time A published UK pricing guide we reviewed in September 2026 put typical penetration tester day rates at about £1,000 to £1,500. Treat that as a market indication, not our price. For whole-programme budgets, see PCI compliance cost. ## Why Sovereign Secure for PCI DSS penetration testing - An assessor company that also tests. We are a PCI SSC-approved QSA, Qualified PIN Assessor (QPA), Card Production Security Assessor (CPSA), P2PE Assessor and 3DS Assessor company, and a member of the PCI SSC Global Executive Assessor Roundtable (GEAR) for 2026 to 2028. - Every layer in one team. Network, web, API, cloud, mobile, wireless and hardware testing, including POS and PIN devices. - Certified ourselves. ISO 27001 certified, and an IASME-licensed Cyber Essentials certification body. - UK head office, international reach. Based in Accrington, Lancashire, with offices in Los Angeles, Singapore, Dubai and Dhaka. Clients include Fiserv, Cashplus, Ticketmaster and Ahli United Bank. ## Get a PCI DSS penetration testing quote Send your CDE diagram, the number of external IPs, internal segments and applications, and your SAQ type or ROC date, and we will reply with a fixed scope and price. Use our penetration testing quote form or call +44 161 523 5276. Last reviewed October 2026 by the Sovereign Secure assessment team. div]:shrink-0 xl:[&>nav]:min-h-0 xl:[&>nav]:overflow-y-auto"> FAQ ## Frequently asked questions Does PCI DSS require penetration testing? + Yes, wherever Requirement 11.4 is in your validation. A Report on Compliance and SAQ D need internal and external tests, SAQ A-EP includes external testing of the systems behind your payment page, and SAQ A does not include penetration testing. How often is PCI penetration testing required? + Internal and external tests are needed at least once every 12 months and after any significant infrastructure or application change. Segmentation tests are annual for merchants and six-monthly for service providers, and are also repeated after any change to segmentation controls. What is PCI segmentation testing? + It is a test that proves your out-of-scope networks cannot reach the cardholder data environment. It is required by Requirement 11.4.5 whenever you use segmentation to reduce PCI DSS scope, and every six months for service providers under 11.4.6. Can my QSA's company do my penetration test? + Yes. PCI DSS requires the tester to be qualified and organisationally independent of the systems being tested, and states that the tester does not need to be a QSA or ASV. We can test and support your assessment, or review a report from another testing firm. Is an ASV scan a penetration test? + No. An ASV scan is an automated quarterly external vulnerability scan under Requirement 11.3.2, while a PCI pentest is manual testing that exploits weaknesses under 11.4. You need both; see our ASV scanning page. What counts as a significant change for PCI DSS? + PCI DSS guidance gives examples such as new or replaced systems in the CDE, changes to how account data flows or is stored, changes to the CDE boundary, and changes to supporting infrastructure or to service providers. You define the threshold, and your assessor will check you applied it. How much does a PCI penetration test cost? + It depends on the number of external IPs, internal segments, applications and APIs in scope, and how often segmentation must be tested. See our guide to penetration testing cost, then ask us for a fixed quote. --- # PCI Compliance Cost UK (2026): Audit, SAQ & Fees URL: https://sovereignsecure.co.uk/pci-services/pci-dss-cost/ PCI DSS v4.0.1 · Cost guide and estimator ## PCI Compliance Cost in the UK: Audit, SAQ and Fees What PCI compliance costs in the UK, what you are actually paying for, and how your scope sets the price. Use the free estimator to find your likely level, SAQ or ROC, and the drivers behind your price. Use the estimator Get a fixed quote - PCI SSC-approved QSA company - PCI SSC GEAR member 2026 to 2028 - Free level, SAQ and cost-driver estimator The short answer PCI compliance costs depend on your validation route. Published UK price guidance we reviewed in September 2026 ranged from about £500 at the low end to £20,000 to £75,000 or more at the top end. A small merchant on a short Self-Assessment Questionnaire (SAQ) sits near the bottom; a Level 1 Report on Compliance (ROC) with remediation sits near the top. Scope and remediation set the figure. Free tool ## PCI validation and cost-driver estimator Answer what you can; rough numbers are fine. The estimate updates as you go and nothing is sent anywhere unless you choose to request a quote. It shows your likely level, validation route and cost drivers, not a price. Your estimate The estimator needs JavaScript to work out your answers. Without it, use the level table below, the cost-driver table in this guide, or send us your answers for a fixed quote. Likely level Answer the questions Likely validation route Tell us how you take card payments. Scope complexity (indicative) Not enough answers yet Get a fixed quote Indicative only, and not a price. Your acquirer (or, for service providers, the card brands) confirms your level, and the SAQ eligibility criteria decide your route. ## Merchant levels (Visa and Mastercard) Level | Transactions a year, per brand 1 | Over 6 million 2 | 1 million to 6 million 3 (Mastercard) | Over 20,000 to 1 million online 4 (Mastercard) | All other merchants Levels 3 and 4 are Mastercard’s thresholds. Visa’s Level 3 is fewer than 1 million Visa e-commerce transactions, and Visa no longer publishes a Level 4. Service providers: Level 1 over 300,000 a year (and some provider types at any volume), Level 2 under 300,000. See PCI compliance levels. ## What you will typically need ## Your main cost drivers For context, published UK price guidance we reviewed in September 2026 ranged from about £500 at the low end to £20,000 to £75,000 or more at the top end. We quote a fixed price once we have confirmed your scope. ## How much does PCI compliance cost? There is no fixed PCI compliance cost, because the standard does not set one. The PCI Security Standards Council (PCI SSC) does not charge merchants to comply, and PCI DSS v4.0.1 and every SAQ are free from the PCI SSC document library. What you pay for is the work: validating each year, the scans and tests your route requires, and fixing whatever is missing. Published UK price guidance we reviewed in September 2026 ranged from around £500 at the low end to £20,000 to £75,000 or more at the top end. Two businesses with the same turnover can sit at opposite ends, because one takes payments through a hosted payment page and the other stores card numbers. What you are paying for, and how often: Cost item | Who needs it | How often | What sets the price Completing an SAQ | Level 2 to 4 merchants; Level 2 service providers (SAQ D only) | Every year | Staff time and the SAQ type: SAQ A is short, SAQ D covers every applicable requirement QSA review or signature on an SAQ | When your acquirer or a customer asks, and often at merchant Level 2 | Every year | Number of channels and the evidence to review Report on Compliance (QSA audit) | Level 1 merchants and service providers, or anyone whose contracts require it | Every year | Assessor days: scope, locations, sampling, remote or on-site work Gap analysis or readiness review | First-time validators and anyone moving to a ROC | Usually once, then as needed | Scope and how much documentation already exists ASV scans | Anyone whose SAQ or ROC includes Requirement 11.3.2 | Every quarter, plus rescans | Number of public IP addresses and domains Penetration and segmentation testing | ROC and SAQ D; external testing for SAQ A-EP; anyone relying on segmentation | At least every 12 months and after significant change; segmentation every 6 months for service providers | Number of IP addresses, applications and network segments Remediation and tooling | Anyone with gaps | Mostly one-off, then running costs | MFA, logging, file-integrity and payment-page script monitoring, policies and training Acquirer PCI programme fee | Merchants whose acquirer charges for its compliance portal and support | As your merchant agreement sets out, often monthly or yearly | Set by your acquirer in your contract, whether or not you have validated Non-compliance fees | Merchants who have not validated | Monthly, until your acquirer accepts your validation | Set by your acquirer Some acquirers also charge a PCI compliance fee for their portal and support, which is part of your contract; a monthly PCI non-compliance fee is different, and it stops only when your acquirer accepts a valid SAQ or AOC and any scans your SAQ requires. ## How much does PCI DSS certification cost? PCI certification cost is really the cost of your annual validation, because there is no PCI DSS certificate to buy. The PCI SSC does not certify merchants or service providers, so what people call PCI DSS certification is that validation, and its cost follows your validation route: a self-completed SAQ, an SAQ reviewed or signed by a QSA, or a Report on Compliance. The PCI SSC charges nothing for the standard or the SAQs; you pay for the work, any scans and tests your route requires, and fixing gaps. Validation route | Typically used by | What you pay for | Where it sits in published UK price guidance (September 2026) Self-completed short SAQ (for example SAQ A, B-IP or P2PE) | Small merchants with outsourced or standalone payments | Staff time, ASV scans where the SAQ requires them, and any fixes | Near the bottom of the range, which starts at around £500 SAQ D, or an SAQ reviewed or signed by a QSA | Merchants with more systems in scope, Level 2 service providers, and anyone whose acquirer or customers ask for QSA involvement | Staff time, QSA days for review or signature, scans, penetration testing where required, and remediation | In between: set by scope and how many gaps need fixing Report on Compliance by a QSA | Level 1 merchants and service providers, and anyone whose contracts require a ROC | QSA assessor days, scans, penetration and segmentation testing, and remediation | Near the top, where a Level 1 ROC with remediation sits: £20,000 to £75,000 or more These are market figures from published UK price guidance we reviewed, not our prices. We quote a fixed price once your scope is confirmed. ## How much does a QSA audit cost? A QSA audit, formally a Report on Compliance, is priced on the assessor days your scope needs, not on your size or turnover. The PCI QSA tests every applicable PCI DSS v4.0.1 requirement, samples systems and locations, interviews staff and reviews evidence, then writes the ROC and the Attestation of Compliance (AOC) your acquirer or customers receive. The days go up with the number of payment channels and sites, the systems in or connected to the cardholder data environment (CDE), any requirements met through the customised approach, and how much evidence is ready on day one. PCI Level 1 merchants and service providers need a ROC every year; others choose one when an acquirer or customer asks. We do not publish a list price for assessments, because no two scopes are the same size. We send a fixed quote after a short scoping call, and the assessment itself is delivered through our PCI DSS audit and QSA assessment service. If you are not ready yet, a gap analysis from our PCI DSS consultancy team is usually cheaper than discovering the same gaps during the assessment. ## What drives the cost of PCI DSS compliance? Scope drives cost more than anything else. Every system that stores, processes or transmits card data, or can affect its security, has to be secured, evidenced and tested. The estimator above weighs these drivers for you. Driver | Keeps cost down | Pushes cost up Validation route | SAQ A, SAQ B-IP or SAQ P2PE | SAQ D or a Report on Compliance Payment channels | One channel, fully outsourced | Online, in person and phone, each with its own systems Stored card data | No card numbers stored, or provider tokens only | Card numbers in databases, spreadsheets, email or call recordings Network segmentation | Payment environment isolated and tested | A flat network, so everything is in scope Locations | One site | Many sites with their own terminals and networks Third parties | A few providers with current AOCs | Many providers with unclear responsibilities Merchant or service provider | Merchant | Service provider, with extra requirements and six-monthly segmentation testing First year or renewal | Renewal, with controls running all year | First validation, or a lapse that needs catching up Our guide to PCI compliance levels explains who needs a ROC. For testing budgets, published UK pricing guidance we reviewed in September 2026 put typical penetration tester day rates at about £1,000 to £1,500. See how Requirement 11.4 is scoped on our PCI DSS penetration testing page, and quarterly external scans on our PCI ASV scans page. ## What does non-compliance cost after a breach? Non-compliance becomes far more expensive after a card data breach: acquirers usually pass card brand fines, forensic investigation and card reissue costs on to the merchant, and can require Level 1 validation in future. Card data is personal data, so a breach can also be a UK GDPR matter for the Information Commission’s Office (ICO), where the maximum fine is £17.5 million or 4% of annual worldwide turnover, whichever is higher. Fines, penalties and what triggers them are covered in our guide to the PCI non-compliance fee. ## How can you reduce the cost of PCI compliance? Reduce scope first. Every system you take out of scope is one you do not have to secure, evidence and test. - Use a hosted payment page or iframe from a PCI DSS compliant provider, so card data never touches your website. That usually means SAQ A rather than SAQ A-EP or SAQ D. - Move terminals to a PCI-listed P2PE solution, which can reduce in-person scope to SAQ P2PE. Our guide to PCI P2PE explains how it works. - Tokenise or delete stored card numbers, including old spreadsheets, email and call recordings. - Take phone payments with DTMF masking or a compliant IVR, so agents never hear or see card numbers. - Segment the payment environment from the rest of your network, and test the segmentation. - Get the SAQ right before you start. The wrong SAQ can mean doing the work twice. Our free PCI compliance test suggests your likely SAQ and shows your gaps in about five minutes. - Plan testing together. Time scans and tests around your assessment date so one round of evidence serves them all. - Keep controls running all year. Renewals cost less when evidence is collected as you go. Small merchants: see our guide to PCI compliance for small business. ## Why Sovereign Secure? - A PCI SSC-approved assessor. Sovereign Secure Ltd (company no. 08334453, est. 2012, Accrington, Lancashire) is a Qualified Security Assessor (QSA), Qualified PIN Assessor (QPA), Card Production Security Assessor (CPSA), P2PE Assessor and 3DS Assessor company. You can check us on the PCI SSC Qualified Security Assessor list. - Part of the assessor community. We are a member of the PCI SSC Global Executive Assessor Roundtable (GEAR) for 2026 to 2028. - Every route covered. SAQ support, gap analysis, ROC assessments, penetration testing, and ASV scans delivered through our PCI SSC Approved Scanning Vendor partner. - Security we practise. We are ISO 27001 certified, with offices in the UK, Los Angeles, Singapore, Dubai and Dhaka. Clients include Accor, Fiserv, Ticketmaster, Cashplus and Kuwait Finance House. See our full range of PCI DSS compliance services. ## How do you get a fixed quote? Run the estimator and choose Get a fixed quote: your answers are copied into the enquiry form below, so you only add your contact details. We aim to reply within one working day and send a fixed quote once your scope is confirmed, or call +44 161 523 5276. Last reviewed October 2026 by the Sovereign Secure assessment team. Talk to an assessor PCI SSC-approved QSA, QPA and CPSA company. Tell us your scope and we will send a fixed quote. Request a quote or call +44 161 523 5276 FAQ ## PCI compliance cost FAQs How much does a QSA audit cost? + It depends on how many assessor days your scope needs: your payment channels, locations, the systems in your cardholder data environment and how ready your evidence is. We send a fixed quote after a short scoping call; see our PCI DSS audit and QSA assessment service. How much does a PCI ROC cost? + There is no standard price, because a Report on Compliance is priced on the assessor days your scope needs: the number of payment channels and sites, the systems in or connected to your cardholder data environment, sampling, remote or on-site work, any customised-approach requirements and how ready your evidence is. We send a fixed quote after a short scoping call; see our PCI DSS audit and QSA assessment service. Do I have to pay a PCI compliance fee? + Not to the PCI Security Standards Council, which charges merchants nothing to comply. The PCI compliance fees you may see come from your acquirer and are of two kinds: a PCI programme fee for its compliance portal and support, set in your merchant agreement, and a PCI non-compliance fee, added monthly when your acquirer has no current record of your validation. Our guide to the PCI non-compliance fee explains how to stop the second one. Is SAQ completion free? + The SAQ itself is free to download from the PCI Security Standards Council, and you can complete it yourself. The costs are staff time, any ASV scans or fixes your SAQ requires, and optional help from a consultant or a QSA review. Does PCI compliance cost more for service providers? + Usually, yes. Service providers can only validate with SAQ D for Service Providers or a Report on Compliance, carry extra requirements such as six-monthly segmentation testing, and their customers often ask for a QSA-validated AOC. How often do I pay for PCI compliance? + Validation is annual, ASV scans are quarterly where your SAQ or ROC requires them, and penetration tests are due at least every 12 months and after significant changes. Remediation is mostly a first-year cost, so renewals are normally cheaper if controls run all year. How much does PCI compliance cost for a small business? + Most small merchants validate with a short SAQ, such as SAQ A for a hosted checkout or SAQ B-IP for a standalone card machine, so the main costs are staff time, scans where required and any fixes. Our guide to PCI compliance for small business goes into more detail. Does a PCI-compliant payment provider make me compliant? + No. It can shrink your scope and cost a great deal, but you still validate the part you control. See what to check before you choose a PCI compliant payment gateway. ## Related services and guides - PCI DSS assessments PCI compliance audits and PCI assessments by a PCI SSC-approved QSA company: Report on Compliance, AOC and QSA-validated SAQs. Get a fixed quote. → - PCI DSS Consultancy PCI DSS consultancy and consulting services from a PCI SSC-approved QSA company: scoping, gap assessment, remediation, policies and SAQ help. Get a fixed quote. → - PCI DSS penetration testing PCI compliance penetration testing to PCI DSS Requirement 11.4 by a QSA company: internal, external, application and segmentation pen tests with ROC-ready reports. → - PCI ASV scans PCI scanning made simple: quarterly PCI ASV scans run through our PCI SSC Approved Scanning Vendor partner and managed by a QSA company. Get a fixed quote. → - PCI compliance levels PCI compliance levels explained by a QSA company: Visa merchant levels 1 to 3 and Mastercard levels 1 to 4, service provider levels and what each submits. → - PCI compliance UK PCI compliance UK guide from a QSA company: who must comply, merchant levels, SAQ or ROC, v4.0.1 deadlines, costs and fees. Get a fixed quote. → ## Further reading - PCI DSS PCI DSS Gap Analysis: What It Covers, How It Works and What You Get - PCI DSS PCI Compliance for Small Businesses: What You Need to Do - PCI DSS Which PCI SAQ Do I Need? All SAQ Types Explained (v4.0.1) --- # PCI Compliance UK: Who Needs PCI DSS, Levels & Costs URL: https://sovereignsecure.co.uk/pci-dss-compliance-uk/ PCI DSS guide ## PCI Compliance UK Guide: Who Needs PCI DSS and How to Comply Updated October 2026 A plain-English PCI compliance UK guide for merchants, charities, public bodies and service providers: what your acquirer expects, which SAQ applies, the v4.0.1 dates, what it costs and what happens if you do not validate. Free PCI compliance check Get a PCI quote - By a PCI SSC-approved QSA company - Current for PCI DSS v4.0.1 - UK acquirers, UK GDPR and fees explained The short answer In the UK, PCI compliance is a contractual requirement, not a law. Every business that takes card payments must meet PCI DSS v4.0.1 under its merchant agreement, validating yearly with its acquirer. Most small merchants complete a Self-Assessment Questionnaire; merchants with over 6 million transactions a year on one card brand need a Report on Compliance, usually from a QSA. PCI compliance in the UK means meeting the Payment Card Industry Data Security Standard (PCI DSS), currently version 4.0.1, and proving it to your acquirer every year. It is not a UK law. It is a condition of your merchant agreement, and it applies to every business that takes card payments, from a sole trader with one card reader to a payment processor. Most small merchants validate with a Self-Assessment Questionnaire (SAQ). The largest merchants and service providers need an assessment by a Qualified Security Assessor (QSA). This guide is written by Sovereign Secure, a PCI SSC-approved QSA company based in Lancashire. It covers who has to comply, how UK acquirers enforce it, merchant levels, which SAQ applies, the v4.0.1 deadlines, costs and fees, and the steps to become compliant. ## What is PCI compliance in the UK? PCI DSS compliance in the UK means meeting a set of 12 security requirements for protecting payment card data, and proving it to your acquirer every year. The standard is written and maintained by the PCI Security Standards Council (PCI SSC), which the major card brands, including Visa and Mastercard, founded in 2006. PCI DSS in the UK is the same standard used in the US, Europe and Asia. What is specific to UK PCI compliance is how acquirers enforce it and how it sits alongside UK data protection law. If you are new to the standard, our guide to what PCI DSS is explains the acronym, the card data it protects and how it is organised. Being “PCI compliant” has two parts: - Meeting the requirements all year round for every system that stores, processes or transmits card data, or could affect its security. Together these systems, people and processes form your cardholder data environment (CDE). - Validating once a year by giving your acquirer an SAQ or a Report on Compliance (ROC), plus a signed Attestation of Compliance (AOC). Quarterly external vulnerability scans are also needed where your SAQ requires them. The 12 requirements cover network security controls, secure configuration, protecting stored account data, encrypting card data in transit, malware protection, secure systems and software, need-to-know access, user identification and authentication, physical security, logging and monitoring, regular security testing, and security policies. Our PCI compliance checklist turns them into the evidence an assessor will ask for. The standard itself is free from the PCI SSC document library. ## Is PCI DSS a legal requirement in the UK? No. PCI compliance is not required by UK law, because no UK statute requires PCI DSS. The obligation is contractual: the card brands require acquirers to make their merchants comply, and your acquirer writes that into your merchant agreement. Failing to comply is a breach of contract, not an offence. The law still matters. Card data is personal data, so UK GDPR and the Data Protection Act 2018 apply to it. Article 32 of UK GDPR requires “appropriate technical and organisational measures”, and for card data PCI DSS is the recognised industry benchmark. A card breach can therefore start two separate processes: Aspect | PCI DSS | UK GDPR and DPA 2018 Legal status | Contract with your acquirer | UK law Set by | PCI SSC (the standard) and the card brands (compliance programmes) | UK legislation Applies to | Anyone who stores, processes or transmits card data, or can affect its security | Anyone who processes personal data Enforced by | Your acquirer, on behalf of the card brands | Information Commissioner’s Office (ICO) After a breach | Tell your acquirer immediately; a PCI Forensic Investigator (PFI) may be required | Report to the ICO within 72 hours if the breach risks people’s rights and freedoms Penalties | Non-compliance fees, card-brand costs passed on, higher charges or loss of card acceptance | Fines up to £17.5 million or 4% of annual worldwide turnover, whichever is higher Our comparison of PCI DSS vs GDPR sets out where the two overlap and where meeting one does not satisfy the other. ## Who needs to be PCI compliant? Every organisation that accepts, processes, stores or transmits payment card data, or whose systems could affect the security of that data, is required to be PCI compliant. If you take card payments in the UK, you need PCI compliance whatever your size: size changes how you validate, not whether you must comply. In practice that includes: - Merchants of every size: shops, restaurants, hotels, online retailers and sole traders with a card reader. - Charities that take card donations online, by phone or at events. - Public-sector bodies such as councils, NHS trusts and universities that take card payments for services, fees or fines. - Service providers that handle card data for others or can affect its security: payment gateways and processors, hosting and cloud providers, managed IT and security providers with access to a CDE, outsourced contact centres, and SaaS platforms that take payments for their customers. Outsourcing reduces your scope; it does not remove it. A website that sends customers to a compliant provider’s hosted payment page still has to complete SAQ A, because the page that sends them there could be tampered with. Get your provider’s AOC and a written split of which requirements it covers for you and which remain yours; our guide to PCI compliant payment gateways lists what to ask for. ## Who enforces PCI compliance in the UK? Your acquirer does. The PCI SSC writes the standard but does not enforce it or fine anyone. Each card brand runs its own compliance programme and holds acquirers responsible for their merchants. Acquirers pass that obligation down to you through the merchant agreement. ## PCI with your acquirer: Barclaycard, Lloyds Cardnet and Clover Most UK acquirers and merchant services providers, including Barclaycard, Lloyds Cardnet, Paymentsense and Clover, manage smaller merchants’ PCI compliance through an online portal, often run by a specialist compliance vendor. The process is broadly the same: - You receive portal log-in details when your account opens, or when your compliance status lapses. - The portal asks how you take payments and suggests an SAQ. - You complete the SAQ, upload ASV scan reports if they are required, and sign the AOC; our guide on how to fill out a PCI SAQ covers the common mistakes. - Your status is reported to the acquirer, and any non-compliance fee should stop once you show as compliant. Two cautions. The portal’s questions decide your SAQ, so a loose answer can put you on the wrong one; check the eligibility criteria in the SAQ yourself. And if a QSA has validated you, send the AOC to your acquirer’s compliance team and ask them to confirm your status has been updated. What differs between providers is mainly the programme name and the portal. These are independent summaries; check the current details with your provider: - Barclaycard: merchants validate through Barclaycard’s Data Security Manager programme. - Lloyds Cardnet: Cardnet merchants validate every year, and your Cardnet account team can tell you how to reach the compliance portal. - Clover: Clover is a point-of-sale platform from Fiserv, and the provider of your Clover account tells you how and where to validate. - Worldpay: our guide to Worldpay PCI compliance explains what Worldpay merchants must do. ## PCI compliance levels: which level are you? Your level depends on how many card transactions you process each year with each card brand, and it decides how you validate. The thresholds below are the ones Visa and Mastercard publish: Visa now publishes three merchant levels and Mastercard four. American Express uses different thresholds, and your acquirer confirms your level and can set stricter requirements. Merchant level | Annual transactions (per card brand) | How you validate Level 1 | Over 6 million, or any merchant a card brand designates Level 1 (for example after a breach) | Annual ROC by a QSA (or an ISA where the brand allows), quarterly ASV scans, AOC Level 2 | 1 million to 6 million | Annual SAQ, quarterly ASV scans where your SAQ requires them, AOC. For SAQ A, A-EP or D, Mastercard requires a QSA or ISA to be engaged for validation Level 3 | Visa: fewer than 1 million Visa e-commerce transactions, which covers every smaller merchant. Mastercard: more than 20,000 and up to 1 million e-commerce | Annual SAQ, quarterly ASV scans where applicable, AOC Level 4 (Mastercard; Visa no longer publishes a Level 4) | All other merchants: 20,000 or fewer e-commerce transactions and up to 1 million in total | Annual SAQ and scans where applicable, as your acquirer directs Service provider level | Annual transactions | How you validate Level 1 | Over 300,000 (plus every VisaNet processor, and for Mastercard every Third Party Processor, merchant payment gateway and several other provider types) | Annual ROC by a QSA, quarterly ASV scans, AOC Level 2 | Under 300,000 | Annual SAQ D for Service Providers, quarterly ASV scans, AOC Enterprise customers may still ask a Level 2 service provider for a ROC, because it gives them independent assurance. Our guide to PCI Level 1 covers what the top level involves for merchants and service providers, and our guide to PCI compliance levels explains how each card brand defines them. ## SAQ or ROC: how do you prove PCI compliance? There are two routes. A Self-Assessment Questionnaire (SAQ) is a self-declaration for eligible merchants and smaller service providers; which SAQ you use depends entirely on how you take payments. A Report on Compliance (ROC) is a detailed assessment written by a QSA, required at Level 1 and chosen by many others. Both routes end with an Attestation of Compliance (AOC), the signed summary your acquirer and customers ask for. SAQ | Who it is for | UK example A | Card-not-present merchants that fully outsource card handling to a PCI DSS compliant provider | Online shop using its payment provider’s hosted payment page or iframe A-EP | E-commerce merchants whose website does not receive card data but controls how the payment page is delivered | Checkout that loads the payment form through the provider’s JavaScript or posts card data directly to it B | Imprint machines or standalone dial-out terminals only | Trader still using a dial-up card machine B-IP | Standalone approved terminals connected to the processor over IP, not linked to other systems | Café with a standalone card machine on its broadband C-VT | Manual entry, one transaction at a time, into a provider’s web-based virtual terminal | Hotel reservations team keying phone bookings on a dedicated PC C | Payment application connected to the internet, with no electronic card storage | Restaurant EPOS integrated with its card terminals P2PE | Only terminals from a PCI-listed point-to-point encryption solution | Retailer using a validated P2PE service D for Merchants | Every merchant not eligible for another SAQ | Business whose website receives card data, or that stores card numbers D for Service Providers | Service providers eligible to self-assess | Level 2 hosting or payment platform There is also SAQ SPoC for merchants using a PCI-listed software-based PIN entry solution on a phone or tablet. If you take payments through several channels, you may need more than one SAQ, or SAQ D; agree this with your acquirer before you start. Our guide to which PCI SAQ you need walks through the eligibility criteria for each one. Some acquirers want a QSA or ISA involved in the SAQ, and Mastercard requires Level 2 merchants completing SAQ A, A-EP or D to engage a QSA or a PCI SSC-certified ISA. A QSA review before you submit also catches a common and costly mistake: a merchant on the wrong SAQ. If you need an assessor, our guide on how to choose a PCI QSA explains how to verify and compare firms. ## What changed in PCI DSS v4.0.1? PCI DSS v4.0.1 is the only version in force. It replaced v4.0 at the end of 2024, and every future-dated requirement became mandatory on 31 March 2025, so any SAQ or ROC completed now covers them in full. Date | What happened 31 March 2022 | PCI DSS v4.0 published 31 March 2024 | v3.2.1 retired; v4.0 became the only version June 2024 | v4.0.1 published (clarifications, no new requirements) 31 December 2024 | v4.0 retired; v4.0.1 became the only active version January 2025 | SAQ A updated: requirements 6.4.3 and 11.6.1 removed and replaced by an eligibility criterion on script attacks 31 March 2025 | The 51 future-dated requirements became mandatory The v4.0.1 requirements UK businesses most often have to work on: - 6.4.3 and 11.6.1: authorise, justify and check the integrity of every script on your payment page, and detect unauthorised changes to it at least weekly. These target card-skimming code on e-commerce sites. SAQ A merchants must instead confirm their site is not susceptible to script attacks. - 8.4.2: multi-factor authentication for all non-console access into the CDE, not just remote access. - 12.3.1: a documented targeted risk analysis wherever you choose how often a control runs. - 5.4.1: automated protection against phishing. - 10.4.1.1: automated reviews of audit logs. - 12.5.2: confirm and document your PCI DSS scope at least every 12 months, or every 6 months for service providers (12.5.2.1). ## How much does PCI compliance cost in the UK? Anything from a few hundred pounds to tens of thousands. A published UK cost guide we reviewed in September 2026 put the range at around £500 at the low end to over £75,000 for large, complex programmes. Where you sit depends far more on your scope and validation route than on your turnover. Cost driver | Lower cost | Higher cost Validation route | Self-completed SAQ A or B-IP | QSA-led ROC with on-site work Payment channels | One channel, fully outsourced | E-commerce, telephone and face-to-face combined CDE size | Few systems, well segmented | Flat network with many systems in scope Locations | Single site | Multiple sites or countries Card data storage | None (tokens only) | Stored card numbers to protect and justify Testing | Quarterly ASV scans only | Annual penetration test plus segmentation testing Year | Renewal with a stable scope | First year, with gap analysis and remediation Remediation work (MFA, central logging, payment-page script monitoring) and staff time are real costs that do not appear on an assessor’s quote. Our PCI compliance cost guide shows how each driver changes the price. ## What if you miss your annual validation? Most UK acquirers add a monthly charge until they accept a valid SAQ or AOC, and a card data breach costs far more, from a forensic investigation to card-brand costs passed on under your merchant agreement and possible ICO action under UK GDPR. Our guide to the PCI non-compliance fee explains why the charge appears, how fines differ from fees and what makes the fee stop. ## How to become PCI compliant in the UK: 8 steps Here is how to become PCI compliant in the UK, step by step. The steps are the same whether you are working out how to be PCI DSS compliant for the first time or getting PCI compliance back after it has lapsed. Before step 1, our free PCI compliance check suggests your likely SAQ and gives you a prioritised fix list in about five minutes. To turn the steps into a dated plan with owners, use our PCI DSS compliance roadmap template. - Confirm your level and validation route with your acquirer, in writing. - Map how card data moves through your business (every channel, system, person and third party) to define your CDE. - Reduce scope before you secure it. Hosted payment pages, P2PE terminals, tokenisation and telephone payment masking can take whole systems out of scope. - Choose your SAQ, or confirm you need a ROC, using the eligibility criteria rather than a best guess. - Run a gap analysis against PCI DSS v4.0.1. If you lack in-house expertise, PCI DSS consultancy covers the gap analysis and remediation plan. - Close the gaps: policies, targeted risk analyses, MFA, logging, patching, script management and third-party agreements. - Test: quarterly external ASV scans by a PCI SSC Approved Scanning Vendor, quarterly internal scans and, where your SAQ or ROC requires it, annual PCI DSS penetration testing and segmentation testing. - Validate and keep it running: submit the SAQ or ROC with the AOC, then treat compliance as a year-round routine rather than an annual form. ## Can I do PCI compliance myself? Yes, most merchants can. If you are eligible to self-assess, you complete the SAQ yourself and sign your own AOC, and no assessor has to be involved unless your acquirer or a card brand rule requires one (Mastercard, for example, requires Level 2 merchants on SAQ A, A-EP or D to engage a QSA or ISA). Two parts cannot be done in-house: - A Report on Compliance. Level 1 merchants and Level 1 service providers validate with a ROC, written by a QSA (or, for merchants, an ISA where the card brand allows it). - External vulnerability scans. Where your SAQ or ROC requires quarterly external scans, they must be run by a PCI SSC Approved Scanning Vendor (ASV). We deliver them through our PCI SSC Approved Scanning Vendor partner. Outside help is worth paying for when you are not sure which SAQ applies, when you take payments through several channels, when your website or systems receive card data and you face SAQ D, when a scan keeps failing or a non-compliance fee will not stop, or when customers ask you, as a service provider, for independent assurance. In those cases, PCI DSS consultancy can confirm your route and plan the fixes before you submit anything. ## PCI compliance by sector Sector | Typical validation | What catches people out Hospitality | SAQ B-IP, C or P2PE at the property; C-VT or D for reservations | Card details taken by email or phone for bookings, and card data held in property management systems E-commerce | SAQ A or A-EP; SAQ D if the site receives card data | Payment-page scripts (6.4.3 and 11.6.1) and plug-ins that change how the payment page loads Call centres | SAQ C-VT or D, or a much smaller scope with payment masking | Call and screen recordings that capture card details; security codes must never be kept after authorisation SaaS and service providers | SAQ D for Service Providers or a ROC | Customers asking for your AOC and a responsibility matrix, and segmentation testing every 6 months If your team keys card details from calls, our guide to taking card payments over the phone covers virtual terminals, payment links and what must never be written down. ## How to choose a QSA in the UK Start by checking the company appears on the PCI SSC’s list of Qualified Security Assessors and that its listing covers the UK. Then ask: - Has it assessed businesses like yours, in your sector and with your payment channels? - Who will do the assessment, and are they individually qualified as QSAs? - How does it keep consulting and assessing separate? PCI SSC’s rules for QSAs include independence requirements. - Can it cover penetration testing, segmentation testing and ASV scans (through a listed ASV), or will you manage several suppliers? - Is the price fixed for an agreed scope, and what happens if the scope changes? When you need a Level 1 ROC or a QSA-signed SAQ, our PCI compliance audit service covers it, and our PCI QSA page explains what a QSA does and how to verify one. ## Why Sovereign Secure Sovereign Secure Ltd has been a UK company since 2012 (Companies House 08334453), headquartered in Accrington, Lancashire, with offices in Los Angeles, Singapore, Dubai and Dhaka. The PCI Security Standards Council has approved us as a Qualified Security Assessor (QSA) company, a Qualified PIN Assessor (QPA), a Card Production Security Assessor (CPSA), a P2PE Assessor and a 3DS Assessor, and we are a member of its Global Executive Assessor Roundtable (GEAR) for 2026 to 2028. We are ISO 27001 certified and ICO registered. We carry out penetration and segmentation testing, and deliver quarterly external scans through our PCI SSC Approved Scanning Vendor partner. Clients shown on our site include Fiserv, Accor, Ticketmaster, Cashplus and Nitecrest. See the full range of our PCI DSS compliance services. ## PCI compliance UK glossary Term | Meaning Acquirer | The bank or payment company that processes card payments for a merchant and enforces PCI DSS for the card brands AOC | Attestation of Compliance: the signed declaration of your PCI DSS status ASV | Approved Scanning Vendor: a company approved by PCI SSC to run external vulnerability scans CDE | Cardholder data environment: the people, processes and technology that store, process or transmit card data ISA | Internal Security Assessor: an employee trained by PCI SSC to assess their own organisation PAN | Primary account number: the long number on the card P2PE | Point-to-point encryption: card data encrypted in the terminal and decrypted only by the solution provider QSA | Qualified Security Assessor: a company, and its individual assessors, approved by PCI SSC to assess PCI DSS compliance ROC | Report on Compliance: the QSA’s detailed assessment report SAQ | Self-Assessment Questionnaire: the self-validation route for eligible merchants and service providers TRA | Targeted risk analysis: the documented analysis v4.0.1 requires where you set how often a control runs ## Get your PCI compliance route confirmed Not sure which SAQ applies, what level you are, or whether you need a QSA? Tell us how you take card payments and we will confirm your validation route and send a fixed quote. Contact our PCI team or call +44 161 523 5276. Last reviewed October 2026 by the Sovereign Secure assessment team. div]:shrink-0 xl:[&>nav]:min-h-0 xl:[&>nav]:overflow-y-auto hidden"> FAQ ## Frequently asked questions Is PCI compliance a legal requirement in the UK? + No. PCI compliance is not required by UK law, because no UK statute requires PCI DSS; it is a contractual requirement in your merchant agreement, enforced by your acquirer on behalf of the card brands. UK GDPR still requires appropriate security for personal data, including card data, so a card breach can lead to ICO action as well as acquirer penalties. Do I need to be PCI compliant in the UK? + Yes, if you take card payments. Anyone who accepts, processes, stores or transmits card data, or can affect its security, is required to be PCI compliant under its merchant agreement or customer contracts, whatever its size. What you need to do depends on how you take payments: usually an annual SAQ, or a Report on Compliance for the largest merchants and service providers. Do I need to be PCI compliant as a small business? + Yes. Every business that takes card payments must comply, including sole traders and charities. Small merchants usually validate with a short Self-Assessment Questionnaire, such as SAQ A for a fully hosted online checkout or SAQ B-IP for a standalone card machine. Who enforces PCI compliance in the UK? + Your acquirer, on behalf of the card brands. The PCI Security Standards Council writes the standard but does not enforce it or issue fines, and the ICO enforces data protection law rather than PCI DSS. Will my acquirer charge me if I don't validate? + Usually, yes: most UK acquirers add a monthly charge until they accept your validation, and a breach costs far more. Our guide to the PCI non-compliance fee explains both. How often do we have to revalidate PCI compliance? + Every year. PCI DSS compliance is validated annually, so an Attestation of Compliance is normally accepted for 12 months from the date it is signed. Where your SAQ or ROC requires quarterly ASV scans, those must stay current throughout the year too. What proves that we are PCI compliant? + Your signed Attestation of Compliance (AOC), backed by an SAQ or a Report on Compliance; the PCI SSC issues no certificate, as our guide to PCI DSS certification explains. Can I do PCI compliance myself? + Usually, yes. Most merchants self-assess with an SAQ and sign their own AOC, but Level 1 merchants and Level 1 service providers need a Report on Compliance from a QSA, and any required external scans must come from a PCI SSC Approved Scanning Vendor. Outside help is worth it if you are unsure which SAQ applies, take payments through several channels or face SAQ D. How do I know if I'm PCI compliant? + Run our free PCI compliance check for a readiness score, your likely SAQ and the gaps to fix; your signed, current AOC accepted by your acquirer is the formal proof. Does using a payment provider make me PCI compliant? + Not on its own. A PCI DSS compliant provider can take most of the work off your hands, but you still have to validate the part you control, usually with SAQ A or SAQ A-EP, and keep your provider's AOC on file. --- # ISO 27001 Consultants UK: Consultancy to Certification URL: https://sovereignsecure.co.uk/iso27001/ ISO/IEC 27001:2022 ## ISO 27001 Consultants & Certification (UK) ISO 27001 consultancy from a UK firm that is ISO 27001 certified itself. We take you from gap analysis through ISMS implementation and internal audit to certification, which typically takes three to nine months, with the Stage 1 and Stage 2 audits carried out independently by our partner certification body, MQA International. Get an ISO quote ISO 27001 checklist - ISO 27001 certified ourselves - Certification audits by MQA International - Evidence reused from PCI DSS & Cyber Essentials Overview ## What an ISO 27001 consultant does, and what the certification body does The short answer An ISO 27001 consultant helps you build an information security management system that meets ISO/IEC 27001:2022, then prepares you for the Stage 1 and Stage 2 audits. Most small and mid-sized organisations take three to nine months. The certificate is issued by an independent certification body; for our clients that is MQA International. An ISO 27001 consultant helps you build an information security management system (ISMS) that meets ISO/IEC 27001:2022: the mandatory clauses 4 to 10 and the 93 Annex A controls, grouped into four themes (organisational, people, physical and technological). We scope the ISMS, run the risk assessment on the confidentiality, integrity and availability of your information, write what is needed and prepare you for audit. We never issue the certificate. An independent certification body does, and for our clients that is MQA International. Common starting points. A customer or tender needs a certificate by a fixed date. You already hold Cyber Essentials or comply with PCI DSS and want to build on that evidence rather than repeat it. An ISMS started from a template pack has stalled. Or you are a startup or small business that needs a proportionate ISMS, not a corporate one. Each of these starts with an ISO 27001 gap analysis. If you are still weighing up whether certification pays off, see the benefits of ISO 27001. Startups and SaaS companies. When your first enterprise customer asks for ISO 27001, a lean scope built around your product, cloud platform and people keeps the ISMS proportionate to a small team. Our guide to ISO 27001 for startups covers scope, timeline, cost drivers, secure development controls and when SOC 2 fits better. Beyond ISO 27001. A working ISMS gives you much of the groundwork for related standards: ISO/IEC 27701 for privacy information management, the cloud codes of practice ISO/IEC 27017 and 27018, ISO 22301 for business continuity, ISO/IEC 20000-1 for IT service management and ISO/IEC 42001 for AI management systems. We design your ISMS so those can be added later without a rebuild. Someone also has to own the ISMS once it is certified; our guide to the virtual CISO (vCISO) explains one way smaller organisations fill that role. For quality management, see ISO 9001 consultancy; every other standard we support is on our ISO certification page. If you have EU operations or EU customers, the NIS2 directive asks for security measures that a working ISMS covers for the most part. ## Standards & frameworks - ISO/IEC 27001:2022 - ISO/IEC 27002:2022 - Annex A (93 controls) - ISO 22301 - PCI DSS - Cyber Essentials ## What you receive - Gap analysis report and risk-ranked roadmap - ISMS scope, risk assessment and Statement of Applicability - ISMS policy and procedure set - Internal audit report and management review pack - Support through the Stage 1 and Stage 2 audits by MQA International What's included ## ISO 27001 consultancy services, from gap analysis to certificate Take the full package or only the step you need. The usual path is gap analysis, implementation, internal audit, then certification by MQA International. - 01 ## Gap analysis A gap analysis against clauses 4 to 10 and all 93 Annex A controls of the 2022 edition, with a risk-ranked roadmap to certification. - 02 ## ISMS scope, risk assessment and SoA Define the ISMS boundaries, run a business impact analysis and risk assessment, and produce the Statement of Applicability that justifies each control. - 03 ## Policies and procedures Security policies and procedures written for how your organisation works, rather than copied from a template pack. - 04 ## Control implementation Options analysis, technical design review and hands-on help putting the selected controls in place, from access control to supplier security. - 05 ## Training and awareness Leadership briefings and staff security awareness training, which ISO 27001 requires you to provide and evidence. - 06 ## Incident response and continuity Incident response plan review and development, tabletop exercises if required, and continuity planning that can grow into ISO 22301. - 07 ## Penetration testing ISO 27001 penetration testing scoped to give auditors evidence for Annex A 8.8 (technical vulnerabilities) and 8.29 (security testing). - 08 ## Internal audit and management review An independent ISO 27001 internal audit (clause 9.2) and management review support (clause 9.3), so Stage 1 and Stage 2 hold no surprises. - 09 ## Certification and surveillance Preparation for and support through the Stage 1 and Stage 2 audits by MQA International, then each annual surveillance audit and recertification, plus guidance on using the certification mark correctly under the ISO 27001 logo rules. ## ISO 27001 certification vs accreditation Buyers often ask for an "ISO 27001 accredited" supplier, but organisations are certified; certification bodies are accredited by an accreditation body that checks they are competent and impartial enough to audit. A request for an ISO 27001 accredited supplier usually means one that holds a valid ISO 27001 certificate. Who holds what in ISO 27001 Who | What they hold | What it means Your organisation | ISO 27001 certification | An independent certification body has audited your ISMS and confirmed it meets ISO/IEC 27001:2022 The certification body | Accreditation | An accreditation body has assessed it as competent and impartial to audit and certify management systems, under ISO/IEC 17021-1 and the ISMS rules in ISO/IEC 27006 The consultant | Neither | Helps you build the ISMS and prepares you for audit; it cannot certify you or accredit anyone Keeping consultancy and audit in separate organisations is what makes the certificate credible. Our partner certification body, MQA International, is accredited for ISO/IEC 27001 by IAS, the International Accreditation Service. If a customer or tender names a particular accreditation body, tell us at the start and we will confirm how your certificate will be issued before you commit. ## How long does ISO 27001 certification take? For most small and mid-sized organisations, three to nine months from gap analysis to certificate. The biggest variables are how mature your controls already are, how wide the scope is and how quickly decisions are made. An indicative six-month plan for a mid-sized organisation looks like this: Indicative ISO 27001 timeline (six-month plan) Phase | What happens | Indicative timing Gap analysis and scope | Leadership commitment, ISMS scope and a gap analysis against the standard | Month 1 Risk assessment and SoA | Risk assessment, treatment plan and Statement of Applicability | Month 2 Build the ISMS | Policies, controls and staff training | Months 2 to 4 Operate and keep records | Run the controls so the auditor has records to sample | Months 3 to 5 Internal audit and management review | Clauses 9.2 and 9.3, completed before Stage 2 | Month 5 Stage 1 and Stage 2 audits | Documentation review, then the effectiveness audit by the certification body | Month 6 onwards A small, cloud-based organisation that already holds Cyber Essentials can be nearer three months; a multi-site scope or in-house development and hosting push it towards nine. The certificate then runs for three years, with a surveillance audit in each of years two and three. Our ISO 27001 implementation guide sets out every step. ## How much does an ISO 27001 consultant cost? Published prices from UK providers we reviewed in September 2026 put consultant-led implementation packages at £8,000 to £25,000 and the initial certification audit at £3,000 to £8,000. Where you land depends on headcount, sites, scope and your starting point; see ISO 27001 consultant costs for day rates and what each model includes, and we then give you a fixed quote for your scope. ## Consultant vs certification body: who does what Under ISO/IEC 17021-1 a certification body may not advise on the management system it certifies, so preparation and audit always come from different organisations. ISO 27001 roles: consultant and certification body Task | Consultant (Sovereign Secure) | Certification body (MQA International) Scope and risk assessment | Helps you set the scope and runs the risk assessment with you | Reviews both at Stage 1 Policies and Statement of Applicability | Drafts them to fit how you work | Checks they meet the standard and are followed Internal audit | Can act as your independent internal auditor (clause 9.2) | Checks that it was planned, done and acted on Stage 1 and Stage 2 audits | Prepares you and supports you through them | Carries them out Certification decision | No role | Makes the decision and issues the certificate Surveillance and recertification | Keeps the ISMS audit-ready each year | Audits in years two and three, then recertifies before expiry ## ISO 27001 consultants in London, Manchester and across the UK We work across the UK, including London, Manchester and the North West, from our head office in Accrington, Lancashire, and internationally through our offices in Los Angeles, Singapore, Dubai and Dhaka. For local services in the North West, see cyber security in Manchester and cyber security in Lancashire. ## Free ISO 27001 templates If you want to make a start before talking to anyone, our free ISO 27001 toolkit has the same working files we use with clients: Template | What it helps you do ISO 27001 checklist (.xlsx) | Rate each clause of the ISO 27001 requirements and each Annex A theme, and track the evidence an auditor will sample ISO 27001 gap analysis template (.xlsx) | Score every sub-clause and all 93 Annex A controls from 0 to 3 and rank the gaps ISO 27001 implementation plan (.xlsx) | Run the 11-step project with owners, dates and progress by phase Statement of Applicability template | Record and justify your decision on each of the 93 Annex A controls ISO 27001 risk register template | Identify, score and treat risks to the information in scope Information security policy template | Start your top-level policy and the topic-specific policies under it How it works ## How our ISO 27001 consultancy works - 1 ## Gap analysis and plan We measure where you stand against ISO/IEC 27001:2022 and agree a realistic plan. Every phase and typical timelines are set out in our ISO 27001 implementation guide. - 2 ## Build and check the ISMS Scope, risk assessment, Statement of Applicability, policies and controls, then the internal audit and management review that must be completed before certification. - 3 ## Independent certification An independent certification body, MQA International, carries out the Stage 1 and Stage 2 audits and makes the certification decision. We support you through those audits, surveillance and recertification. Why Sovereign Secure ## Why choose Sovereign Secure as your ISO 27001 consultant? Established in 2012, we deliver PCI, ISO and Cyber Essentials work for banks, payment processors, card manufacturers and fast-growing companies. Read client testimonials → - We practise what we preach. Sovereign Secure is ISO 27001 certified, so we prepare you for the same kind of audit we go through ourselves. - Independent certification. Stage 1 and Stage 2 audits by MQA International keep consultancy and audit separate. - One set of evidence, several standards. As a PCI SSC-approved QSA company and an IASME-licensed Cyber Essentials certification body, we map ISO 27001 controls to PCI DSS, Cyber Essentials and GDPR. - Where we work. Across the UK, including London, Manchester and the North West, from our head office in Accrington, Lancashire, and internationally through our offices in Los Angeles, Singapore, Dubai and Dhaka. FAQ ## Frequently asked questions What does an ISO 27001 consultant do? + An ISO 27001 consultant plans and builds your ISMS with you: scope, risk assessment, Statement of Applicability, policies, controls, training and an internal audit. The consultant prepares you for certification but cannot certify you; an independent certification body carries out the audit. How do I choose an ISO 27001 consultant? + Look for experience with organisations of your size and sector, policies written for how you work rather than a template pack, clear separation from the certification body and a fixed scope of work. Our guide on how to choose an ISO 27001 consultant lists the questions to ask and the red flags. How do I get ISO 27001 certification? + Build and run an ISMS, complete an internal audit and management review, then pass a two-stage audit by an independent certification body. Our ISO 27001 implementation guide sets out each step, and the ISO 27001 checklist tracks your readiness. How long does ISO 27001 certification take? + For a small to mid-sized organisation, typically three to nine months from gap analysis to certificate, depending on how mature your security practices already are, the size of the scope and how quickly decisions are made. How long does an ISO 27001 certificate last? + Three years, with surveillance audits in years two and three; our guide to the ISO 27001 audit explains each stage of the cycle. How much does ISO 27001 cost? + It depends on your size, scope and starting point. Our ISO 27001 cost guide breaks down consultancy, Stage 1 and Stage 2 audit, surveillance and recertification fees. After a short call we give you a fixed quote for consultancy, and we can include the certification body fees so you see the full cost up front. How much does an ISO 27001 auditor typically cost? + The certification body’s auditors are paid through its audit fee, which published UK prices we reviewed in September 2026 put at £3,000 to £8,000 for Stage 1 and Stage 2 together, while an internal audit under clause 9.2 is a separate cost; see ISO 27001 audit costs. What is an ISO 27001 certification body? + The independent organisation that audits your ISMS, makes the certification decision and issues the certificate, separate from the consultant that helped you implement. For our clients that is MQA International, which audits you while we support you through the process. Do you provide penetration testing for ISO 27001? + Yes. ISO 27001 does not name penetration testing as a requirement, but two Annex A controls usually apply: 8.8 (management of technical vulnerabilities) and 8.29 (security testing in development and acceptance), and a penetration test is often the clearest evidence for both. See penetration testing for ISO 27001. What changed in ISO 27001:2022? + Annex A moved to 93 controls in four themes and the 2013 transition ended on 31 October 2025; our guide to ISO 27001 controls lists every change. Is ISO 27001 worth it if we already have Cyber Essentials? + Cyber Essentials covers five technical controls. ISO 27001 is a full management system covering risk, governance, people, suppliers, incidents and continuity. Many clients start with Cyber Essentials and move to ISO 27001 when larger customers or tenders require it; Cyber Essentials vs ISO 27001 compares the two side by side. If ISO 27001 is more than a small company needs, some buyers accept IASME Cyber Assurance instead, and our map of the NCSC 10 Steps to Cyber Security shows which areas Cyber Essentials and ISO 27001 each cover. Last reviewed October 2026 by the Sovereign Secure assessment team. ## Guides and tools in this section - ISO 27001 Annex A controls ISO 27001 controls explained: all 93 Annex A (2022) controls in four themes, the 11 new ones, what changed from 2013 and where CE and PCI DSS set stricter rules. - ISO 27001 audit ISO 27001 audit guide: what happens at stage 1, stage 2 and surveillance audits, what auditors sample, how nonconformities are graded and how to prepare. - ISO 27001 checklist Free ISO 27001 checklist for the 2022 standard: clause-by-clause readiness, an Annex A theme check and a Stage 1 and 2 audit checklist. Download the.xlsx. - ISO 27001 for startups ISO 27001 for startups and software companies: a lean ISMS scope, realistic timeline, cost drivers, secure development controls and when SOC 2 fits. Get help. - ISO 27001 logo ISO 27001 logo rules explained: why ISO does not license its logo, how to use your certification body's mark, the right wording and where the mark can appear. - ISO 27001 policy templates Free ISO 27001 toolkit: editable information security, access control, acceptable use, supplier and cryptography policies (Word) plus five ISMS spreadsheets. - ISO 27001 requirements ISO 27001 requirements explained: what clauses 4 to 10 of ISO/IEC 27001:2022 demand, every mandatory document and what auditors check. Plan your ISMS here. - ISO 27001 risk assessment How to run an ISO 27001 risk assessment that stands up at audit: the clause 6.1.2 method, ISO 27005 approaches and a free risk register template with examples. - ISO 27002 ISO 27002:2022 explained: its 93 controls, the five attribute types, what changed from 2013 and how it differs from ISO 27001. Design controls that pass audit. - Statement of Applicability Statement of Applicability for ISO 27001:2022: what it must include, how to justify exclusions, a worked example and a free SoA template (.xlsx). - What is ISO 27001? What is ISO 27001? The information security standard in plain English: the ISMS, clauses 4 to 10, Annex A, how certification works and who needs it. Start here. --- # ISO 27001 Certification Cost UK (2026): All-In Prices URL: https://sovereignsecure.co.uk/iso-27001-certification-cost/ ISO/IEC 27001:2022 pricing ## ISO 27001 Certification Cost in the UK Updated October 2026 ISO 27001 certification cost for UK organisations in 2026, split into consultancy, certification body audits, surveillance years and internal effort, so you can budget for the whole three-year certificate cycle. Get an ISO quote ISO 27001 checklist - Consultancy, audit and surveillance costs in one place - Published UK ranges, reviewed September 2026 - From an ISO 27001 certified firm The short answer ISO 27001 cost in the UK splits into consultancy, certification audits and internal effort. Published UK prices we reviewed in September 2026 put the Stage 1 and Stage 2 audit at £3,000 to £8,000, each annual surveillance audit at £1,000 to £3,000 and consultant packages at £8,000 to £25,000: roughly £13,000 to £39,000 over three years. ISO 27001 certification cost in the UK has three parts: the certification body’s audits, any consultancy you buy to get ready, and your own team’s time. In published prices from UK providers we reviewed in September 2026, the initial Stage 1 and Stage 2 audit ran £3,000 to £8,000, surveillance audits £1,000 to £3,000 a year, and consultancy packages £8,000 to £25,000. Many cost guides show only half the bill: certification bodies publish audit fees, consultancies publish packages. You pay both, and the certification body again in years two and three. This guide puts every line item in one place. ## How much does ISO 27001 certification cost? Combining the published ranges, a consultant-led project costs roughly £13,000 to £39,000 in external fees over the first three years. A self-implemented project can cost far less in cash, but you pay for it in staff time. Route | Year 1 | Years 2 and 3 | Three-year external fees Consultant-led, lower end | £8,000 package + £3,000 certification audit | 2 × £1,000 surveillance | about £13,000 Consultant-led, upper end | £25,000 package + £8,000 certification audit | 2 × £3,000 surveillance | about £39,000 Self-implemented | about £114 for the standard + £3,000 to £8,000 audit | 2 × £1,000 to £3,000 surveillance | about £5,100 to £14,100, plus significant staff time These totals are arithmetic from the published ranges, not a quote. They leave out staff time, new tools, penetration testing and remediation, and you should check whether any quote includes VAT. Large and multi-site organisations can sit well above them: one UK compliance platform’s published bands reach £30,000 to £100,000 for its largest size band. ## ISO 27001 cost estimator: work out your own budget You can build an indicative three-year budget from the same published UK ranges. Pick the row in each step that fits you best, then add up the figures. Step | Your situation | Figure to use 1. The standard | Everyone | About £114 2. Initial audit (Stage 1 and 2) | Small team, one site, simple scope | Towards £3,000 2. Initial audit (Stage 1 and 2) | More people, several sites, or a complex scope such as software development, hosting or many suppliers | Towards £8,000 3. Two surveillance audits (years 2 and 3) | Small team, one site, simple scope | Towards £2,000 for both 3. Two surveillance audits (years 2 and 3) | More people, several sites or a complex scope | Towards £6,000 for both 4. Consultancy | An experienced security lead in-house who will run the project | No fees, but significant staff time 4. Consultancy | A lead in-house who needs help with the hard parts | £400 to £1,000 for each consultant day you buy 4. Consultancy | Starting from scratch, or a fixed customer deadline | £8,000 to £25,000 for a fixed package 5. Security testing | Internet-facing systems or software you build (Annex A 8.8 and 8.29) | Add a penetration test; see our penetration testing cost guide Two worked examples, using only the figures above: - Lower end: one site, a simple scope and ten consultant days: £114 + £3,000 + £2,000 + £4,000 to £10,000 = about £9,100 to £15,100 over three years. - Upper end: several sites, a complex scope and a full package at the top of the range: £114 + £8,000 + £6,000 + £25,000 = about £39,100 over three years. Your starting point moves the consultancy line most. If you already hold Cyber Essentials or PCI DSS, or already run security processes with records, you need fewer consultant days. An ISO 27001 gap analysis tells you which consultancy row you are really in before you commit budget. For a figure based on your actual scope rather than published ranges, ask us for a quote. ## What makes up the cost of ISO 27001 certification? Five line items appear on invoices; internal costs never do. Cost item | Who you pay | Published UK range | When Copy of ISO/IEC 27001:2022 | Standards body | about £114 | Once Consultancy (gap analysis, ISMS build, internal audit support) | Consultant | £8,000 to £25,000 packages, or £400 to £1,000 a day | Mostly year 1 Initial certification audit (Stage 1 + Stage 2) | Certification body | £3,000 to £8,000 | Year 1 Surveillance audits | Certification body | £1,000 to £3,000 each | Years 2 and 3 Recertification audit | Certification body | No figure published in our review; longer than a surveillance audit, shorter than Stage 1 + 2 | Before the certificate expires Staff time, tools, testing and training | Internal and suppliers | Varies with scope and gaps | Throughout You can buy the standard itself from ISO or a national standards body. The £114 figure is the price quoted in one UK guide we reviewed. Stage 1 checks the design of your information security management system (ISMS): scope, risk assessment, Statement of Applicability, policies, and evidence that an internal audit and management review have taken place. It decides whether you are ready for Stage 2. Stage 2 tests whether the ISMS actually works. Auditors interview staff, sample records and check the controls listed in your Statement of Applicability. Any major nonconformity must be closed before the certificate is issued, which can add follow-up audit time to the bill. ## ISO 27001 certification cost by company size Company size is one of the biggest cost drivers. Certification bodies set audit days from the number of people working within your ISMS scope, following ISO/IEC 27006, the standard that governs ISMS certification bodies. Company size | Published band (one UK compliance platform) | Why it costs what it does Smaller organisations | £3,000 to £10,000 | Fewer people, systems and suppliers; audit days at the low end; often one site Mid-sized organisations | £9,000 to £40,000 | More departments and suppliers to bring into the ISMS; more consultancy days to write and embed processes Larger organisations | £30,000 to £100,000 | Multiple sites, more complex scope, longer Stage 2 with site sampling, often a dedicated ISMS manager Surveillance, any size | £1,000 to £3,000 a year | Shorter annual audits that sample part of the ISMS each year Providers draw headcount thresholds differently, so treat these bands as a guide, not a price list. ## How much does the ISO 27001 audit cost? Every certified organisation pays for the initial certification audit. Published UK prices we reviewed ranged from £3,000 to £8,000 for Stage 1 and Stage 2 together, and one certification body’s own cost guide quoted £3,675 to £4,425 for initial certification. ISO 27001 certification fees are driven by auditor days, which depend on: - the number of people in scope; - the number of sites, and whether audits are on site or remote; - how complex your technology and outsourcing arrangements are. Before you compare quotes, ask which accreditation body stands behind each certificate and check that it matches what your customers or tenders ask for. A cheap certificate that your largest customer will not accept is the most expensive option. ## What are the annual costs after certification? An ISO 27001 certificate lasts three years, provided you pass a surveillance audit in years two and three. In the published UK prices we reviewed, each surveillance audit cost £1,000 to £3,000. Year | Certification body | Your ongoing work Year 1 | Stage 1 and Stage 2 audits (£3,000 to £8,000) | Implementation, internal audit, management review Year 2 | Surveillance audit (£1,000 to £3,000) | Internal audit, management review, risk review, security testing Year 3 | Surveillance audit (£1,000 to £3,000), then recertification before expiry | As year 2, plus preparing for recertification The standard requires internal audits (clause 9.2) and management reviews (clause 9.3) at planned intervals, and certification bodies expect to see both each year. You can run the internal audit yourself if you have a competent, impartial person, or outsource it; see our ISO 27001 internal audit service. ## How much do ISO 27001 consultants charge? UK ISO 27001 consultants charge £400 to £1,000 a day, according to published figures we reviewed. Fixed implementation packages from one UK provider came in three tiers: £8,000, £12,000 to £15,000 and £18,000 to £25,000. Model | Published range | Best for | Watch out for Day rate | £400 to £1,000 a day | Teams with an in-house lead who need targeted help | Days that keep growing if scope drifts Fixed package | £8,000 to £25,000 | Most first-time certifications | Check whether internal audit, audit-day support and surveillance years are included Self-implementation | About £114 for the standard, plus tools and time | Organisations with an experienced security lead | Stage 1 findings that delay the certificate You do not need a consultant to certify. Certification bodies must stay impartial, so they will audit your ISMS but will not design it for you; that is the consultant’s job. A fixed-price ISO 27001 gap analysis is the cheapest way to find out how much help you actually need, and our ISO 27001 consultancy page explains how we take you from gap analysis to certificate. ## What hidden ISO 27001 implementation costs should you budget for? Invoices show only part of the cost of ISO 27001 implementation. Budget for these as well: - Staff time. Someone has to own the ISMS, and IT, HR and leadership all give time to the risk assessment, policies, training, internal audit and the audit days themselves. - Remediation and tools. Whatever gaps the risk assessment finds need fixing: device management, backups, logging, access reviews or supplier assessments. Some teams also buy a compliance platform to manage evidence. - Security testing. Annex A 8.8 and 8.29 expect you to find and fix technical weaknesses. One UK provider published external infrastructure tests at £3,750 to £6,250+ and web application tests at £6,250 to £10,000+. Our penetration testing cost guide explains what drives these prices, and our ISO 27001 penetration testing page covers what auditors expect to see. - Training and awareness. Clause 7.3 and control 6.3 require staff awareness, and you need records to prove it. - Travel and follow-up. On-site audit days can carry travel costs, and major nonconformities can mean a return visit. ## What affects the price of ISO 27001 certification? Cost driver | Why it changes the price | How to keep it down People in scope | Sets auditor days and the number of staff to train | Scope the ISMS to what your customers actually need certified Number of sites | More locations to visit or sample | Ask whether parts of the audit can be remote Scope complexity | Software development, hosting and many suppliers bring more Annex A controls into play | Agree a clear scope statement early Existing controls | Mature IT and existing certifications mean fewer consultancy days | Reuse evidence you already have Deadline | A compressed timeline needs more consultant days at once and an early audit booking | Start before a tender deadline forces you to Documentation approach | Generic template packs look cheap but take rework to fit how you operate | Write policies for how you actually work ## How long does ISO 27001 certification take? For a small or mid-sized organisation, expect three to nine months from gap analysis to certificate. A rushed project concentrates consultant days; a longer one spreads the work. Phase | What happens | Who you pay 1. Gap analysis | Assess against clauses 4 to 10 and the 93 Annex A controls | Consultant, or internal time 2. Scope, risk assessment and Statement of Applicability | Decide what is in scope and which controls apply | Consultant and internal time 3. Implementation | Policies, procedures and controls put in place | Internal time, tools, consultant 4. Operate the ISMS | Generate the records auditors will sample | Internal time 5. Internal audit and management review | Mandatory before Stage 2 | Internal time or outsourced auditor 6. Stage 1 and Stage 2 audits | Documentation review, then effectiveness audit | Certification body 7. Surveillance, years 2 and 3 | Annual sampling audits | Certification body ## How can you reduce the cost of ISO 27001? - Start with a gap analysis so you only pay consultants to close the gaps you actually have. - Scope sensibly. Certify the services your customers buy rather than the whole group, as long as the scope still makes sense to the people asking for the certificate. - Reuse Cyber Essentials evidence. The five Cyber Essentials controls (firewalls, secure configuration, user access control, malware protection and security update management) feed straight into Annex A controls such as 8.7, 8.8, 8.9 and 8.20. See our Cyber Essentials certification prices and the Cyber Essentials vs ISO 27001 comparison. - Reuse PCI DSS work. Risk assessments, policies, logging and penetration test reports produced for PCI DSS can support your ISMS evidence. Our comparison of PCI DSS vs ISO 27001 maps each PCI DSS requirement to Annex A. - Plan ISO 27001 and SOC 2 together. If US customers also want a SOC 2 report, one risk assessment and one control set can serve both, and most of your ISO 27001 evidence carries over to the CPA firm’s examination. See ISO 27001 vs SOC 2 for how the two compare, our guide to SOC 2 compliance for what the examination adds and what drives its cost, and SOC 2 Type 1 vs Type 2 for which report to start with. - Start from free templates, then tailor them. Our free ISO 27001 toolkit has a policy template and spreadsheets for the checklist, Statement of Applicability and risk register, which saves drafting days as long as you adapt them to how you work. - Build internal audit skills so each year’s internal audit does not need outside help. - Get one quote for both halves. Pricing consultancy and certification audits together shows you the whole cost before you commit. ## Why Sovereign Secure Sovereign Secure Ltd is an ISO 27001 certified UK consultancy and an IASME-licensed Cyber Essentials certification body. ISO certification audits are carried out by our partner certification body, MQA International. - We hold the certificate ourselves. We go through the same surveillance audits we prepare you for. - Consultancy and audit, kept separate. We prepare you; MQA International audits you. We can quote both together so you see the full cost up front, while the audit stays independent. - Evidence that works across standards. As a PCI SSC Qualified Security Assessor (QSA), Qualified PIN Assessor (QPA) and Card Production Security Assessor (CPSA) company, and a member of the PCI SSC Global Executive Assessor Roundtable 2026 to 2028, we map ISO 27001 to PCI DSS and Cyber Essentials so one set of evidence serves several. - UK-based since 2012, headquartered in Accrington, Lancashire, with offices in Los Angeles, Singapore, Dubai and Dhaka. ## Get a fixed ISO 27001 quote We do not publish ISO 27001 prices, because headcount, sites and scope change the answer more than anything else. For a fast, fixed quote, tell us: - how many people work within the scope you want certified; - how many sites or offices are involved; - which products, services or systems the certificate must cover; - any existing certifications, such as Cyber Essentials or PCI DSS; - your deadline, for example a tender or customer contract date. Request your ISO 27001 quote or call +44 161 523 5276. Last reviewed October 2026 by the Sovereign Secure assessment team. div]:shrink-0 xl:[&>nav]:min-h-0 xl:[&>nav]:overflow-y-auto hidden"> FAQ ## Frequently asked questions How much does ISO 27001 cost for a small business? + One UK compliance platform publishes a band of £3,000 to £10,000 for smaller organisations. If you use a consultant, the published figures we reviewed put year one at about £11,000 at the low end (an £8,000 package plus a £3,000 certification audit). The gap between the two is mostly how much of the work your own team does. Our guide to ISO 27001 for startups shows how a small team keeps the scope lean. What are the annual costs of ISO 27001? + Each surveillance audit in years two and three cost £1,000 to £3,000 in the published UK prices we reviewed. On top of that you run an internal audit and management review every year, keep security testing and training going, and pay for any retained consultancy. A recertification audit falls due before the certificate expires at the end of year three. Do I have to use an ISO 27001 consultant? + No. The certification body only checks that your ISMS meets the standard, not who built it. A consultant mainly saves time and avoids Stage 1 findings; if you have an experienced security lead, day-rate support for the hard parts can cost far less than a full package. See our ISO 27001 consultancy page for how we work. How many months should we budget for? + Typically three to nine months from gap analysis to certificate for a small or mid-sized organisation. The biggest variables are how mature your security already is and how quickly decisions get made internally. Is the ISO 27001 certificate a one-off cost? + No. A certificate is valid for three years only if you pass a surveillance audit in each of years two and three, then a recertification audit starts the next cycle. Budget for the full cycle, not just the first audit. Should we budget for penetration testing? + Usually. The standard does not name penetration testing, but Annex A controls 8.8 (technical vulnerabilities) and 8.29 (security testing in development and acceptance) expect you to find and fix weaknesses, and auditors will ask how you do it. See ISO 27001 penetration testing. Is ISO 27001 certification worth it? + It depends on who you sell to. Where enterprise, financial services or public sector buyers require it, certification is the price of entry to those contracts. Our guide to the benefits of ISO 27001 covers the commercial case in more detail. Does this include ISO 27001 course or exam fees? + No. This page covers certifying your organisation. Individual courses and exams, such as ISO 27001 Lead Implementer or Lead Auditor, are personal qualifications priced separately by training providers, and you do not need them to get your organisation certified. --- # ISO Certification UK | ISO Consultants: 9001, 14001, 27001 URL: https://sovereignsecure.co.uk/iso-certification/ ISO 9001, 14001, 45001, 22301 & more ## ISO Certification & Consultancy in the UK ISO certification is independent confirmation, by a certification body, that your management system meets an ISO standard such as ISO 9001, 14001 or 45001. As ISO consultants and an ISO 27001-certified firm, we take you from gap analysis to certificate (typically three to six months for a single standard), with audits by our partner certification body, MQA International. Get an ISO quote ISO 27001 checklist - 12 ISO standards covered - Integrated management systems - Certification audits by MQA International Overview ## What is ISO certification? The short answer ISO certification is independent confirmation, by a certification body, that your management system meets an ISO standard such as ISO 9001, 14001, 45001 or 27001. ISO writes the standards but does not certify anyone. Certification follows a two-stage audit, lasts three years with surveillance audits in between, and typically takes three to six months for one standard. ISO certification means an independent certification body has audited your management system and confirmed it meets an ISO standard, such as ISO 9001 for quality or ISO 14001 for environmental management. ISO writes the standards but does not certify organisations; certification bodies do. A certificate normally lasts three years, with surveillance audits in between. A certificate is always to a named standard, edition and scope, for example a quality management system covering the design and manufacture of a product range at one site. It is voluntary in law, but customers, tenders and supply chains often make it a condition of doing business. Information security is our core ISO work, and Sovereign Secure is ISO 27001 certified itself. See ISO 27001 consultancy for the full service, or our ISO 27001 certification cost guide for what audits and consultancy typically cost. For quality management, see ISO 9001 consultancy and certification. ## Standards & frameworks - ISO/IEC 27001:2022 - ISO 9001:2026 - ISO 14001:2026 - ISO 45001:2018 - ISO 22000:2018 - ISO/IEC 20000-1:2018 - ISO 13485:2016 - ISO 50001:2018 - ISO 55001:2024 - ISO 39001:2012 - ISO 22301:2019 - ISO 21001:2025 ## What you receive - Gap analysis report for each standard - Management system documentation - Internal audit report and management review pack - Support through the Stage 1 and Stage 2 certification audits What's included ## ISO consultancy services for every major standard Whichever standard you need, the work follows the same path. For information security we also offer an ISO 27001 gap analysis and an ISO 27001 internal audit as standalone services. - 01 ## Gap analysis A clear view of where you stand against each standard, what is missing and what it will take to certify. - 02 ## Integrated management One set of policies, objectives, risk registers, internal audits and management reviews covering several standards at once. - 03 ## Documentation Policies, procedures and records written for how your organisation actually works. - 04 ## Training Awareness and internal auditor training so your team can run the system after we step back. - 05 ## Internal audit and management review Independent internal audits and management review support before the certification audit and every year after it. - 06 ## Certification Stage 1 and Stage 2 audits by an independent certification body, such as our partner MQA International, plus support through annual surveillance and recertification. ## ISO certification vs ISO accreditation: what is the difference? ISO accreditation is formal recognition, by an accreditation body, that a certification body is competent and impartial enough to audit; ISO certification is what your organisation receives from that certification body. So your organisation is certified, and the certification body that audits you is accredited. The two words are often used interchangeably, and many buyers say "ISO accredited" when they mean ISO certified. ISO certification and ISO accreditation compared Aspect | ISO certification | ISO accreditation Who receives it | Your organisation, for its management system | A certification body (or a testing, inspection or calibration body) Who grants it | An independent certification body, after a Stage 1 and Stage 2 audit | An accreditation body, after assessing the certification body against ISO/IEC 17021-1 What it proves | Your management system meets the requirements of the standard | The certification body is competent and impartial to audit and certify We are the consultancy that prepares you; MQA International is the independent certification body that audits you and issues your certificate. MQA International is accredited by IAS, the International Accreditation Service, for standards including ISO 9001, ISO 14001, ISO 45001, ISO/IEC 27001, ISO 22301 and ISO/IEC 20000-1. If a customer or tender asks for a specific accreditation, tell us at the outset and we will confirm how your certificate will be issued before you commit. ## Types of ISO certification There is no single "ISO certificate": you are certified to a specific standard. These are the management system standards we support, who usually asks for them and where to read more. ISO 9001 is the most widely used; if you are new to it, start with what ISO 9001 is. ISO certifications we support Standard | What it certifies | Who usually asks for it | Read more ISO 9001 | Quality management system | Customers, public sector tenders and manufacturing supply chains | ISO 9001 certification ISO 14001 | Environmental management system | Public sector and construction tenders, customers with environmental targets | ISO 14001 certification ISO 45001 | Occupational health and safety management | Construction, manufacturing, facilities and logistics clients | ISO 45001 certification ISO/IEC 27001 | Information security management system (ISMS) | Enterprise and SaaS buyers, banks, the public sector | ISO 27001 consultancy ISO 22301 | Business continuity management | Financial services, critical suppliers and outsourcers | ISO 22301 certification ISO/IEC 20000-1 | IT service management | Clients of managed service and IT outsourcing providers | ISO 20000 certification ISO 13485 | Quality management for medical devices | Medical device manufacturers, their suppliers and regulators | ISO 13485 certification ISO 22000 | Food safety management | Food manufacturers, retailers and caterers | ISO 22000 certification ISO 50001 | Energy management | Energy-intensive organisations; one route to ESOS compliance | ISO 50001 certification ISO 55001 | Asset management | Utilities, infrastructure and transport operators | ISO 55001 certification We also support ISO 39001 for road traffic safety and ISO 21001 for educational organisations. For ISO 13485, ISO 22000, ISO 50001, ISO 55001, ISO 39001 and ISO 21001 we confirm the certification body for your scope when we quote. ## How much does ISO certification cost? There is no fixed price for ISO certification. The total has two parts: the certification body's audit fees over the three-year cycle (Stage 1, Stage 2, two surveillance audits and recertification), and any consultancy you choose to buy to get ready. These are the drivers that move both: What drives the cost of ISO certification Cost driver | Why it changes the cost Which standards, and how many | Each standard needs its own audit time; an integrated audit of several standards can take less time than separate audits if the certification body agrees People in scope | Certification bodies set audit days largely from the number of people the certificate covers Number of sites | More locations to visit or sample Scope and risk | Complex or higher-risk activities, such as manufacturing processes, hazardous work or software development, need more audit time Your starting point | Existing procedures and records mean fewer consultancy days and fewer audit findings Level of support | A full implementation costs more than a gap analysis or an internal audit on its own Deadline | A compressed timeline concentrates consultant days and needs an early audit booking For information security, our ISO 27001 certification cost guide shows the published UK fees we found at each stage. For any other standard, we give you a fixed quote after a short call: use the enquiry form to tell us the standard, the number of people and the sites in scope. ## Integrated management systems: ISO 9001, 14001 and 45001 together Most ISO management system standards, including ISO 9001, 14001, 45001, 22301 and 27001, share the same harmonised structure, with their requirements in clauses 4 to 10. Quality, environmental, health and safety, business continuity and information security can therefore run as one integrated management system, built once and maintained together, with certification against each standard you need. In practice that means one context and risk process, one document control system, one internal audit programme and one management review covering every standard. ISO 9001, 14001 and 45001 are the most common combination, particularly in manufacturing, construction and facilities management. Whether the certification audits themselves can be combined is for the certification body to decide, so we confirm it for your scope before you commit. ## ISO certification by sector Which certificates matter depends on who you sell to. These are the combinations we see asked for most often: ISO certification by sector Sector | Standards usually asked for | Read more Manufacturing | ISO 9001, ISO 14001, ISO 45001 and ISO 50001, with ISO 27001 where customers share designs or data | Manufacturing cyber security SaaS and IT services | ISO 27001 and ISO/IEC 20000-1, often alongside SOC 2 for North American customers | SaaS security and compliance Healthcare and medical devices | ISO 13485 for device makers, ISO 27001 for suppliers handling patient data | Healthcare cyber security How it works ## How to get ISO certification in five steps - 1 ## Choose the standard and scope Confirm which standards your customers, tenders or regulators ask for, and agree which sites and activities the certificate will cover. - 2 ## Gap analysis Assess your current practices against each chosen standard and agree one combined plan. - 3 ## Implement Put documentation, processes and training in place with our support, and start keeping the records auditors will check. - 4 ## Internal audit and review We audit the system and support your management review, both required before certification. - 5 ## Certification audit An independent certification body carries out the Stage 1 and Stage 2 audits and makes the certification decision, followed by annual surveillance audits. For ISO 9001, 14001, 45001, 27001, 22301 and 20000-1 that is our partner, MQA International. Why Sovereign Secure ## Why choose Sovereign Secure for ISO certification? Established in 2012, we deliver PCI, ISO and Cyber Essentials work for banks, payment processors, card manufacturers and fast-growing companies. Read client testimonials → - ISO 27001 certified ourselves. We run our own certified management system, so we prepare you for the kind of audit we go through ourselves. - Independent certification. MQA International audits and certifies, which keeps consultancy and audit separate. - Joined up with PCI DSS and Cyber Essentials. As a PCI SSC-approved QSA company and an IASME-licensed Cyber Essentials certification body, we reuse evidence across frameworks. - Where we work. Across the UK, including London, Manchester and the North West, from our head office in Accrington, Lancashire, and internationally through our offices in Los Angeles, Singapore, Dubai and Dhaka. FAQ ## Frequently asked questions What is ISO certification in the UK? + The same as anywhere else: an independent certification body audits your management system against an ISO standard, such as ISO 9001, ISO 14001 or ISO 27001, and issues a certificate after a two-stage audit, maintained through annual surveillance audits. Certification bodies are themselves accredited by an accreditation body, and many UK tenders and supply chains ask for a certificate from an accredited certification body, so check the wording of yours. For ISO 9001, 14001, 45001, 27001, 22301 and 20000-1, our partner MQA International is accredited by IAS, the International Accreditation Service. How do I get ISO certification? + Choose the standard and scope, run a gap analysis, implement and document the system, then complete an internal audit and management review. A certification body then audits you in two stages (Stage 1 and Stage 2) and issues the certificate if you meet the requirements. How do I check whether an ISO certificate is valid? + Ask the organisation for its certificate and check the certification body, the standard and edition, the scope and the expiry date. Then confirm it on the certification body's own register of certified organisations and, for accredited certificates, on the accreditation body's database. Is ISO certification a legal requirement? + No. No UK law requires ISO certification in general. It becomes a requirement when a customer, tender or supply chain makes it a condition, and some schemes accept it as a route to compliance, such as ISO 50001 for ESOS. Who issues the certificate? + An independent certification body, never the consultant. For ISO 9001, 14001, 45001, 27001, 22301 and 20000-1 that is our partner, MQA International; for other standards we confirm the certification body for your scope when we quote. We provide the consultancy and preparation; the certification body carries out the audit and issues the certificate if you meet the requirements. Do we need an ISO consultant to get certified? + No. Some organisations implement a standard themselves. An ISO consultant shortens the path with a proven method and an outside view before the auditor arrives. Under ISO/IEC 17021-1, the standard for certification bodies, a certification body may not offer consultancy on the management systems it certifies, which is why consultancy and certification come from separate organisations. How long does ISO certification take? + Typically three to six months for a single standard in a small or medium organisation, depending on your starting point. Adding a standard to an existing management system is usually quicker than starting from scratch. How much does ISO certification cost? + It depends on the standard, your headcount, the number of sites and how much is already in place. For information security, our ISO 27001 cost guide shows the typical fees at each stage. For any standard, we give you a fixed quote after a short call. How long does an ISO certificate last? + Three years. The certification body carries out surveillance audits in years two and three, then a recertification audit before the certificate expires, so the management system has to keep working between audits. Can we certify to several ISO standards at once? + Yes. Because the standards share a common structure, an integrated management system lets you work towards, for example, ISO 9001, 14001 and 45001 together, with one set of policies, internal audits and management reviews. Whether the certification audits can be combined is for the certification body to decide, so we confirm it for your scope before you commit. Which ISO standard do we need? + It depends on what your customers, tenders and regulators ask for. ISO 9001 covers quality, ISO 14001 environmental management, ISO 45001 health and safety, ISO 22301 business continuity and ISO 27001 information security. If you are unsure, we will confirm it with you in a short call before any work starts. Last reviewed October 2026 by the Sovereign Secure assessment team. ## Guides and tools in this section - ISO 27701 ISO 27701:2025 explained: the standalone privacy standard, controller and processor controls, how it maps to UK GDPR and what 2019 certificate holders do next. - ISO 42001 ISO 42001 explained: what the AI management system standard requires, its 38 Annex A controls, who needs it and how ISO 42001 certification works. - ISO 9001 vs ISO 27001 ISO 9001 vs ISO 27001 compared: purpose, risk approach, Annex A controls and audits, which to get first, and how to run both as one integrated management system. Standards we cover ## Consultancy and certification services - ISO/IEC 27001:2022 Information security Our core ISO service. Build and certify an ISMS that also supports PCI DSS and Cyber Essentials. → - ISO 9001:2026 ## Quality management The most widely adopted management system standard. Build a quality management system that controls your processes and suppliers, tracks customer satisfaction and improves continually. The 2026 edition was published in September 2026. Certificates to ISO 9001:2015 stay valid during a three-year transition, so certified organisations have until September 2029 to move across, and a system built to the 2015 edition carries forward. → - ISO 14001:2026 ## Environmental management Identify and control your environmental impacts, meet your compliance obligations and set measurable objectives. Often certified alongside ISO 9001 and ISO 45001 as one integrated system. The 2026 edition was published in April 2026. Certificates to ISO 14001:2015 stay valid during a three-year transition, so certified organisations have until 30 April 2029 to move across. → - ISO 45001:2018 ## Occupational health & safety The international standard that replaced OHSAS 18001. Identify hazards, reduce workplace risk, involve workers and show clients and regulators a safe working environment. → - ISO 22000:2018 ## Food safety management Food safety controls across the supply chain, from producers to retailers, combining HACCP principles and prerequisite programmes with a management system. → - ISO/IEC 20000-1:2018 ## IT service management Plan, deliver and improve IT services to agreed levels. It shares its structure and many processes with ISO 27001, so the two are often run together. → - ISO 13485:2016 ## Medical device quality Quality management for medical device design, manufacture and supply, widely used to support regulatory requirements for medical devices. → - ISO 50001:2018 ## Energy management Measure and reduce energy use and cost with a structured plan-do-check-act management system and energy performance indicators. → - ISO 55001:2024 ## Asset management Get the most value from physical assets across their whole life cycle. → - ISO 39001:2012 ## Road traffic safety Reduce road traffic incidents for fleets, logistics and transport operators. - ISO 22301:2019 ## Business continuity Prepare for, respond to and recover from disruption with tested continuity plans. Often paired with ISO 27001 and PCI DSS, and a natural next step for an existing ISMS. → - ISO 21001:2025 ## Educational organisations Management system for training providers, schools and universities. ## Related guides - What is ISO 9001? → - ISO 9001 vs ISO 27001 → - ISO/IEC 27701 privacy guide → - ISO/IEC 42001 AI management guide → --- # Penetration Testing Services UK | Pen Testing Company URL: https://sovereignsecure.co.uk/cyber-security-testing/ Cyber security testing ## Penetration Testing Services UK Penetration testing services are authorised, manual attacks on your applications, networks and cloud that show which weaknesses a real attacker could exploit, and how to fix them. Sovereign Secure is a UK pen testing company and a PCI SSC-approved QSA, so our pen testing services come with reports written to stand up as PCI DSS and ISO 27001 evidence. We carry out penetration testing in the UK and abroad. Get a penetration testing quote Call +44 161 523 5276 - PCI SSC-approved QSA company - Retest of fixed findings available - Reports mapped to PCI DSS, ISO 27001 & CE+ Penetration testing in brief A penetration test is an authorised, simulated attack on your systems. A tester, an ethical hacker working with your written permission, looks for weaknesses in your applications, networks, cloud services or staff, safely exploits them to show what an attacker could reach, and reports each finding with a severity rating and a fix. Unlike an automated vulnerability scan, every finding is confirmed by hand. New to pen testing? Read what is penetration testing for how tests work, the main types and when you need one. Security testing services ## Our penetration testing and cyber security testing services From a single web application to a full red team exercise, every engagement is manual, scoped to your risk and your compliance obligations, and priced before we start. Every testing service we offer is listed below. - Web application testing Web application penetration testing in the UK: manual OWASP Top 10, access-control and business logic testing by a PCI QSA company. Get a quote. → - API penetration testing API penetration testing services for REST, GraphQL and SOAP web services, tested against the OWASP API Security Top 10 by a PCI QSA company. Get a quote. → - Network & infrastructure testing Network penetration testing for UK firms: external perimeter, internal network and Active Directory attack paths, plus PCI DSS segmentation tests. Get a quote. → - External penetration testing External penetration testing of your internet-facing perimeter by a PCI QSA company: VPN, email, web and cloud, mapped to PCI DSS 11.4.3. Get a fixed quote. → - Internal penetration testing Internal penetration testing by a PCI QSA company: Active Directory attack paths, lateral movement and PCI 11.4.5 segmentation, remote or on-site. Get a quote. → - Cloud penetration testing Cloud penetration testing and cloud security testing for AWS, Azure, GCP and Microsoft 365: configuration review plus hands-on identity attacks. Get a quote. → - Mobile app testing Mobile penetration testing for iOS and Android apps to OWASP MASVS: on-device storage, traffic, authentication and the APIs behind the app. Get a quote. → - Hardware & IoT testing IoT penetration testing and hardware security testing for connected devices and POS terminals: firmware, debug interfaces, radio and cloud APIs. Get a quote. → - Social engineering & phishing Social engineering testing services: phishing, vishing and pretext tests that measure how staff respond, reported by team rather than by name. Get a quote. → - Phishing simulation Phishing simulation services for UK organisations: a simulated phishing test by email, QR code or phone, under agreed rules, reported by team. Get a fixed quote. → - Red team assessments Red teaming services and red team assessments: objective-led adversary simulation across technical, human and physical routes, under written rules of engagement. → - Wireless testing Wireless penetration testing for corporate and guest Wi-Fi networks: WPA2/WPA3, 802.1X, rogue and evil twin access points and PCI DSS 11.2 checks. Get a quote. → - Source code review Secure code review services UK: manual source code security review plus static code analysis (SAST), mapped to OWASP and PCI DSS 6.2. Get a quote. → - AI & LLM testing AI red teaming and LLM penetration testing: prompt injection, data leakage, jailbreaks and agent abuse, tested against the OWASP Top 10 for LLMs. Get a quote. → - Vulnerability scanning Vulnerability scanning services and vulnerability assessment services: internal, external and cloud scans, triaged findings, rescans and PCI ASV scans via a partner. → - VAPT services VAPT services from a PCI QSA company: vulnerability assessment plus manual penetration testing, one prioritised report and a retest. Get a fixed-price quote. → - Firewall security audit Firewall security audit and configuration review against CIS Benchmarks and PCI DSS Requirement 1: rule-base analysis, segmentation checks and hardening advice. → - Website penetration testing Website penetration testing for WordPress, WooCommerce, Shopify and Magento sites: what a test covers, what online scanners miss and how to get a fixed quote. → - Small business penetration testing Affordable penetration testing for small businesses: what to test first and how to right-size the scope so you only pay for what matters. Get a fixed quote. → - Microsoft 365 security assessment Microsoft 365 security assessment from a PCI QSA company: Entra ID, conditional access, Exchange Online, sharing and Defender reviewed. Get a fixed quote. → - AWS penetration testing AWS penetration testing services from a PCI QSA company: IAM privilege escalation, S3 exposure, EC2, Lambda, EKS and PCI segmentation tested. Get a fixed quote. → - Azure penetration testing Azure penetration testing of Entra ID, RBAC, storage, Key Vault, App Service, AKS and hybrid identity, reported by a PCI QSA company. Get a fixed quote. → - SOC 2 penetration testing SOC 2 penetration testing for UK SaaS firms: scope CPA firms accept, timing inside your observation period, reports for Vanta and retests. Get a fixed quote. → - Agentic AI security Agentic AI security testing for agents that call tools and APIs: tool misuse, excessive agency, credential exposure and memory poisoning. Get a fixed quote. → ## Compliance testing As a QSA company and IASME-licensed certification body, we scope tests around the standard you answer to. - PCI DSS penetration testing Requirement 11.4 internal, external, application and segmentation tests, reported the way your QSA expects. → - ISO 27001 penetration testing Testing scoped to Annex A 8.8 and 8.29, with the evidence pack certification auditors ask for. → - PCI ASV scans Quarterly external scans for Requirement 11.3.2, delivered through a PCI SSC Approved Scanning Vendor partner. → - Cyber Essentials Plus audit The independent CE+ technical audit, from an IASME-licensed certification body. → ## Penetration testing guides and tools - What is penetration testing - Types of penetration testing - Penetration testing methodology - Black box vs white box penetration testing - Vulnerability assessment - What is red teaming - Red teaming vs pentesting - Physical penetration testing - Wireless security audit checklist - Penetration testing as a service - Attack surface management - Penetration testing vs vulnerability scanning - Internal vs external penetration testing - How often should penetration testing be done? - How to prepare for a penetration test - Penetration testing report - Penetration test remediation - Penetration testing companies - Penetration testing cost - Penetration testing quote Choose the right test ## Which penetration test do you need? Start from what you need to prove. If more than one row applies, we can combine tests into a single engagement and report. If you need to… | Choose | What it covers Find out what an attacker can reach from the internet | External penetration testing | Tests firewalls, VPN and remote access, email, DNS and web servers from the outside. See how far a phished user or insider could get | Internal penetration testing | Follows Active Directory and lateral-movement paths from a standard user towards domain admin. Test a whole estate, inside and out | Network & infrastructure penetration testing | Combines external, internal and segmentation testing in one engagement. Secure a website, portal or SaaS product | Web application penetration testing | Manual testing of every role, workflow and permission to the OWASP Top 10. Check a WordPress, Shopify or Magento site | Website penetration testing | What a test covers on a CMS or e-commerce site, and what online scanners miss. Answer enterprise customers’ security reviews | SaaS penetration testing | Web application, API and cloud testing scoped around multi-tenant isolation and release cycles. Secure APIs used by apps and partners | API penetration testing | Tests each endpoint for broken authorisation, token flaws and data exposure. Secure an iOS or Android app | Mobile app penetration testing | Covers on-device storage, traffic and the back-end APIs to OWASP MASVS. Check AWS, Azure, GCP or Microsoft 365 | Cloud penetration testing | Configuration review plus hands-on identity and exposure testing. Meet PCI DSS Requirement 11.4 | PCI DSS penetration testing | Internal, external, application and segmentation tests in one report for your QSA. Evidence Annex A 8.8 and 8.29 for ISO 27001 | ISO 27001 penetration testing | Scoped to your ISMS, with findings linked to your risk treatment plan. Keep watch between annual tests | Vulnerability scanning | Scheduled internal and external scans, triaged and rescanned after fixes. Combine scanning and a manual test in one report | VAPT | A vulnerability assessment plus a penetration test, with one prioritised report. Get a first test on a small budget | Affordable penetration testing for small businesses | What to test first and how to right-size the scope. Measure how staff respond to phishing | Social engineering testing | Phishing, phone and on-site pretexts, reported by team. Test detection and response | Red team assessment | An objective-led attack across technical, human and physical routes. Check Wi-Fi and rogue access points | Wireless penetration testing | On-site testing of encryption, guest segregation and PCI DSS 11.2 checks. Test a chatbot, copilot or AI agent | AI & LLM penetration testing | Prompt injection, data leakage and excessive agency, to the OWASP Top 10 for LLMs. Test connected devices or POS terminals | IoT & hardware penetration testing | Firmware, debug interfaces, radio links and cloud back ends. Compliance mapping ## Which standards require penetration testing? PCI DSS requires penetration testing outright; ISO 27001, SOC 2, DORA and UK GDPR expect regular security testing that a pen test evidences best. Every report we write maps findings to the standards below. Standard | What it asks for | Tests that provide the evidence PCI DSS v4.0.1 | Internal and external penetration tests at least every 12 months and after significant change (11.4.1 to 11.4.4); segmentation tests every 12 months, or 6 for service providers (11.4.5 to 11.4.6); quarterly internal and ASV scans (11.3); quarterly rogue wireless checks (11.2). | PCI DSS penetration testing, ASV scans, vulnerability scanning, wireless testing ISO/IEC 27001:2022 | Annex A 8.8 (management of technical vulnerabilities) and 8.29 (security testing in development and acceptance). Neither names penetration testing, but auditors look for regular, independent evidence. | ISO 27001 penetration testing, web and API testing, vulnerability scanning Cyber Essentials Plus | An independent technical audit of a sample of devices, including an external vulnerability scan, authenticated patch checks and malware-protection tests. It is not a penetration test. | CE+ audit; a pen test is useful preparation but not required SOC 2 | The Trust Services Criteria list penetration testing as an example of a separate evaluation (CC4.1) and expect vulnerabilities to be identified and monitored (CC7.1). | Annual penetration test of the in-scope system, plus vulnerability scanning DORA (EU financial entities) | A digital operational resilience testing programme that includes vulnerability assessments and penetration testing (Articles 24 to 25), and threat-led penetration testing for firms selected by their regulator (Article 26). | External, internal and application testing; red team assessments UK GDPR | Article 32 requires a process for regularly testing, assessing and evaluating the effectiveness of your security measures. | Risk-based penetration testing of systems holding personal data External scans for PCI DSS 11.3.2 are delivered through a PCI SSC Approved Scanning Vendor partner; see PCI ASV scanning. For how requirements change the size of a test, see how compliance affects penetration testing cost. Our process ## How we run a penetration test, from scoping to retest Our methodology follows the OWASP Web Security Testing Guide, PTES and NIST SP 800-115, and the NCSC’s penetration testing guidance on how buyers should scope and use a test. The frameworks and phases are compared in our guide to penetration testing methodology. - 1 ## Scoping and fixed price We agree targets, user roles, testing windows and rules of engagement in writing, then fix the price before any testing starts. - 2 ## Reconnaissance We map the attack surface: hosts, services, application functions and the people or data an attacker would go after. - 3 ## Manual testing Testers work by hand, backed by professional tooling, following OWASP, PTES and NIST SP 800-115. Critical issues are reported the day we confirm them. - 4 ## Reporting An executive summary for leadership, and technical findings with reproduction steps, CVSS ratings and prioritised fixes, mapped to the standards you answer to. - 5 ## Debrief A walkthrough call with your technical team to talk through the findings, the attack paths and the fixes. - 6 ## Retest Once you have remediated, we retest the fixed findings and reissue the report showing them closed, ready for your auditor or customer. Every test follows the five stages of penetration testing: planning and reconnaissance, scanning, gaining access, maintaining access, and analysis and reporting. Where we test ## Where can you get penetration testing in the UK? Anywhere in the UK. Web application, API, cloud and external network tests run over the internet, so your location makes no difference to them. For work that needs a tester in the building, our head office in Accrington, Lancashire is about 20 miles from Manchester, so we reach offices and data centres across Manchester and the North West on site. Internal tests need network access or a test device on the relevant segments, and wireless penetration testing always needs a tester on site, so we travel to sites elsewhere in the UK when the work requires it. Choosing a provider ## How do you choose a penetration testing company? Start with what you need to prove and who will read the report. Then ask every provider the same questions: how many tester-days the scope includes and how much of that time is manual testing, which methodology they follow, what a sample report looks like, and how fixed findings are retested. If a contract, regulator or customer names a specific testing scheme, check that the provider meets it before you compare prices. Our guide on how to choose a penetration testing company in the UK sets out the full list of questions. Looking for a list of the top penetration testing companies in the UK? No independent ranking exists, and lists published by providers usually rank the publisher well, so the same guide shows you how to build and check your own shortlist. Why Sovereign Secure ## Why choose a QSA-led penetration testing company? Most penetration tests are bought to satisfy someone: a QSA, an ISO auditor, a customer’s security questionnaire or an insurer. We assess against those standards every day, so we scope tests to what the assessor will check and write findings in the form they expect. - Evidence first time. Reports map each finding to PCI DSS, ISO 27001 and CE+ controls, so you do not need a second report for the audit. - Manual testing. Every finding is confirmed by hand, with reproduction steps, not a scanner export with a cover page. - Fixed scope and price. Agreed in writing before testing starts, including whether and when fixed findings are retested. - One provider across compliance. Testing, PCI assessments, Cyber Essentials and ISO 27001 consultancy from one team, with ASV scans managed through our approved scanning partner. Sovereign Secure Ltd (company no. 08334453, est. 2012, Accrington, Lancashire, UK) is a PCI SSC-approved Qualified Security Assessor (QSA), Qualified PIN Assessor (QPA), Card Production Security Assessor (CPSA), P2PE Assessor (Europe and USA) and 3DS Assessor company, a member of the PCI SSC Global Executive Assessor Roundtable 2026 to 2028, an IASME-licensed certification body for Cyber Essentials, IASME Cyber Assurance and Defence Cyber Certification Levels 0 and 1, and an ISO 27001-certified firm, with offices in Los Angeles, Singapore, Dubai and Dhaka. Clients include Accor, Fiserv, JCPenney and Ticketmaster; see our clients and testimonials. We test across sectors, from payments and banking to SaaS penetration testing for software firms whose enterprise customers ask for an independent report. Cost and quotes ## How much do penetration testing services cost? Penetration tests are priced by tester-days, so the price follows the scope. The table shows what moves it. Cost driver | What we ask at scoping Size of the target | Live IP addresses, applications, API endpoints, cloud accounts or devices Depth | User roles, authenticated testing, business logic and workflows Compliance driver | PCI DSS segmentation, ISO 27001 scope, customer or insurer requirements Access and location | Remote, on site or through a test device; testing windows Retest and reporting | Whether a retest of fixed findings is needed, and any extra report formats See our penetration testing cost guide for published UK price ranges by test type, then get a fixed penetration testing quote. ## Accreditations Our accreditations are held by the company: PCI SSC-approved QSA, QPA, CPSA, P2PE Assessor (Europe and USA) and 3DS Assessor, member of the PCI SSC Global Executive Assessor Roundtable 2026 to 2028, IASME-licensed certification body for Cyber Essentials, IASME Cyber Assurance and Defence Cyber Certification Levels 0 and 1, and ISO 27001 certified. If a contract names a specific testing scheme, ask us at scoping and we will confirm in writing whether we meet it. FAQ ## Penetration testing FAQs What is a penetration testing service? + A penetration testing service is a scoped engagement in which a qualified tester, working with your written authorisation, attacks agreed targets such as web applications, APIs, networks or cloud accounts, proves which weaknesses can be exploited and reports each one with a severity rating and a fix. Some providers also sell testing as a subscription, known as penetration testing as a service (PTaaS), or combine it with scanning as VAPT. Is penetration testing legal? + Yes, when the owner of the systems authorises it in writing; testing without permission can be an offence under the Computer Misuse Act 1990, as our guide to what penetration testing is explains. How often should we have a penetration test? + At least once a year, and after any significant change to your infrastructure or applications. PCI DSS requires annual internal and external testing and testing after significant changes, plus segmentation testing every six or twelve months depending on whether you are a service provider. See PCI DSS penetration testing for the detail. Do we need vulnerability scanning as well as penetration testing? + Usually, yes. A scan is automated and finds known weaknesses. A penetration test is carried out by a skilled tester who verifies and exploits vulnerabilities, chains them together and tests business logic that scanners cannot. Most standards expect both, which is why we also offer vulnerability scanning services. How much does a penetration test cost? + Most tests are priced by tester-days. In published pricing guides from UK providers we reviewed in September 2026, typical day rates were about £1,000 to £1,500, so the price mainly reflects how many days your scope needs. Our penetration testing cost guide breaks this down by test type, and the penetration testing quote form gets you a fixed price. How long does a penetration test take? + A small API or external test can take a few days; a typical web application around a week; mobile, hardware and red team work longer. We confirm testing dates, reporting and the retest window in the fixed-price proposal. What is the difference between black box, grey box and white box testing? + Black box starts with no inside knowledge, grey box gives the tester credentials and some documentation, and white box adds source code and architecture detail, which pairs well with a secure source code review. Our guide to black box vs white box penetration testing compares all three. What do your penetration testing services include? + Every engagement includes written scoping and a fixed price, manual testing, a report with an executive summary and technical findings rated with CVSS and mapped to the standards you answer to, and a debrief call with your technical team. A retest of fixed findings can be scoped into your proposal. Do we need a penetration test for PCI DSS, ISO 27001 or Cyber Essentials Plus? + For PCI DSS, yes: Requirement 11.4 requires internal and external penetration testing. ISO 27001 does not name it, but Annex A 8.8 and 8.29 make it the clearest evidence (see ISO 27001 penetration testing). Cyber Essentials Plus is a separate technical audit, not a penetration test. Will testing disrupt our systems? + We agree rules of engagement, testing windows and contacts before we start, avoid denial-of-service style testing unless requested, and can test in staging environments. Production testing is carried out carefully and with your approval. Do you retest after we fix the issues? + Yes. A retest of remediated findings can be scoped into your proposal, and the updated report gives your auditor or customer evidence that issues have been closed. What accreditations does Sovereign Secure hold? + We are a PCI SSC-approved QSA, QPA, CPSA, P2PE Assessor (Europe and USA) and 3DS Assessor company, a member of the PCI SSC Global Executive Assessor Roundtable 2026 to 2028, an IASME-licensed certification body for Cyber Essentials, IASME Cyber Assurance and Defence Cyber Certification Levels 0 and 1, and ISO 27001 certified. Testing follows published methodologies such as OWASP, PTES and NIST SP 800-115. If a contract or regulator names a specific testing scheme, tell us when you ask for a quote and we will confirm in writing whether we meet it. Do you test on site? + Yes, where the work needs it. Our head office is in Accrington, Lancashire, about 20 miles from Manchester, so we cover cyber security and penetration testing in Manchester and the North West on site, and test remotely across the rest of the UK and abroad. --- # About Sovereign Secure | PCI SSC GEAR Member, Est. 2012 URL: https://sovereignsecure.co.uk/about-us/ About us ## About Sovereign Secure Sovereign Secure Ltd (company 08334453) is a UK cyber security company, founded in 2012 and headquartered in Accrington, Lancashire. We assess and certify organisations against PCI DSS, PCI PIN, PCI Card Production, P2PE, 3DS and Cyber Essentials, help them achieve ISO 27001, and carry out the penetration testing those standards require. Talk to us Download company profile - PCI SSC QSA, QPA, CPSA, P2PE and 3DS - PCI SSC GEAR member 2026 to 2028 - IASME certification body Who we are ## Payment security specialists with a broader compliance practice Sovereign Secure Ltd (company no. 08334453, est. 2012, Accrington, Lancashire, UK) is a PCI SSC-approved Qualified Security Assessor (QSA), Qualified PIN Assessor (QPA), Card Production Security Assessor (CPSA), P2PE Assessor (Europe and USA) and 3DS Assessor company, a member of the PCI SSC Global Executive Assessor Roundtable 2026 to 2028, an IASME-licensed certification body for Cyber Essentials, IASME Cyber Assurance and Defence Cyber Certification Levels 0 and 1, and an ISO 27001-certified firm, with offices in Los Angeles, Singapore, Dubai and Dhaka. Payment security is at the heart of what we do. The PCI Security Standards Council approves us to assess against five of its standards: PCI DSS as a Qualified Security Assessor, PCI PIN Security as a Qualified PIN Assessor, PCI Card Production as a Card Production Security Assessor, point-to-point encryption (P2PE) as a P2PE Assessor in Europe and the USA, and 3-D Secure (3DS) as a 3DS Assessor. See our PCI DSS compliance services. Alongside PCI we issue Cyber Essentials certification and Cyber Essentials Plus as an IASME-licensed certification body, and IASME's Network Directory also lists us for IASME Cyber Assurance and MOD Defence Cyber Certification at Levels 0 and 1. We deliver ISO 27001 consultancy and support for other ISO standards, with certification audits by our partner certification body MQA International, and we provide penetration testing services and vulnerability scanning. Our clients range from banks, payment processors and card manufacturers to retailers, technology companies and UK SMEs taking their first step with Cyber Essentials. Read what our clients say. ## On time, on budget Fixed quotes, agreed plans and no surprises. We help you meet governance, risk and compliance objectives when you need to. ## Risk-based We consider the laws and regulations that apply to you, and focus effort where the risk is, to shorten projects and cut cost. ## Integrated PCI DSS, PIN, Card Production, ISO 27001 and Cyber Essentials under one roof, so evidence is reused, not duplicated. ## Independent ISO certification audits are carried out by an independent partner certification body, MQA International, and we keep advisory and assessment work properly separated. Accreditations ## Approved and accredited GEAR PCI Security Standards Council ## Member of the Global Executive Assessor Roundtable (2026 to 2028) The Global Executive Assessor Roundtable (GEAR) is a PCI Security Standards Council advisory group made up of senior executives from PCI SSC assessor companies. It acts as a direct channel between the assessor community and Council leadership on the Council's standards and programmes. Sovereign Secure is a member for the 2026 to 2028 term. The membership sits alongside our QSA, QPA, CPSA, P2PE Assessor and 3DS Assessor approvals, and you can check it on the PCI SSC website. See the GEAR members on pcisecuritystandards.org → - QSA PCI Qualified Security Assessor PCI Security Standards Council - QPA PCI Qualified PIN Assessor PCI Security Standards Council - CPSA PCI Card Production Security Assessor PCI Security Standards Council - P2PE PCI P2PE Assessor (Europe and USA) PCI Security Standards Council - 3DS PCI 3DS Assessor PCI Security Standards Council - CE / CE+ Cyber Essentials Certification Body IASME Consortium - IASME CA IASME Cyber Assurance Certification Body IASME Consortium - DCC Defence Cyber Certification, Levels 0 and 1 MOD scheme, IASME Network Directory - ISO 27001 ISO/IEC 27001 certified Certified information security management - ICO Registered with the ICO Information Commission's Office ## Verify us yourself Our PCI SSC and IASME approvals are published by the bodies that grant them, and our company record by Companies House. Search for "Sovereign Secure" on: - Companies House (company 08334453) - PCI SSC assessor listings (QSA, QPA, CPSA, P2PE Assessor, 3DS Assessor) - PCI SSC Global Executive Assessor Roundtable - IASME Network Directory (Cyber Essentials, Cyber Essentials Plus, IASME Cyber Assurance, Defence Cyber Certification Levels 0 and 1) Company facts ## Sovereign Secure at a glance The registered details buyers, procurement teams and assessors ask for. Updated October 2026. Full company facts → Legal name Sovereign Secure Limited (trading as Sovereign Secure) Company number 08334453, registered in England & Wales (Companies House record) Incorporated 18 December 2012 Head office 16 Whalley Road, Accrington, Lancashire, BB5 1AA, United Kingdom Other offices Los Angeles (US), Singapore, Dubai (UAE) and Dhaka (Bangladesh) PCI SSC approvals Qualified Security Assessor (QSA) company, Qualified PIN Assessor (QPA), Card Production Security Assessor (CPSA), P2PE Assessor (Europe and USA) and 3DS Assessor PCI SSC GEAR Member of the Global Executive Assessor Roundtable, 2026 to 2028 (PCI SSC GEAR page) IASME IASME-licensed certification body for Cyber Essentials and Cyber Essentials Plus, IASME Cyber Assurance, and MOD Defence Cyber Certification Levels 0 and 1 (listed on the IASME Network Directory) ISO ISO 27001 certified. ISO certification audits for our clients are carried out by partner certification body MQA International ASV scans Delivered through a PCI SSC Approved Scanning Vendor partner (Sovereign Secure is not itself an ASV) Data protection Registered with the Information Commission's Office (ICO) Global offices ## Local teams, global reach - Headquarters ## United Kingdom Accrington, Lancashire - ## United States Los Angeles, CA - ## Singapore Woodlands - ## United Arab Emirates Dubai - ## Bangladesh Dhaka Sovereign Secure Limited is registered in England & Wales, company number 08334453. Registered office: 16 Whalley Road, Accrington, Lancashire, BB5 1AA. Full addresses and phone numbers for every office are on our contact page. FAQ ## Questions about Sovereign Secure Where is Sovereign Secure based? + Our head office is at 16 Whalley Road, Accrington, Lancashire, BB5 1AA, United Kingdom. We also have offices in Los Angeles (US), Singapore, Dubai (UAE) and Dhaka (Bangladesh). Full addresses and phone numbers are on our contact page. Which approvals can I verify? + Our PCI SSC approvals, GEAR membership, IASME certification body status and company registration are all public. Search for "Sovereign Secure" on the PCI SSC assessor listings (QSA, QPA, CPSA, P2PE Assessor and 3DS Assessor), the PCI SSC GEAR page, IASME (Cyber Essentials, Cyber Essentials Plus, IASME Cyber Assurance and Defence Cyber Certification Levels 0 and 1) and Companies House (company 08334453). Do you issue ISO certificates? + No. ISO certificates are issued by our partner certification body, MQA International. We help you implement the standard and prepare for the audit, and Sovereign Secure is itself ISO 27001 certified. Is ASV scanning one of your PCI SSC approvals? + No. Our PCI SSC approvals are QSA, QPA, CPSA, P2PE Assessor and 3DS Assessor, and ASV scans are delivered through our PCI SSC Approved Scanning Vendor partner. See PCI ASV scanning. Where can AI assistants find verified company facts? + On our company facts page, which lists our registered details, approvals and where to verify each one. It is kept in step with this page. --- # Sovereign Secure Clients & Testimonials | PCI, ISO & CE URL: https://sovereignsecure.co.uk/our-clients/ Our clients ## Sovereign Secure clients: banks, payment companies and global brands Sovereign Secure clients include banks, payment processors, card manufacturers, retailers and UK SMEs, who work with us on PCI DSS, PCI PIN and card production assessments, Cyber Essentials certification, ISO 27001 and penetration testing. Here is who they are, and what they say about working with us. Get a free consultation Call +44 161 523 5276 Who we work with ## Sovereign Secure clients by sector Payment security is at the heart of what we do, and many of our clients take, process or produce card payments. Our Cyber Essentials, ISO and testing work extends that to organisations of every size. For the standards each sector faces, see our guide to cyber security by industry. ## Banks and financial services - Ahli United Bank - Kuwait Finance House - AYA Bank - Bank of Palestine - Cashplus - First National of Nebraska Standards organisations in this sector typically need: - PCI DSS assessments - PCI PIN security - ISO 27001 Sector guide: Cyber security and PCI compliance for banks ## Payments, PIN and card production - Fiserv - Liquid Pay - Nitecrest - Bamcard - Intelligent Card Production Systems - Level 10 Standards organisations in this sector typically need: - PCI card production audits - PCI PIN security - PCI DSS penetration testing Sector guide: Cyber security for fintech and payments firms ## Retail, hospitality and entertainment - Accor - JCPenney - Ticketmaster - Albertsons Companies Standards organisations in this sector typically need: - PCI DSS compliance services - PCI DSS consultancy - Web application penetration testing Sector guide: Cyber security for retail and e-commerce ## Technology, data and other sectors - DataFlow Group - Wilmington - The Growth Company - Wahyukart - Onesecure Asia - Specialists Hub Standards organisations in this sector typically need: - Cyber Essentials certification - ISO 27001 consultancy - Penetration testing services Sector guide: Penetration testing for SaaS companies Testimonials ## What our clients say Each testimonial is tagged with the service we delivered: PCI PIN security assessments, card production audits, ISO 27001 consultancy, Cyber Essentials and penetration testing. *]:mb-6 [&>*]:break-inside-avoid"> PCI PIN In my tenure as Principal Analyst for First National Bank of Omaha's Key Management and Cryptography program and many more years in the industry, I never realized how easy it could be to work with an assessor, nor the true value they could bring to a PIN security program until I began to work with Azie (Sovereign Secure, Ltd). Azie's knowledge and expertise is beyond reproach, and she truly stands out above and beyond in providing updates and changes in the compliance programs to her clients. Her passion and integrity are evidenced when she comes well prepared, is thorough and works efficiently, resulting in an accurate assessment. Kristi White Key Management & Cryptography, Information Security, First National of Nebraska PCI Card Production The specialist team at Sovereign Secure provided valuable support throughout our EMV certification process. They demonstrated a keen understanding of PCI production requirements and expertly steered the audit to a successful conclusion. We commend them on their innovativeness in conducting the audit of our facility remotely and the proactive nature of their services. We want to make special mention of the Security Assessor, Agnes Ng for her professionalism, efficiency and undisputed industry knowledge. Agnes and her team at Sovereign Secure were a pleasure to work with and an excellent choice for anyone looking for security consultancy and assessment in the PCI Card Production Industry. Eunice Nyadu Head of Business Development, Intelligent Card Production Systems PCI PIN Approaching our PCI PIN 3.0 audit at the start of a pandemic was an overwhelming goal filled with uncertainties ranging from, “How could we ensure the safety of our employees & auditors?” to “Could this actually be done remotely?” Our colleagues at Sovereign Secure were true partners in this successful venture. While flexing to the distinct needs of an essential business, like ours, running during a pandemic, they stayed true to the high standards required of a business to ensure the PCI PIN 3.0 certification by the use of extraordinary communication, experienced auditors, and unique documentation delivery avenues. They made what was once thought of as impossible, not only very much possible, but also a pleasurable learning & partnership experience for our payment solutions team. Courtney Stone Vice President, Customer Experience & Strategy, Level 10 PCI CPSA, DSS & PIN Sovereign Secure provided Payment Card Industry Compliance Services to Bamcard for the following standards: PCI CPSA, PCI DSS and PCI PIN. Even with the global COVID-19 pandemic, they managed to provide the best possible, knowledgeable support during the process of auditing and achieving compliance. The Sovereign Secure assessors were so helpful in these challenging times … with years of Payment Card Industry experience. We would happily recommend them to any company in need of the services mentioned. Emir Handan Executive Director, Bamcard PCI PIN I highly recommend services of Sovereign Secure through my work with Azie Amini; PCI PIN Security audits. I have known Azie for fifteen years and have nothing but positive things to say, regarding her PCI PIN services both in auditing and as a PIN security instructor. We have used her services for various payment companies that I have been employed by including Albertsons Companies. Gary Zempich Information Security Analyst IV, Albertsons Companies ISO 27001 We would like to thank Sovereign Secure on their guidance and assistance in obtaining ISO 27001:2017 for our company in both Singapore and Malaysia. Their security assessor went the extra mile to ensure that our processes were documented and that we were prepared for our external assessment. We are satisfied with the quality of work delivered by Sovereign Secure and would happily recommend them to any company that requires consultancy and guidance in obtaining their ISO 27001 certification. Edmund How Managing Director, Onesecure Asia Cyber Essentials & Pen Testing Engaged Sovereign Secure for Penetration Testing and Cyber Essentials and received a professional and friendly service. The Cyber Security Services were delivered on time and price was competitive. I would highly recommend the team at Sovereign Secure … to any organisation. Beverley McGowan Director, Specialists Hub Certified clients ## Check a certificate we issued Cyber Essentials and Cyber Essentials Plus certificates issued by Sovereign Secure can be checked on the official IASME certificate search. PCI DSS has no single public register of compliant merchants, so ask the organisation for its Attestation of Compliance and check which QSA company signed it. Verify a certificate Already a client? ## Show your certification Certified clients can add a "Certified by Sovereign Secure" link to their website so customers and procurement teams can see who assessed them. Ask us for the snippet, or tell us if you would like to be listed on our certified clients page. Want to know who you would be working with? Read about Sovereign Secure and our PCI SSC and IASME approvals, or check our company facts at a glance. --- # AI Red Teaming and LLM Penetration Testing UK URL: https://sovereignsecure.co.uk/ai-llm-penetration-testing/ Penetration Testing ## AI & LLM Penetration Testing and AI Red Teaming AI red teaming is manual, adversarial testing of your AI and large language model applications, from chatbots and copilots to RAG search and agents that call tools. We test for prompt injection, data leakage, jailbreaks and excessive agency against the OWASP Top 10 for LLM Applications and, as an ISO 27001-certified firm, handle your prompts and data securely. Scope your test Pen testing cost - OWASP Top 10 for LLM Applications - Prompt injection, jailbreaks and data leakage - Agent and tool-use testing Overview ## What is AI red teaming? The short answer AI red teaming, or LLM penetration testing, is adversarial testing of an AI-enabled application to find what it can be made to say, reveal or do. It covers prompt injection, jailbreaks, data leakage, unsafe output handling and excessive agency, tested against the OWASP Top 10 for LLM Applications, plus the web and API layer around the model. AI red teaming, also called AI or LLM penetration testing, means attacking an AI-enabled application the way a real adversary would, to find out what it can be made to say, reveal or do. This is testing of your AI and LLM applications. It is different from an “AI-powered” penetration testing tool, which uses AI to scan conventional systems. AI and LLM applications introduce risks that traditional testing does not cover. A model can be manipulated through crafted input, tricked into revealing data it should protect, or, when connected to tools and data, driven into taking actions it should not. Our AI security testing covers these specific weaknesses alongside the conventional flaws in the surrounding application. Our coverage follows the 2026 OWASP Top 10 for LLM Applications, from prompt injection (LLM01) and sensitive information disclosure (LLM02) to excessive agency (LLM03), unbounded consumption (LLM06) and hidden context exposure (LLM08), formerly system prompt leakage. Our OWASP LLM Top 10 glossary entry explains each risk in plain English, and the groups below show how each one maps to what we test. Because an LLM feature is still part of a wider application, we test the web application and API layer around it too. For objective-led exercises that combine AI and conventional attack paths, see our red team assessments. Findings support ISO 27001 evidence, as set out on our ISO 27001 penetration testing page. New to testing? Our guides to what penetration testing is and the types of penetration testing show where this test fits. ## Standards & frameworks - OWASP Top 10 for LLM (2026) - OWASP Top 10 - NIST AI RMF - ISO 27001 A.8.8 - ISO 27001 A.8.29 - PTES ## What you receive - Executive summary for non-technical stakeholders - Technical findings with reproduction steps and examples - Coverage record against the OWASP Top 10 for LLM Applications - Risk ratings and prioritised remediation guidance - Retest of remediated findings and an updated report - Attestation letter for auditors and customers What's included ## LLM security testing: what's included An AI engagement covers the model, its integrations and the application around it. - 01 ## Prompt injection testing Direct and indirect prompt injection attempts to bypass instructions, guardrails and safety controls. - 02 ## Data leakage testing Attempts to extract sensitive data, system prompts, training data or context the model should not reveal. - 03 ## Output handling review Assessment of how model output is used downstream, where unsafe handling can lead to injection or code execution. - 04 ## Agent and tool-use testing Testing of models connected to tools, functions and data sources for unsafe or excessive actions. - 05 ## Authorisation and access checks Verification that the AI feature respects the same access controls as the rest of the application. - 06 ## Guardrail and abuse testing Testing of content filters and safety controls, and of how the system resists misuse. - 07 ## Surrounding application testing The web and API layer around the AI feature, tested for conventional vulnerabilities. - 08 ## Retest A retest of remediated findings, scoped in your fixed-price proposal, with the report updated to show them closed. What we test for ## AI penetration testing: what we test for Each group shows the risks it covers from the OWASP Top 10 for LLM Applications (2026), the list our LLM Top 10 glossary entry summarises. ## Prompt injection and jailbreaks (LLM01) Crafted input that overrides intended instructions and controls. - Direct prompt injection - Indirect injection via retrieved content - Jailbreaks and guardrail bypass - Instruction and role confusion - Injection through files, images and web pages ## Sensitive information and hidden context exposure (LLM02, LLM08) Extraction of data and instructions the model should keep protected. - Hidden context exposure: system prompts, tool definitions and instructions - Disclosure of confidential context - Extraction of connected data sources - Leakage of other users’ data - Secrets embedded in prompts ## Excessive agency and tool use (LLM03) Models connected to tools and actions with too much freedom. - Unsafe function and tool invocation - Actions beyond the intended scope - Insufficient human oversight of actions - Over-broad permissions granted to the model - Chaining of tools towards harmful outcomes ## Supply chain, data and model poisoning (LLM04, LLM05) Risks in the data, components and services the system depends on. - Training and retrieval data poisoning - Vulnerable model or plugin components - Insecure third-party model services - Untrusted content added to knowledge bases - Model and dependency provenance ## Resource abuse, misinformation and vector stores (LLM06, LLM07, LLM09) Weaknesses in cost controls, answer reliability and retrieval. - Unbounded token and request consumption - Denial-of-wallet exposure - Confidently wrong answers in high-risk flows - Cross-tenant leakage through embeddings - Access control on vector databases ## Improper output handling (LLM10) Model output trusted downstream without proper handling. - Cross-site scripting via generated output - Injection into downstream systems - Code or command execution from output - Unsafe rendering of model responses - Missing validation of generated content ## Surrounding application The conventional application around the AI feature. - Authentication and authorisation flaws - API vulnerabilities behind the feature - Injection in the wider application - Insecure configuration and secrets - Rate limiting and abuse controls ## AI red teaming vs AI penetration testing vs LLM red teaming The three terms overlap, and providers use them loosely. The useful distinction is between testing what a model can be made to do and testing the whole application that uses it. Term | What it usually means | Typical focus AI red teaming | Adversarial testing of an AI system’s behaviour, trying to make it break its rules | Jailbreaks, harmful or misleading output, misuse and safety controls AI penetration testing | A scoped security test of an AI-enabled application, run and reported like any other penetration test | Prompt injection, data leakage, unsafe output handling, agents and tools, plus the surrounding web and API layer LLM red teaming | AI red teaming aimed specifically at large language models and the applications built on them | Prompt injection, system prompt leakage, jailbreaks and data extraction Our engagements cover the security side of all three: what the model can be made to reveal or do, and the conventional application it sits in. ## Which frameworks guide AI red teaming? Three public frameworks shape most AI red teaming work. None is a test method on its own, so each does a different job: one lists the risks to test, one describes how attackers behave, and one turns the results into managed risk. Framework | What it is | How it is used in AI red teaming OWASP Top 10 for LLM Applications (2026) | A ranked list of the ten most important security risks in applications built on large language models, from prompt injection (LLM01) to improper output handling (LLM10) | The checklist for test coverage, and the reference each finding is reported against MITRE ATLAS | A public knowledge base of the tactics and techniques used against AI systems, drawn from real incidents and research and modelled on MITRE ATT&CK | A source of realistic attack scenarios when planning tests, and a shared vocabulary for describing them NIST AI Risk Management Framework | A voluntary framework for managing AI risk through four functions (Govern, Map, Measure and Manage), with a Generative AI Profile that calls for pre-deployment testing | Placing red team findings in the Measure function as evidence, and feeding the fixes into Manage AI pen testing covers the application around the model as well as the model itself, so the conventional OWASP Top 10 and the OWASP API Security Top 10 still apply to the web and API layer. ## What does an AI security assessment cover beyond the model? Many of the most serious AI weaknesses sit around the model rather than in it: in what it is connected to, what data it can reach and how its output is used. An AI security assessment therefore looks at the whole system. Area | What is checked Retrieval (RAG) and vector stores | Whether users can retrieve documents they should not see, and whether planted content can steer answers Tools, plugins and agents | What actions the model can trigger, with whose permissions, and whether approval steps hold Identity and access | Whether the AI feature enforces the same access controls as the rest of the application Output handling | Whether generated text, code or links are rendered or executed safely downstream Third-party model services | What data is sent to external model providers, and how keys and settings are protected Logging, rate limits and cost controls | Whether misuse is noticed, and whether request floods could run up cost or deny service The surrounding application | The web front end and APIs behind the feature, tested like any other application ## Testing agents, tools and MCP servers When a model can call tools, the question changes from what it might say to what it might do. We test whether an agent can be driven, through direct instructions or content it reads, to call tools outside its intended scope, use permissions broader than the task needs, or skip a human approval step. Many agents now reach tools through the Model Context Protocol (MCP). Testing covers the servers an agent connects to: the permissions and tokens they hold, tool descriptions and results that could carry injected instructions, and server packages from untrusted sources. Our guides to agentic AI security and MCP security set out the threat models in more detail. ## Prompt injection testing Prompt injection is input crafted to make a model ignore its instructions. Direct injection comes from the user; indirect injection hides in content the model reads, such as a web page, an email, a document or a tool result. There is no complete fix, so testing checks two things: how easily the model can be steered, and how much damage a successful injection could do with the data, tools and permissions the model has. The second answer usually shapes the fix: least privilege, careful output handling and human approval for sensitive actions. How it works ## How is an AI penetration test carried out? - 1 ## Scoping We agree the AI feature, its integrations, the data it can reach and the surrounding application, and fix the price. - 2 ## Understanding We map how the model is used, what it connects to, and where its input and output flow. - 3 ## Testing Manual testing for prompt injection, data leakage, unsafe output and excessive agency, plus the conventional application layer. Testers commonly use open-source tools such as PyRIT and garak to send large sets of attack prompts, then confirm and extend each result by hand. - 4 ## Reporting An executive summary and technical report with reproduction steps, ratings and remediation advice. - 5 ## Debrief A walkthrough with your team covering the findings, the risk and the fixes. - 6 ## Retest Once remediated, we retest and reissue the report showing findings closed. Every test follows the five stages of penetration testing: planning and reconnaissance, scanning, gaining access, maintaining access, and analysis and reporting. Why Sovereign Secure ## Why choose Sovereign Secure for AI and LLM penetration testing? Established in 2012, we deliver PCI, ISO and Cyber Essentials work for banks, payment processors, card manufacturers and fast-growing companies. Read client testimonials → - Testing aligned to the OWASP Top 10 for LLM Applications, the recognised framework for this domain. - Coverage of the AI-specific attack surface and the conventional application around it. - Manual testing that reflects how these systems are actually attacked. - Fixed scope and price, with any retest and its window agreed in your proposal. FAQ ## Frequently asked questions Why do AI and LLM applications need their own testing? + They introduce risks that conventional testing does not cover, such as prompt injection, data leakage through the model, and unsafe actions when a model is connected to tools. These need to be tested alongside the usual application vulnerabilities, using techniques suited to how AI systems fail. What is prompt injection? + Crafted input that makes a model ignore its instructions or safety controls; our prompt injection glossary entry explains direct and indirect attacks, and prompt injection testing is a core part of every AI engagement we run. Do you test AI agents that can take actions? + Yes. Where a model is connected to tools, functions or data, we test for excessive agency: whether it can be driven to take actions beyond its intended scope, and whether human oversight and permissions are adequate. Our agentic AI security page sets out the agent threat model in more detail. What do you need from us for an AI or LLM penetration test? + Access to the AI feature, details of the model and how it is integrated, what data and tools it can reach, and test accounts. Documentation of the system prompts and guardrails helps us test thoroughly. We confirm the detail during scoping. Do you test the application around the AI feature too? + Yes. An AI feature is part of a wider application, so we test the surrounding web and API layer for conventional vulnerabilities as well as the AI-specific risks. How do you test LLM security? + We map how the model is used, what it can reach and where its input and output flow (a short threat modelling exercise), then test by hand against the OWASP Top 10 for LLM Applications: prompt injection and jailbreaks, sensitive data and hidden context exposure such as system prompts, unsafe output handling and excessive agency. We also test the web and API layer around the model, and report each finding with reproduction steps and a fix. Does this support ISO 27001 and AI governance? + Yes. Testing supports ISO 27001:2022 Annex A 8.8 and 8.29 and aligns with AI risk frameworks such as the NIST AI Risk Management Framework, giving you evidence that AI features have been assessed. The report can also serve as evidence for an AI management system under ISO 42001, and for the robustness and cybersecurity testing the EU AI Act expects of high-risk AI systems. Our AI governance guide explains where that evidence fits in a wider programme. Is AI red teaming the same as an AI-powered penetration test? + No. An AI-powered penetration test uses AI tools to test ordinary systems. AI red teaming tests the AI system itself: whether your chatbot, copilot or agent can be manipulated, made to leak data or pushed into unsafe actions. We do the second, by hand. How much does AI and LLM penetration testing cost? + The price depends on how many AI features are in scope, what data and tools each can reach, whether agents can take actions, and how much of the surrounding web and API layer we test. Our penetration testing cost guide explains the drivers, and our AI penetration testing quote form returns a fixed price. Last reviewed October 2026 by the Sovereign Secure assessment team. --- # Sovereign Secure Certificate Verification & Client Badges URL: https://sovereignsecure.co.uk/certified-clients/ Certified clients ## Sovereign Secure Certificate Verification and Certified Clients Sovereign Secure certificate verification in one place: how to check a Cyber Essentials, Cyber Essentials Plus, IASME or PCI DSS credential we issued, and how our certified clients can show theirs on their own website. Request your badge snippet Contact us - IASME-licensed Cyber Essentials certification body - PCI SSC QSA, QPA and CPSA company - Badge snippet on request for certified clients The short answer Cyber Essentials and Cyber Essentials Plus certificates issued by Sovereign Secure are listed on the free IASME certificate search, which covers every certificate issued in the last 12 months. PCI DSS has no public register: ask the organisation for its Attestation of Compliance, check that Sovereign Secure is named as the assessor, then email us to confirm it. Sovereign Secure certificate verification depends on what you have been shown. A Cyber Essentials or Cyber Essentials Plus certificate we issued is listed on the IASME certificate search, the official search for the NCSC scheme, so you can check it yourself for free without contacting us. PCI DSS, PCI PIN and card production results are confidential and have no public register, so you verify them from the Attestation of Compliance (AOC) and a short email to us. We do not run a separate register of our own. The official sources below are the ones a procurement team should rely on, and this page shows you how to read them. It is also the home of our badge programme for certified clients. ## How does Sovereign Secure certificate verification work? Find the document you hold in the table, then follow the matching section below. Each credential has a different issuer and a different place to check it. What you have been shown | Who issues it | Public register? | How to verify it Cyber Essentials certificate | Sovereign Secure, as an IASME-licensed certification body | Yes: IASME certificate search | Search the organisation’s name for the level and dates; read the scope and certification body on the certificate Cyber Essentials Plus certificate | Sovereign Secure, after a hands-on technical audit | Yes: the same search, shown as Plus | As above, and confirm the level says Plus IASME Cyber Assurance or Defence Cyber Certification certificate | Sovereign Secure, as an IASME-licensed certification body (Defence Cyber Certification Levels 0 and 1 only) | Yes: IASME runs a separate certificate search for each scheme | Use the IASME Cyber Assurance search or the Defence Cyber Certification search, then compare with the certificate PCI DSS Attestation of Compliance | The assessed organisation, signed by our lead QSA where we performed the assessment | No: the PCI SSC keeps no register of compliant companies | Ask for the AOC, check the assessor and date, then email us PCI PIN or card production assessment | Sovereign Secure as a QPA or CPSA company, reported to the payment brands | No | Ask the organisation, then email us ISO 27001, 9001 or other ISO certificate | MQA International, our partner certification body | Held by the certification body | Contact MQA International with the certificate number Penetration test | A report, not a certificate | No | Ask for the report or its summary, then email us ## How do I verify a Cyber Essentials certificate issued by Sovereign Secure? Search the organisation’s name on the IASME certificate search and read the result. It should show a certificate issued within the last 12 months with the correct level. The search result does not name the certification body or the scope, so check those on the certificate itself, which names Sovereign Secure for certificates we issued. The search is free and needs no account. - Open the certificate search. The NCSC directs people to it on IASME’s website, because IASME delivers the scheme for the NCSC. - Enter the organisation’s name. Try its registered name from Companies House as well as any trading name. - Read the matching result: company name, certificate reference, certificate level, certification date and expiry date. - Compare it with the certificate the supplier gave you, which also shows the scope and the certification body, using the table below. - If anything does not match, or the organisation is not listed, email us before you rely on it. Field | What good looks like | Red flag Organisation name | The legal entity you contract with | A parent, sister or trading company you do not contract with Level | Cyber Essentials Plus, if your contract or tender asks for Plus | Only basic Cyber Essentials when Plus was claimed Issue date | Within the last 12 months | Older than 12 months: the certificate has expired Scope | Whole organisation, or a described scope that covers the service you buy | A scope limited to a part of the business you do not use Certification body | Sovereign Secure, for certificates we issued | Another body: verify with them instead Certificate number | The same as on the digital certificate or PDF you were sent | Different, or the supplier cannot provide one IASME asks that the search is used only to check certification, not for marketing or data research. Organisations checking many suppliers can register for the IASME Supplier Assurance Tool, a free platform for checking certification across a supply chain. For a screen-by-screen walkthrough, see our guide on how to check a Cyber Essentials certificate, and for what the higher level involves, see Cyber Essentials Plus. ## Why can’t I find a certified organisation in the search? Usually because the certificate has expired, the organisation is certified under a different name, or another certification body issued it. The common causes are: - Expired. The search only covers certificates issued in the last 12 months. A lapsed supplier needs to renew its Cyber Essentials certificate before it counts again. - Different name. The certificate is issued to the legal entity in scope, which may be a parent company or a registered name that differs from the brand you know. - Different certification body. If the certificate names another body, ask that body to confirm it. We can only confirm certificates we issued. - Not certified. Wording such as “working towards Cyber Essentials” or “Cyber Essentials compliant” is not certification. Only a certificate from a licensed certification body counts. If you still cannot find it, email contactus@sovereignsecure.co.uk with the organisation’s name and the certificate number. We will tell you whether we issued it and whether it is current. ## How are PCI DSS Attestations of Compliance verified? Ask the organisation for its current AOC, check that Sovereign Secure is named as the assessor and that the assessment is less than 12 months old, then email us to confirm it. The PCI Security Standards Council does not certify merchants or service providers and publishes no list of compliant companies, so the AOC is the evidence. The full Report on Compliance (ROC) is confidential and normally stays between the organisation, its acquirer and the payment brands. The AOC is the summary designed to be shared with customers and partners, often under a non-disclosure agreement. Check | Where to look | Why it matters Assessed entity | Contact details in Part 1 of the AOC | It must be the company you contract with Assessor | Assessor details in Part 1 | For assessments we performed, it names Sovereign Secure Ltd and the lead QSA Assessor status | The PCI SSC list of Qualified Security Assessor companies and its professionals lookup | Confirms the company and the individual assessor were qualified Validation route | Whether the AOC follows a ROC or a self-assessment questionnaire (SAQ) | An SAQ is the organisation’s own self-assessment, even where a QSA advised; a ROC records a full assessment Services covered | The executive summary in Part 2 | The services you buy must be inside the assessed scope Result and date | The validation and signatures in Part 3 | It should say “Compliant” and be dated within the last 12 months PCI DSS compliance is revalidated every year, so an older AOC is out of date. Service providers may also appear on Visa’s Global Registry of Service Providers or Mastercard’s list of compliant service providers, but those listings run through the card brands’ own programmes, so absence from them does not prove non-compliance. Treat a “PCI certificate” on its own with care. It is not a PCI SSC document and does not replace the AOC. The same principle applies to our PCI PIN security audits and card production audits as a QPA and CPSA company: results go to the payment brands, not to a public register. Read more about our PCI DSS assessments. ## How do I add the “Certified by Sovereign Secure” badge to my website? Ask us for your badge snippet once your certificate is issued. It pairs the official Cyber Essentials or Cyber Essentials Plus digital badge from your IASME digital certificate with a short “Certified by Sovereign Secure” text link, so visitors can see who certified you and how to check it. IASME issues certificates digitally, and certified organisations receive a digital Cyber Essentials badge to display on their website. We do not host, copy or alter the Cyber Essentials marks: you embed the badge exactly as IASME provides it and follow IASME’s branding guidelines. The official rules for the marks are covered in our guide to the Cyber Essentials logo; this section covers only our own snippet. Our snippet adds one plain text line beneath it, for example “Cyber Essentials Plus certified by Sovereign Secure, an IASME-licensed certification body”, linking to our Cyber Essentials certification page or to this verification page. Where | What to show Website footer | The IASME badge and the text line, on every page Security or trust page | Badge, text line, certificate number and renewal month Tender and supplier portals | Certificate number and a link to the IASME search Email signature | The IASME digital badge only A few rules keep the badge credible: - Show the level you hold. Never display the Plus badge with a basic certificate. - Do not redraw, recolour or crop the Cyber Essentials marks, or take them from another website. - Do not imply the certificate covers more than its scope. - Remove the text line if your certificate lapses, and renew before expiry to keep both. To request the snippet, email contactus@sovereignsecure.co.uk with your organisation’s name and certificate number, or use the form below. It is available on request to organisations we have certified. ## Can PCI clients say they were assessed by Sovereign Secure? Yes, if you hold a current, compliant AOC from an assessment we performed and you want to say so. We supply a plain-text line such as “PCI DSS assessed by Sovereign Secure, a PCI SSC Qualified Security Assessor company”. - Never use the PCI SSC logo, and never say the Council itself certified you. - Name the standard and version you were assessed against. - Remove the line if your AOC is more than 12 months old and has not been revalidated. - We check the wording with you against the PCI SSC’s rules on use of its name and marks before you publish. ## Can my organisation be listed on this page? Yes, if you want to be. Listing is opt-in: tell us when you request your badge snippet, and we will only add your name and a link to your website once you have agreed in writing. The organisations we already name, from banks to card manufacturers, are on our clients page. ## Why Sovereign Secure You can check our own credentials the same way we ask you to check a supplier’s: at the source. Credential | Where to check it IASME-licensed certification body for Cyber Essentials, Cyber Essentials Plus, IASME Cyber Assurance and Defence Cyber Certification Levels 0 and 1 | IASME’s Network Directory PCI SSC Qualified Security Assessor (QSA), Qualified PIN Assessor (QPA) and Card Production Security Assessor (CPSA) company, P2PE Assessor (Europe and USA) and 3DS Assessor | PCI SSC assessor listings Member of the PCI SSC Global Executive Assessor Roundtable (GEAR) 2026-2028 | The GEAR page on pcisecuritystandards.org Sovereign Secure Limited, company no. 08334453, incorporated 18 December 2012 | Companies House ISO 27001 certified and ICO registered | Our certificate on request; the ICO register We are headquartered at 16 Whalley Road, Accrington, Lancashire, with offices in Los Angeles, Singapore, Dubai and Dhaka; our company facts page lists these details and our accreditations in one place. ISO certification audits for our consultancy clients are carried out by our partner certification body, MQA International. If you hold an ISO certificate, our guide to the ISO 27001 logo rules explains which marks and wording you can use. ## What to do next Already certified by us? Email your certificate number to request your badge snippet. Checking a supplier and stuck? Send us the organisation’s name and certificate number. Need certifying yourself? See our Cyber Essentials packages and prices, call +44 161 523 5276 or use the form below. Last reviewed October 2026 by the Sovereign Secure assessment team. div]:shrink-0 xl:[&>nav]:min-h-0 xl:[&>nav]:overflow-y-auto"> FAQ ## Frequently asked questions Does Sovereign Secure keep its own certificate register? + No. Cyber Essentials and Cyber Essentials Plus certificates appear on the official IASME certificate search, and PCI results are confidential to the assessed organisation, so we point you to the official source rather than a copy of it. How long does a certificate we issued stay on the IASME search? + Twelve months from the issue date, for both Cyber Essentials and Cyber Essentials Plus, after which it drops off the search unless it has been renewed. Plus must be completed within three months of the basic certificate. Our guide to the Cyber Essentials certificate check explains what the search shows. Can you confirm a certificate for me by email? + Yes. Email contactus@sovereignsecure.co.uk with the organisation's name and the certificate number, and we will tell you whether we issued it and whether it is current. Is a PCI certificate the same as an Attestation of Compliance? + No. The PCI Security Standards Council does not certify merchants or service providers, so any certificate is an assessor's courtesy document. The AOC is the official evidence of a PCI DSS assessment. Who issues the ISO certificate if Sovereign Secure is our consultant? + MQA International, our partner certification body, carries out the certification audit and issues the certificate, so verify ISO certificates with them. See our ISO 27001 consultancy page for how the two roles fit together. Can we use the Cyber Essentials logo on our website? + Yes, once you are certified; our guide to the Cyber Essentials logo explains where the badge comes from and the rules for using it. What happens to our Sovereign Secure badge when the certificate expires? + Your certificate drops out of the IASME search 12 months after issue, so remove the "Certified by Sovereign Secure" line and any static copy of the Cyber Essentials badge when it expires; the embedded IASME badge disappears by itself. Renewing before expiry lets you keep both in place. Does a parent company's certificate cover its subsidiaries? + Only if the subsidiary is inside the certificate's scope. The IASME search does not show scope, so ask for the certificate itself and read its scope before you rely on it. --- # Contact Sovereign Secure | Free Consultation & Fixed Quotes URL: https://sovereignsecure.co.uk/contact-us/ Let's talk ## Contact Sovereign Secure Contact Sovereign Secure by phone, email or the form below, and tell us what you need and when you need it. We aim to reply within one working day, and we send a fixed quote once your scope is confirmed. Prefer to talk? Call +44 161 523 5276. Free consultation Call +44 161 523 5276 Email contactus@sovereignsecure.co.uk Head office Sovereign Secure Ltd 16 Whalley Road Accrington, Lancashire BB5 1AA, United Kingdom Based in Lancashire? Read about our Accrington office. Registered in England & Wales, company no. 08334453 Follow us on LinkedIn → Approvals you can verify - QSA - QPA - CPSA - P2PE - 3DS - GEAR 2026 to 2028 - IASME CB - ISO 27001 “We would happily recommend them to any company in need of the services mentioned.” Emir Handan, Executive Director, Bamcard. Read the full testimonial Preparing for PCI DSS? Take the free PCI compliance check or estimate your costs with the PCI DSS cost estimator. Need a Cyber Essentials or CE+ quote? Complete our scoping questionnaire and we send a fixed quote once your scope is confirmed. Or see our published Cyber Essentials prices. Scoping a penetration test? Choose your test types and asset counts with our penetration testing quote tool and we will send a fixed-price proposal. Starting ISO 27001? Get the ISO 27001 checklist. What happens next ## What happens after you enquire? We aim to reply within one working day, and we send a fixed quote once your scope is confirmed. No work starts until you have that quote. - 1 We aim to reply within one working day An assessor or consultant reads your enquiry and replies by email or phone with next steps and any questions about scope. - 2 Free consultation A short call to confirm which standard you need, what is in scope and your deadline. - 3 Fixed quote Once your scope is confirmed, we send the scope, timeline and fixed price in writing. No day-rate surprises. - 4 Kick-off Cyber Essentials can start as soon as you are ready to submit. For PCI, ISO and penetration testing we agree the start date with you in the quote. Response times ## How long does each step take? What you send | What you get | When Contact form, email or phone enquiry | A reply with next steps | We aim to reply within one working day Cyber Essentials or CE+ scoping questionnaire | A reply about your scope, then a fixed quote | We aim to reply within one working day, and send a fixed quote once your scope is confirmed Cyber Essentials submission (after you order) | Your answers assessed | Gold 24 hours, Silver 48 hours, Bronze 3 to 5 working days Signed quote for PCI DSS, ISO or testing work | Project kick-off | On the start date agreed in your quote Penetration tests are timed around your systems and change windows, so we agree dates on the scoping call. Working days are Monday to Friday, excluding UK bank holidays. Not sure what to ask for? ## Which service do I need? Pick the line that matches your situation. If none fits, choose "Something else" on the form and describe what your customer, acquirer or regulator has asked for. - You are not sure whether you are PCI compliant Free PCI compliance check → - You take card payments and your acquirer or bank asks for PCI DSS compliance PCI DSS compliance services → - You need a Report on Compliance, or a Self-Assessment Questionnaire signed by a QSA PCI DSS assessments → - You handle PINs, cryptographic keys or key injection for payment terminals or ATMs PCI PIN security assessments → - You manufacture, personalise or provision payment cards PCI card production audits → - A UK government contract or a customer asks for Cyber Essentials Cyber Essentials certification (from £320 + VAT) → - A customer wants your controls independently tested, not just self-assessed Cyber Essentials Plus → - Enterprise or international customers ask for ISO 27001 ISO 27001 consultancy → - You need an application, network or cloud tested, or a pen test for PCI DSS 11.4 Penetration testing quote → Preparing for Cyber Essentials for the first time? Try the free Cyber Essentials readiness check before you enquire. FAQ ## Contact questions How quickly will you reply? + We aim to reply within one working day, whether you contact us by form, email or phone. If you complete the Cyber Essentials scoping questionnaire, an assessor reviews your answers and we send a fixed quote once your scope is confirmed. Is the first consultation free? + Yes. The first consultation is free. We use it to confirm the right standard, scope and route to compliance before you commit to anything. Can I get a price without a call? + For Cyber Essentials, yes: packages start at £320 + VAT and every price is published on our Cyber Essentials cost page. Cyber Essentials Plus, PCI DSS, ISO and penetration testing are quoted on scope, so we ask a few questions first and then send a fixed price. What should I include in my enquiry? + The standard you have been asked for and who asked for it, your number of employees and sites, the systems or card channels in scope, any current certificate or Attestation of Compliance and its expiry date, and your deadline. Rough numbers are fine. Do you work with organisations outside the UK? + Yes. We are headquartered in Accrington, Lancashire, with offices in Los Angeles, Singapore, Dubai and Dhaka, and we deliver PCI and ISO work internationally. Cyber Essentials is a UK scheme but is open to organisations anywhere. Who will I be dealing with? + Sovereign Secure Ltd, company number 08334453, a PCI SSC-approved QSA, QPA, CPSA, P2PE and 3DS assessor company and an IASME-licensed Cyber Essentials certification body. See about Sovereign Secure for our approvals and how to verify them. Our global offices ## Find and contact Sovereign Secure Our head office and registered office is at 16 Whalley Road, Accrington, Lancashire, BB5 1AA. We also have offices in Los Angeles, Singapore, Dubai and Dhaka. Call the office nearest you, or use the main UK number, +44 161 523 5276, for any service. - Headquarters ## United Kingdom 16 Whalley Road Accrington, Lancashire, BB5 1AA +44 161 523 5276 - ## United States 1250 S. Beverly Glen Blvd, Ste 401 Los Angeles, CA 90024 +1 310 892 9654 - ## Singapore No. 280 Woodlands Industrial Park E5 #09-48, Harvest@Woodlands, Singapore 757322 +65 9017 1511 - ## United Arab Emirates Office 409, Business Center 1 Arjan, Dubai +971 50 501 1025 PCI PIN assessments in Dubai and the UAE - ## Bangladesh 383, Road 28, New DOHS Mohakhali Dhaka-1206 +880 1817 141836 Company details and where to verify our approvals: company facts. --- # Cyber Essentials Assessor: Choose Your Certification Body URL: https://sovereignsecure.co.uk/cyber-essentials-assessor/ IASME-licensed certification body ## Cyber Essentials Assessors: Choosing a Certification Body and Meeting Your Assessor You don't book a Cyber Essentials assessor directly: you choose a certification body, and its assessors mark your answers and audit your systems. Here is how to choose one, and what you get when you choose us. Start your assessment Free readiness check - IASME-licensed for Cyber Essentials and CE+ - Gold submissions marked within one working day - CE+ audits remote or on site The short answer A Cyber Essentials assessor works for an IASME-licensed certification body and marks your self-assessment or, for Cyber Essentials Plus, audits your devices and accounts. You choose the certification body. Sovereign Secure is one: packages start at £320 + VAT, Gold submissions are marked within one working day, and CE+ audits run remotely or on site. A Cyber Essentials assessor is the person at a certification body licensed by IASME who decides whether you meet the scheme’s requirements. For basic Cyber Essentials they mark your answers; for Cyber Essentials Plus they also test a sample of your devices and accounts. You can’t hire an assessor on their own: you choose a certification body, and its assessors do the work. Sovereign Secure is an IASME-licensed certification body. Our packages start at £320 + VAT, Gold submissions are marked within one working day, and we run Cyber Essentials Plus audits remotely or on site. ## Who are Cyber Essentials assessors? Every IASME Cyber Essentials assessor works for a certification body licensed by IASME, which delivers the scheme on behalf of the NCSC. Only a licensed certification body can assess your submission and issue a Cyber Essentials or Cyber Essentials Plus certificate. Consultants, IT providers and resellers can help you prepare or sell you a package, but the certificate always comes from a certification body. That gives you two quick checks before you buy: - Who will assess us and issue the certificate? If a website sells Cyber Essentials, ask which certification body will do the assessment. With us there is no reseller in between: we assess your submission and issue your Cyber Essentials certification ourselves. - Is the body licensed for what we need? Not every certification body delivers Cyber Essentials Plus, so confirm that it covers the audited level if a contract asks for it. ## How do I choose a Cyber Essentials certification body? Every certification body applies the same NCSC requirements, so the standard you are marked against does not change from one to the next. What changes is speed, support, resubmission terms and how Cyber Essentials Plus is delivered. Compare them on these points: What to check | Why it matters | Sovereign Secure IASME licence | Only licensed bodies can assess you and issue certificates | IASME-licensed for Cyber Essentials and Cyber Essentials Plus Published prices | The basic fee follows IASME’s published bands, but extras vary | Packages from £320 to £750 + VAT, published in full Marking time | Decides how fast you can meet a contract deadline | 1 working day (Gold), 2 (Silver), 3 to 5 (Bronze) Resubmissions | Decide what happens if an answer fails | 1, 3 or unlimited by package; extras £100 + VAT Help before you submit | Catches failing answers before they are marked | Pre-assessment check and a support call of up to an hour in every package Cyber Essentials Plus delivery | Remote audits cut travel and disruption for multi-site and home-working teams | Remote audits as standard, on site when remote access is not practical Cyber Essentials Plus retests | Failed tests must be fixed and retested within 30 days | Free remote retest of up to an hour within a month, otherwise from £400 + VAT Wider security work | Tenders and customers often ask for more than Cyber Essentials | PCI DSS, ISO 27001 and penetration testing from the same company IASME publishes the basic assessment fee for each organisation size in its Cyber Essentials FAQs: £320 for 0 to 9 employees, £440 for 10 to 49, £500 for 50 to 249 and £600 for 250 or more, all + VAT. Our Bronze packages match those bands, and Silver and Gold add faster marking and more resubmissions. The full price table is on our Cyber Essentials cost page. ## Who is the Cyber Essentials Plus assessor? Your Cyber Essentials Plus assessor comes from a certification body licensed for the audited level, and the audit starts once you hold a basic Cyber Essentials certificate. Because the audit must be completed within three months of that certificate, using one certification body for both stages keeps the timetable in one set of hands. With us, the basic assessment is included in every Cyber Essentials Plus quote, and one team plans the audit date, the device sample and any retest. Most of our audits are remote: your IT lead or managed service provider shares the screen of each sample device and runs a scanning tool we provide. We audit on site when remote access is not practical, anywhere in the UK, as our page on Cyber Essentials Plus in London explains for London offices. To price an audit, use our Cyber Essentials Plus quote request. ## How quickly can we be certified? Basic Cyber Essentials can be certified within days of submission; most of the time goes on preparing answers and closing gaps first. Once you submit, marking time depends on your package: Package | Marking time | Resubmissions included | Time to pass after first clarification Bronze | 3 to 5 working days | 1 | 10 working days Silver | 2 working days | 3 | 1 month Gold | 1 working day | Unlimited | 3 months Each extra resubmission beyond your package limit costs £100 + VAT. For Cyber Essentials Plus, allow a few weeks. The asset declaration is due at least two weeks before the audit and the basic assessment at least one week before, and most small organisations finish the audit itself in a day. If a customer deadline is close, give us the date when you order so we can plan around it. ## Who will assess you at Sovereign Secure? Assessors working under Sovereign Secure’s IASME licence mark your answers and carry out your Cyber Essentials Plus audit. The support call in each package is also with an assessor, so questions about scope, MFA on cloud services, unsupported software or home workers are answered by the people who assess against the requirements, not by a sales team. Our assessors work inside a wider security company. Sovereign Secure is a PCI SSC Qualified Security Assessor (QSA) company, a member of the PCI SSC Global Executive Assessor Roundtable for 2026 to 2028, ISO 27001 certified and a penetration testing provider. When a customer asks for more than Cyber Essentials, you don’t need to start again with a new supplier. ## What happens after you submit? Your assessor marks each answer against the NCSC requirements, asks for clarification where an answer is unclear, then either issues your certificate or explains what failed so you can fix it and resubmit. Our guide to the Cyber Essentials assessment walks through each step from the assessor’s side. ## Can the same company advise and assess you? Within limits. IASME’s independence rules for certification bodies govern how advice and assessment can be combined for the same client, and we explain how they apply to you before any consultancy starts. Help with preparation never changes the standard: every applicant is marked against the same requirements, and no one is promised a pass. Our Cyber Essentials consultancy page explains how advice and assessment are kept separate. ## Can we switch certification body? Yes. When your certificate is due for renewal, any IASME-licensed certification body can assess you, and because a renewal is a new assessment either way, there is nothing to transfer. Our Cyber Essentials renewal page explains how to switch, including checking whether your current provider renews automatically. ## How do you become a Cyber Essentials assessor? You qualify through IASME and must work for an IASME-licensed certification body, based in the UK or the Crown Dependencies. Newcomers start as a Trainee Cyber Essentials Assessor. People with at least three years’ IT or security experience qualify as a Cyber Essentials Assessor, and qualified assessors can add the Cyber Essentials Plus Assessor qualification. IASME’s Deliver this scheme page sets out the current requirements, and its Trainee Cyber Essentials Assessor page covers the entry-level route. In summary: Role | Who it suits | What IASME requires Trainee Cyber Essentials Assessor | People with less than three years’ IT or cyber security experience, including none | A job or job offer at a certification body, a half-day Cyber Basics assessment and the one-day Cyber Essentials Assessor training, then assessing under the guidance of an experienced assessor who reviews your work Cyber Essentials Assessor | People with at least three years’ IT or cyber security experience in the last five years | IASME’s free Assessor Skills Assessment exam (unless you hold a listed qualification such as CISSP, CISM or ISO 27001 Lead Auditor), then the one-day Cyber Essentials Assessor course and exam Cyber Essentials Plus Assessor | Qualified Cyber Essentials assessors | A security testing qualification from IASME’s approved list or a pass in the Vulnerability Assessment Plus (VA+) exam developed by IASME and the NCSC, plus IASME’s Cyber Essentials Plus training course A company that is not yet licensed can apply to become a certification body once one of its staff has qualified. It must meet IASME’s security and quality requirements and hold the certifications it wants to deliver, which for Cyber Essentials means being certified itself. If you are buying certification rather than building a career, the sections above on choosing a certification body are the ones that matter. ## Why Sovereign Secure - We are the certification body. Sovereign Secure is IASME-licensed to issue Cyber Essentials and Cyber Essentials Plus certificates, so your questions go straight to the people who assess you. - Prices you can see. Every basic package is published, from £320 + VAT, with resubmission and retest terms stated up front. - Fast marking. Gold submissions are marked within one working day, Silver within two. - Remote or on-site Cyber Essentials Plus. Remote audits keep disruption down, and we come on site when remote access is not practical. - Established UK company. Sovereign Secure Ltd was incorporated in 2012 (Companies House 08334453) and is based at 16 Whalley Road, Accrington, Lancashire. ## Start your assessment Choose your package and order through the form on this page, or call +44 161 523 5276. For Cyber Essentials Plus, or if you are not sure what is in scope, send your details through the Cyber Essentials scoping questionnaire and we will come back with a fixed quote. Last reviewed October 2026 by the Sovereign Secure assessment team. div]:shrink-0 xl:[&>nav]:min-h-0 xl:[&>nav]:overflow-y-auto"> FAQ ## Frequently asked questions What does a Cyber Essentials certification body do? + It is a company licensed by IASME to assess Cyber Essentials applications and issue certificates; bodies licensed for Cyber Essentials Plus also carry out the technical audit. Its qualified assessors mark your answers, and the certificate always comes from the body, not from a consultant or reseller. IASME lists every licensed body on its Find a Certification Body page. How do I choose a Cyber Essentials certification body? + Check that it is licensed by IASME, then compare marking times, resubmission terms, the support included before you submit and whether it delivers Cyber Essentials Plus remotely or on site. The requirements and the pass mark are the same at every certification body. Who assesses Cyber Essentials Plus? + An assessor from a certification body licensed for Cyber Essentials Plus, within three months of your basic Cyber Essentials certificate. We include the basic assessment in every Cyber Essentials Plus quote and audit remotely or on site. How quickly can we be certified? + Once you submit, we mark within one working day on Gold, two on Silver and three to five on Bronze. Preparation usually takes a few days to a few weeks. For Cyber Essentials Plus, allow a few weeks from order to certificate. Can we choose a particular assessor? + You choose the certification body, and the body allocates an assessor to your submission or audit. If you have a deadline or need an on-site audit at a particular location, tell us when you order. Is there a site visit? + Not for basic Cyber Essentials, which is assessed online from your answers. Cyber Essentials Plus audits usually run remotely by screen share, with on-site audits available when remote access is not practical. Is it easier to pass with some certification bodies? + No. Every licensed certification body marks against the same NCSC requirements. Bodies differ in speed, support, resubmission terms and price, not in the standard they apply. What is a Cyber Essentials auditor? + It is another name for a Cyber Essentials Plus assessor: the person from a licensed certification body who audits a sample of your devices and accounts against the NCSC test specification. Basic Cyber Essentials has no audit, because an assessor marks your written answers instead. Do you offer Cyber Essentials assessor jobs or courses? + This page is for organisations that need certifying. Assessors qualify through IASME and work for licensed certification bodies; the section above on how to become a Cyber Essentials assessor summarises the routes, and IASME's Deliver this scheme page has the current requirements. --- # Cyber Essentials Consultancy & Certification Support | UK URL: https://sovereignsecure.co.uk/cyber-essentials-consultancy/ Cyber Essentials support ## Cyber Essentials Consultancy & Support Gap analysis, remediation guidance and pre-assessment support from an IASME-licensed certification body, with the core help included in every package from £320 + VAT. Get a CE quote Free readiness check - Support included from £320 + VAT - Pre-assessment check before you submit - Independence rules explained up front The short answer Cyber Essentials consultancy is help to scope your IT, find the gaps against the five technical controls and close them before assessment. Our Cyber Essentials certification consultants work for an IASME-licensed certification body, and Cyber Essentials help comes with every package from £320 + VAT: a pre-assessment check, a support call of up to an hour and six months of guide access. Cyber Essentials consultancy is hands-on help to scope your IT, find the gaps against the five technical controls and fix them before you submit, giving you the best chance of passing first time. Every Sovereign Secure package from £320 + VAT includes a pre-assessment check, a support call of up to an hour and six months of guide access. Gap analysis, remediation guidance and readiness help are added at a fixed price. As an IASME-licensed certification body for Cyber Essentials certification, we know what assessors look for, and we explain up front how advice and assessment are kept apart. ## What does Cyber Essentials consultancy include? The first three services below come with every package; the rest are added as needed. Service | What you get | Best for | Price Pre-assessment check | We review your draft answers and flag anything likely to fail | Everyone | Included Support call | Up to an hour on scope, cloud MFA, BYOD and unsupported software | Everyone | Included Guide access | Six months of our guidance, normally £85 + VAT | First-time applicants | Included Gap analysis and readiness review | A control-by-control review with a written, prioritised gap list | No in-house IT, bid deadlines, failed attempts | Fixed quote Remediation guidance | What to change, in what order, and the evidence the assessor expects | Anyone with gaps to close | Fixed quote Cyber Essentials Plus readiness | The CE+ tests walked through on your own sample devices | First-time CE+ | Fixed quote ## What Cyber Essentials certification support is included in each package? Every package includes the pre-assessment check, support call, guide access, portal access and the certification fee. Prices by package and company size: Package | Micro (0 to 9 staff) | Small (10 to 49) | Medium (50 to 249) | Large (250+) Bronze | £320 | £440 | £500 | £600 Silver | £410 | £520 | £575 | £650 Gold | £510 | £620 | £675 | £750 Packages differ in assessment speed, the number of resubmissions and how long you have to pass: Package | Assessed within | Resubmissions | Time to pass Bronze | 3 to 5 working days | 1 | 10 working days Silver | 2 working days | 3 | 1 month Gold | 1 working day | Unlimited | 3 months Prices exclude VAT. Bronze matches IASME’s published fee for each size band, so the support costs nothing extra. Extra resubmissions cost £100 + VAT each. See the full Cyber Essentials cost breakdown. ## How does included support compare with paid add-ons? Several UK providers sell the assessment at the IASME fee and charge extra for help. Published prices from UK providers we reviewed in September 2026: Support item | Sovereign Secure | Add-on prices elsewhere (ex VAT) Review of your answers before submission | Included | +£150 Extra help with your answers | Support call of up to an hour included | +£300, or “supported” packages from £640 Assessment within one working day (Micro) | Gold at £510, unlimited resubmissions | £520 to £620 CE+ pre-assessment or mock audit | Readiness review, fixed quote | +£300 to +£1,000 ## What does a Cyber Essentials gap assessment include? A Cyber Essentials gap analysis compares your IT today with the NCSC requirements and gives you a written, prioritised list of what to fix before you submit. We start with scope, because every other answer depends on it. Area | What we review | Common gap Scope | Offices, home workers, BYOD, servers, cloud services | Devices left out that still access email or data Firewalls | Boundary firewalls, software firewalls on home-working devices, admin interfaces | Default passwords; admin interfaces open to the internet Secure configuration | Unused accounts and software, auto-run, device locking | Old accounts still active; no screen lock on phones Security update management | Vendor support, automatic updates, the 14-day window for high and critical fixes | Unsupported operating systems or applications User access control | MFA on cloud services, separate admin accounts, passwords | One cloud service without MFA; admin accounts used for email Malware protection | Anti-malware or allow-listing on every capable device | Protection missing or switched off The gap list follows the question set and shows the evidence an assessor expects for each answer. To test yourself first, try the free Cyber Essentials readiness check or the Cyber Essentials requirements checklist. The requirements are published by the NCSC. To write down the rules your team will follow, adapt our free cyber security policy template, whose sections map to the five controls. ## How are advice and assessment kept separate? IASME’s assessment independence rules apply to every certification body, including us. Before any consultancy starts, we explain how advice and assessment are kept separate for you. Aspect | Advice (consultancy) | Assessment (certification) Purpose | Help you understand and meet the requirements | Decide whether you meet them Who changes your systems | You or your IT provider, using our guidance | No one. The assessor reviews what you submit or, for CE+, tests a sample What you receive | Gap list, remediation guidance, pre-assessment feedback | A pass or fail decision and, on a pass, your certificate Standard applied | The current NCSC requirements | The same requirements, with no allowance for help received Advice does not guarantee a pass. If you prefer advice from a separate firm, IASME runs the NCSC-backed Cyber Advisor scheme, which lists assured advisers, and you can still certify with us. How does that differ from consultancy here? Cyber Advisors are assured under the NCSC scheme to give hands-on help to micro, small and medium-sized organisations, but IASME notes that an adviser cannot certify you unless they are also a Cyber Essentials assessor. Consultancy from a certification body comes from a team that assesses against the same requirements, kept separate from your assessment under IASME’s independence rules. IASME explains the difference between an assessor and an advisor. ## Who is Cyber Essentials support for? - No in-house IT. We turn each question into plain steps for whoever looks after your laptops and Microsoft 365 or Google Workspace. - IT run by an MSP. Your provider can join the call and receive the gap list, hearing each requirement first-hand. - Bid deadlines. Finding gaps early avoids losing time to a failed attempt. - First-time Cyber Essentials Plus. The audit tests real devices, so readiness work cuts the risk of retests. - Failed or lapsed elsewhere. We start from your previous feedback. ## How long does Cyber Essentials preparation take? Preparation depends on your gaps; assessment time depends on your package. Turning on MFA or automatic updates can take days, while replacing unsupported hardware can take weeks. Step | What happens | Timing 1. Scoping call | Agree scope, deadline and who does what | When you enquire 2. Gap analysis | Review against the requirements; written gap list | Depends on size and sites 3. Remediation | Your team or IT provider closes the gaps | Days to weeks 4. Pre-assessment check | We review your draft answers | Before you submit 5. Assessment | Formal marking by an assessor | 1, 2 or 3 to 5 working days 6. Certificate | Issued on a pass; renew every 12 months | On a pass Our guide to passing Cyber Essentials first time covers the submission itself. ## Cyber Essentials Plus support: getting audit-ready Cyber Essentials Plus must be completed within three months of your Cyber Essentials certificate, and the audit tests a sample of your devices, external IP addresses and cloud accounts. A readiness review runs through those tests first: patching on each sample device, malware protection, browser warnings on downloads and MFA on every cloud service. It is the help most organisations want when they look for a Cyber Essentials Plus consultant, and here it comes from an IASME-licensed certification body that delivers the audit itself. If a test fails, you fix the issue and are retested within the scheme’s time limits. A remote retest of up to an hour within a month is free; other retests start at £400 + VAT. See the Cyber Essentials Plus requirements for sample sizes, or our Cyber Essentials Plus service for how the audit runs. ## Why Sovereign Secure - IASME-licensed certification body. We issue Cyber Essentials and Cyber Essentials Plus certificates, so our advice reflects how assessments are marked. - Support in the price. Pre-assessment check, support call and guide access with every package. - Wider assurance. ISO 27001 certified, a PCI SSC Qualified Security Assessor company, a member of the PCI SSC Global Executive Assessor Roundtable (2026 to 2028), and penetration testing when you need more. - UK company since 2012, based at 16 Whalley Road, Accrington, Lancashire. ## Get help with Cyber Essentials Send your setup through the Cyber Essentials scoping questionnaire for a fixed quote, or pick a package and use its included support. Prefer to talk? Call +44 161 523 5276. Last reviewed October 2026 by the Sovereign Secure assessment team. div]:shrink-0 xl:[&>nav]:min-h-0 xl:[&>nav]:overflow-y-auto"> FAQ ## Frequently asked questions Do I need a Cyber Essentials consultant? + Not always. Organisations with confident in-house IT often pass with the pre-assessment check and support call included in our packages. Extra consultancy is worth it when you have no IT staff, a bid deadline or Cyber Essentials Plus to prepare for. What does a Cyber Essentials gap analysis include? + A review of your scope and each of the five technical controls against the current NCSC requirements. You get a written, prioritised list of gaps and the evidence an assessor will expect, at a fixed price agreed after a short call. Can my certification body help me fix issues? + It can advise you, within IASME's independence rules for certification bodies. We tell you what needs to change and your team or IT provider makes the change, and we explain how advice and assessment are kept separate before any work starts. How long does it take to get ready for Cyber Essentials? + It depends on your gaps. Settings changes such as turning on MFA can take days, while replacing unsupported hardware can take weeks. Once you submit, we assess within one working day on Gold, two on Silver and three to five on Bronze. Can you work with my IT provider? + Yes. Your MSP or IT provider can join the support call and receive the gap list, so the people making the changes know exactly what the assessor will look for. IT providers that certify clients regularly can join our Cyber Essentials MSP partner programme. What support is included in the Cyber Essentials price? + Every package includes a pre-assessment check, a support call of up to an hour, six months of guide access (normally £85 + VAT), portal access and the certification fee. Packages start at £320 + VAT; see the Cyber Essentials price list. Do you help with Cyber Essentials Plus? + Yes. A readiness review takes you through the Cyber Essentials Plus tests on your own sample devices before audit day. If a test fails, a remote retest of up to an hour within a month is free; other retests start at £400 + VAT. --- # Cyber Security Audit: What It Covers and How to Prepare URL: https://sovereignsecure.co.uk/cyber-security-audit/ Cyber security audit guide ## Cyber Security Audit: What It Covers, How It Works and How to Prepare Updated October 2026 A plain guide to cyber security audits from a PCI SSC QSA company and IASME-licensed Cyber Essentials certification body: what gets checked, how it is done and what you should receive at the end. Contact us Get a quote - PCI SSC QSA company - IASME-licensed Cyber Essentials certification body - ISO 27001 certified ourselves The short answer A cyber security audit (often written cybersecurity audit) is an evidence-based check of your security controls against a defined benchmark, such as Cyber Essentials, ISO 27001, PCI DSS or your own policies. The auditor interviews staff, reviews documents and configurations and runs scans, then reports risk-rated gaps and a prioritised roadmap. Plan one every 12 months and after major change. A cyber security audit is a structured, evidence-based check of whether your security controls are in place and working, measured against a stated benchmark. That benchmark might be Cyber Essentials, ISO 27001, PCI DSS, a framework such as the NCSC Cyber Assessment Framework, or simply your own policies. The auditor interviews people, reviews documents and system configurations, samples records and often runs vulnerability scans. You come away with findings ranked by risk and a roadmap of what to fix first, and a general audit usually adds a maturity score for each control area. The most important decision is the benchmark. Without one, an audit becomes a list of opinions; against a named standard, it tells you exactly where you stand with the buyers and regulators who use it. ## What is a cyber security audit? A cyber security audit tests your controls against stated criteria, within an agreed scope, and records the evidence behind every conclusion. It answers “are we doing what we said, and what the standard requires?” rather than “are we secure?”, which no audit can promise. The same work is sold as an IT security audit, a security audit, a cyber audit or a cyber security assessment. The labels overlap, so compare quotes on the scope and criteria written into the engagement, not the name. ## Is an IT security audit the same as a cyber security audit? Usually, yes: the terms are often used interchangeably. Where they differ, an IT security audit sometimes means a narrower review of IT systems only, such as servers, networks, accounts and patching, while a cyber security audit usually also covers governance, people, suppliers and incident response. An information security audit is wider still, because it covers information in every form, including paper and conversations. Label | What it usually covers | What it can leave out IT security audit | Servers, endpoints, networks, user accounts, patching, backups | Policies, training, suppliers, incident response Cyber security audit | Technical controls plus governance, people, suppliers and incident response | Non-digital information, unless agreed Information security audit | All information, digital and physical, often against ISO 27001 | Nothing in principle, if the scope is the whole organisation Whichever label a provider uses, check the scope and the benchmark written into the engagement rather than the name. ## What does a cyber security audit cover? A full audit looks at governance and people as well as technology. Control area | What the auditor checks Governance and risk | Security roles, approved policies, risk register, board reporting Asset management | Inventories of hardware, software, data and cloud services Network security | Firewall rules, segmentation, remote access, wireless Configuration and patching | Hardened builds, no unsupported software, updates applied on time Identity and access | Multi-factor authentication (MFA), admin accounts, joiners, movers and leavers Malware and vulnerability management | Anti-malware coverage, scanning cadence, how fast findings are fixed Logging and incident response | What is logged and reviewed; a tested incident plan Backup and recovery | Protected backups and evidence of a successful restore test Suppliers and people | Supplier security checks, awareness training, phishing resilience Network and configuration checks often go deeper as a separate firewall configuration review, which examines every rule rather than a sample. ## Which standard should the audit measure you against? Pick the benchmark your customers, regulators or insurers already use. If nobody is asking yet, a recognised baseline such as the NCSC’s 10 Steps to Cyber Security gives a sensible structure. Benchmark | Best for | Audit outcome | Who carries it out Cyber Essentials | UK organisations, public-sector and NHS supply chains | Certificate valid for 12 months | An IASME-licensed certification body Cyber Essentials Plus | Buyers who want audited proof of the five controls | Certificate after hands-on technical tests | An IASME-licensed certification body ISO 27001 internal audit | Organisations running or building an ISMS | Internal audit report against clauses 4 to 10 and Annex A | A competent, impartial internal auditor, in-house or outsourced PCI DSS v4.0.1 | Anyone storing, processing or transmitting card data | Report on Compliance or Self-Assessment Questionnaire, plus an Attestation of Compliance | A QSA for a Report on Compliance (or an internal ISA where the card brands or acquirer allow); you complete an SAQ yourself NCSC Cyber Assessment Framework | Essential services, NHS bodies, public sector | Assessment against CAF outcomes | Usually a self-assessment first; some schemes, such as GovAssure, add independent review Your own policy or a general framework, such as the CIS Controls | Anyone without a mandated standard | Gap report and maturity score, no certificate | Any competent auditor For card data, the audit is a formal PCI DSS assessment by a QSA. ISO 27001 clause 9.2 requires internal audits at planned intervals, which our ISO 27001 internal audit service covers. Public-sector and critical-service organisations should read our NCSC Cyber Assessment Framework guide. ## How does a cyber security audit work? Most audits follow the same seven steps, whatever the benchmark. - Scope and criteria. Agree the benchmark, the systems, sites and suppliers in scope, and the evidence period. - Document request. Policies, network and data-flow diagrams, asset lists, previous reports and the risk register. - Interviews. Short sessions with IT, HR, finance, operations and leadership to confirm how processes really run. - Technical review. Configuration review of firewalls, cloud tenants and sample devices, plus vulnerability scanning to confirm patching and hardening. - Sampling. Records are tested over time, for example checking that a sample of recent leavers lost access on the day they left. - Findings and grading. Each gap is rated by risk, or by nonconformity grade where the standard uses one. - Report and close-out. You receive the report, agree owners and dates, and the auditor checks the fixes at follow-up. ## What do you get from a cyber security audit? Expect a report you can act on and show to a customer: - An executive summary in plain English for the board. - Findings with evidence, each with a risk rating, the requirement it relates to and a suggested owner. - A maturity score for every control area, so you can measure progress at the next audit. - A prioritised roadmap, split into quick wins, the next three months and the next 12 months. - A mapping to standards where you plan to certify later, so the work counts twice. Audits for a certification scheme end in that scheme’s formal output: a certificate, an Attestation of Compliance or an internal audit report of nonconformities. A maturity score and roadmap are not part of those outputs, so ask for them in the scope if you want them. ## What is a cyber security maturity assessment? A cyber security maturity assessment scores how well established each control area is, not just whether a control exists. Two organisations can both “have a backup policy”, yet only one tests restores. Some providers call this a security posture assessment. Scales vary between frameworks and providers. A simple scale from 0 to 5 works for most organisations: Score | Level | What it looks like 0 | Not in place | No control, or nobody knows whether one exists 1 | Ad hoc | Done by individuals when they remember; nothing written down 2 | Repeatable | Done consistently by habit, but informal and person-dependent 3 | Defined | Documented, approved, assigned to an owner and followed 4 | Managed | Measured and reviewed, with evidence it operates over time 5 | Optimised | Improved continuously from metrics, incidents and testing The useful output is the gap between your current score and a target agreed with the board. Few organisations need a 5 everywhere; they need the right level for the risks they carry. Someone also has to own that roadmap after the audit; our guide to the virtual CISO (vCISO) explains one way smaller organisations fill that role. ## What is a security posture assessment? A security posture assessment is a review of how well your organisation can prevent, detect and respond to attacks today: your controls, configurations, exposed systems, people and processes, measured against a benchmark. It combines audit-style evidence review with technical testing, and usually ends with a maturity score and a prioritised roadmap. It sits between the other common reviews: Review | Question it answers | Read more Cyber security audit | Do our controls meet the benchmark, and can we prove it? | This guide Cyber security risk assessment | Which risks matter most, and what should we do about them? | Cyber security risk assessment Vulnerability assessment | Which known weaknesses are in our systems? | Vulnerability assessment Penetration test | Could a real attacker get in, and how far? | Penetration testing Security posture assessment | Overall, how strong is our defence right now? | A blend of all four, scoped to your needs ## How often should a cyber security audit be done? At least once every 12 months, and again after any significant change. The standards you hold usually set the minimum rhythm. Driver | Minimum rhythm Cyber Essentials and Cyber Essentials Plus | Certificates last 12 months, so reassess every year PCI DSS v4.0.1 | Validate every year; quarterly internal and external vulnerability scans (11.3.1 and 11.3.2); internal and external penetration tests at least every 12 months and after significant change (11.4.2 and 11.4.3) ISO 27001 | Internal audits at planned intervals (clause 9.2); certification surveillance audits every year and recertification every three years Any organisation | After a merger, a cloud migration, a new critical supplier or a serious incident ## How do you prepare for a cyber security audit? A checklist Preparation is mostly about finding evidence, not hiding problems. Use this cyber security audit checklist: - Current hardware, software and cloud service inventory - Network diagram and data-flow diagram - Security policies with owners and last review dates - Risk register and any treatment plans - List of admin accounts and MFA status for every cloud service - Patch and vulnerability scan reports for the last three months - Backup jobs and the most recent restore test - Incident response plan and incident log - Supplier list with the security evidence you hold for each - Previous audit and penetration test reports, with remediation status Name one coordinator, book interviews early and tell staff the auditor is testing processes, not people. ## Is a cyber security audit the same as a penetration test? No. An audit checks that controls meet a benchmark across your whole organisation, while a penetration test attacks specific systems to prove whether a real attacker could get in, so the two complement each other: see our penetration testing services for the testing side. ## What should you look for in a cyber security audit provider? - The right standing for the benchmark. PCI DSS assessments need a QSA company (check the PCI SSC list of Qualified Security Assessors); Cyber Essentials needs an IASME-licensed certification body; ISO 27001 certificates come from an independent certification body. - Honesty about independence. A provider that designed or fixed the controls should say so and not call the audit independent. - Evidence, not questionnaires. Sampling, configuration review and scanning catch what self-assessment misses. - A usable report and a written scope. Risk-rated findings, owners and a roadmap, against a scope agreed before fieldwork. ## Why Sovereign Secure Sovereign Secure Ltd was incorporated in 2012 and is headquartered in Accrington, Lancashire, with offices in Los Angeles, Singapore, Dubai and Dhaka. Assessing organisations against defined standards is our core work: - PCI SSC approvals. We are a Qualified Security Assessor (QSA) company, a Qualified PIN Assessor (QPA), a Card Production Security Assessor (CPSA), a P2PE Assessor (Europe and USA) and a 3DS Assessor, and a member of the PCI SSC Global Executive Assessor Roundtable (GEAR) for 2026 to 2028. - IASME schemes. We are an IASME-licensed certification body and issue Cyber Essentials, Cyber Essentials Plus, IASME Cyber Assurance and Defence Cyber Certification Levels 0 and 1 certificates. - ISO 27001. We are ISO 27001 certified and run outsourced ISO 27001 internal audits. Certification audits are carried out by our partner certification body, MQA International. - Technical evidence. Penetration testing, firewall configuration reviews and vulnerability scanning. External ASV scans are delivered through a PCI SSC Approved Scanning Vendor partner. Where we have advised on or remediated the environment we are reviewing, we say so in the report and do not describe that review as independent. Read more about our wider cyber security consultancy. ## Next step: agree the benchmark and scope Tell us who is asking for the audit, what they want to see and your deadline. We will tell you which benchmark fits and which of our services cover it. Contact our team or call +44 161 523 5276. If the benchmark is already set, see where you stand first with a free self-check: the PCI compliance check, the Cyber Essentials readiness check or the ISO 27001 checklist. Last reviewed October 2026 by the Sovereign Secure assessment team. div]:shrink-0 xl:[&>nav]:min-h-0 xl:[&>nav]:overflow-y-auto hidden"> FAQ ## Frequently asked questions What are the four types of audit? + In cyber security, the four usual types are internal audits, such as an ISO 27001 internal audit, run by your own staff or an outsourced auditor; external audits, run by an independent body such as a certification body or QSA; compliance audits against a named standard such as a PCI DSS assessment or the Cyber Essentials Plus audit; and IT or technical audits that test configurations, patching and access directly. One engagement often combines several, for example an external compliance audit that includes technical testing. How often should a cyber security audit be done? + At least once every 12 months, and again after a significant change such as a cloud migration, an acquisition or a serious incident. Certificates and validations set their own cycles: Cyber Essentials lasts 12 months, PCI DSS is validated every year and ISO 27001 has yearly surveillance audits. What is a cyber maturity assessment? + A maturity assessment scores how well established each control area is, from ad hoc to measured and continuously improved, rather than just recording whether a control exists. It is usually delivered as part of an audit report so you can track progress year on year. How long does a cyber security audit take? + It depends on the benchmark, the number of sites, systems and suppliers in scope, and how quickly evidence can be produced. A tightly scoped audit of a small organisation can need only a few days of fieldwork, while multi-site or multi-standard audits take longer. The scope agreed up front is what fixes the timetable. How much does a cyber security audit cost? + There is no standard price. The cost depends on the benchmark, the people, sites, systems and suppliers in scope, whether technical testing such as scanning or penetration testing is included, and how quickly evidence can be produced. Ask any provider to quote against a written scope and criteria. Does a cyber security audit include a risk assessment? + Not as a separate deliverable. The audit checks that your risk process exists and is followed, for example by sampling the risk register and treatment records, but it does not score your risks for you. Our guide to cyber security risk assessment covers that method. Is Cyber Essentials an audit? + Basic Cyber Essentials is a self-assessment that an assessor at an IASME-licensed certification body marks. Cyber Essentials Plus is the audited level, with hands-on technical tests of sample devices, external scans and cloud accounts. Can the firm that helped us fix our controls also audit us? + It can review its own work, but it should say so and not call the audit independent. Certification schemes set their own rules: we check IASME's certification body rules before certifying a client we have advised, and PCI SSC rules on independence apply to our QSA work. --- # Cyber Security Certification UK: Which One Do You Need? URL: https://sovereignsecure.co.uk/cyber-security-certifications-uk/ Comparison guide ## Cyber Security Certification UK: CE, CE+, ISO 27001, PCI DSS and SOC 2 Compared Updated October 2026 One table for every certification UK buyers ask about: who it is for, how you are assessed, how long it lasts and who issues it, from an IASME-licensed certification body that is also a PCI SSC QSA company. Contact us Get a quote - IASME-licensed Cyber Essentials certification body - PCI SSC QSA company - ISO 27001 certified ourselves The short answer The first cyber security certification for most UK organisations is Cyber Essentials, the government-backed baseline that many public-sector contracts require, with Cyber Essentials Plus added when buyers want audited proof. ISO 27001 suits firms that need an internationally recognised management system. PCI DSS applies to anyone handling card payments, and SOC 2 is a US attestation report, not a certificate. The right cyber security certification in the UK depends on who is asking for it. For most organisations the first step is Cyber Essentials, the government-backed baseline that UK central government and NHS contracts often require. Cyber Essentials Plus adds an independent technical audit. ISO 27001 is the international standard for running an information security management system, and it is what enterprise and overseas buyers usually want. PCI DSS is not optional if you take or handle card payments. SOC 2 is a US attestation report that many American customers expect from service providers. Looking for a personal cyber security qualification? This guide covers certifications for organisations; for individual courses see NCSC Assured Training and the UK Cyber Security Council. This page compares the organisational certifications in one place and helps you choose; detailed pairwise comparisons are linked rather than repeated. ## UK cyber security certifications compared Aspect | Who it is for | How you are assessed | Validity | Main cost driver | Who issues it Cyber Essentials | UK organisations of any size, especially public-sector and NHS suppliers | Self-assessment against the IASME question set, approved by a board member or equivalent and marked by an assessor | 12 months | Organisation size: IASME fee bands from £320 to £600 + VAT | An IASME-licensed certification body, such as Sovereign Secure Cyber Essentials Plus | Organisations whose buyers want audited proof | Hands-on tests: external vulnerability scan, authenticated scans of sample devices, malware protection and MFA checks, within three months of the Cyber Essentials certificate | 12 months | Number of devices, users, sites and cloud services sampled | An IASME-licensed certification body, such as Sovereign Secure IASME Cyber Assurance | Smaller organisations wanting governance assurance beyond Cyber Essentials. It is also where IASME now points anyone looking for IASME Cyber Baseline, which is no longer available | Level One is a verified self-assessment; Level Two adds an audit. A valid Cyber Essentials certificate is a prerequisite | Level One one year; Level Two three years, with Cyber Essentials and Level One renewed yearly | Organisation size and level | Certification bodies licensed by IASME for the scheme, including Sovereign Secure ISO 27001 | Organisations needing an internationally recognised management system; see What is ISO 27001? | Stage 1 and Stage 2 audits of your ISMS against ISO/IEC 27001:2022 (clauses 4 to 10 and the Annex A controls you apply): documents, records, interviews and sampling | Three years, with surveillance audits every year | Scope: people, sites and complexity, which set the audit days | An independent certification body PCI DSS v4.0.1 | Any business that stores, processes or transmits card data, or can affect its security | Self-Assessment Questionnaire or Report on Compliance by a QSA, plus an Attestation of Compliance and quarterly ASV scans where they apply | Validated every year | Size of the cardholder data environment and your merchant or service provider level | No certificate: you, and your QSA where one is used, sign an Attestation of Compliance SOC 2 | Service organisations selling to US customers | Attestation against the AICPA Trust Services Criteria: Type 1 tests design at a point in time, Type 2 also tests operating effectiveness over a period | Covers a past period; usually renewed every year | Criteria in scope and the length of the Type 2 period | A licensed CPA firm The Cyber Essentials fee bands are IASME’s official prices: £320 for 0 to 9 staff, £440 for 10 to 49, £500 for 50 to 249 and £600 for 250 or more, all + VAT. Our own Cyber Essentials certification packages start at the same £320 + VAT. Sovereign Secure is an IASME-licensed certification body for Cyber Essentials, Cyber Essentials Plus, IASME Cyber Assurance and Defence Cyber Certification Levels 0 and 1, so we issue those certificates directly. For card payments, the PCI SSC also runs programmes beyond PCI DSS for payment solution providers, and as a PCI SSC-listed assessor we carry out PCI P2PE assessments for point-to-point encryption solutions and PCI 3DS assessments for 3-D Secure providers. ## What is the best cyber security certification for a UK business? There is no single best certificate. Answer each question in turn; many organisations end up needing more than one. - Do you take card payments or handle card data? PCI DSS applies whatever else you hold. Your acquirer or the card brands decide how you validate. - Does a UK government or NHS contract name Cyber Essentials? Get Cyber Essentials, and Cyber Essentials Plus if the contract asks for it. The NCSC’s Cyber Essentials overview explains the scheme. - Do enterprise or overseas buyers ask for ISO 27001, or send long security questionnaires? Plan for ISO 27001, which typically takes months rather than weeks. - Are your main customers US companies asking for a SOC 2 report? You will need a licensed CPA firm. Read our guide to SOC 2 compliance before choosing between SOC 2 and ISO 27001. - Do you want governance assurance beyond the technical baseline, without a full ISMS? Look at IASME Cyber Assurance. - Nobody is asking yet? Start with Cyber Essentials. It is the cheapest recognised baseline, and ISO 27001 and PCI DSS both expect its five controls in some form. ## Which certification do customers ask for? Buyers tend to fall into clear groups. Buyer | What they usually ask for UK central government departments, their agencies and NHS bodies | Cyber Essentials for relevant contracts; Cyber Essentials Plus where the risk is higher NHS suppliers and care providers with access to patient data | An annual NHS DSPT self-assessment; outside Category 1, a current Cyber Essentials Plus certificate on top of Standards Met lifts the published status to Standards Exceeded Defence suppliers | Cyber Essentials or Cyber Essentials Plus, plus a Defence Cyber Certification level where the contract sets one Large UK and international enterprises | ISO 27001, often with Cyber Essentials for UK work US customers of software and service providers | A SOC 2 Type 2 report; some accept ISO 27001 instead Acquirers, payment partners and card brands | PCI DSS compliance, shown by an Attestation of Compliance ## How do the pairwise comparisons work out? Each of these has its own page. In one line: Comparison | The short answer Cyber Essentials vs ISO 27001 | Five technical controls in days or weeks, against a whole management system in months; many firms hold both PCI DSS vs ISO 27001 | Prescriptive card data requirements, against a risk-based framework; ISO 27001 does not replace PCI DSS ISO 27001 vs SOC 2 | A certificate recognised worldwide, against a US attestation report; firms selling into both the UK and US markets often hold both ## Do I need Cyber Essentials if I have PCI DSS? Yes, if a contract asks for Cyber Essentials. PCI DSS protects cardholder data and covers the systems that store, process or transmit it, plus anything that can affect their security. Cyber Essentials checks five basic technical controls across your whole organisation, or a clearly separated part of it. Holding one says nothing formal about the other. The controls do overlap, so the work is not wasted: Cyber Essentials control | Closest PCI DSS v4.0.1 requirements | Watch out for Firewalls | Requirement 1: network security controls | PCI DSS also needs rule sets reviewed at least every six months (1.2.7) Secure configuration | Requirement 2: secure configurations | PCI DSS needs configuration standards for every system type Security update management | Requirement 6.3.3 | Cyber Essentials is stricter: high and critical updates within 14 days, against one month for critical vulnerabilities in PCI DSS, with other patches on a timescale you define User access control | Requirements 7 and 8, including MFA for all non-console access into the cardholder data environment (8.4.2) | PCI DSS adds password, session and access review rules Malware protection | Requirement 5 | PCI DSS adds periodic evaluation for systems not commonly at risk ## Can Cyber Essentials Plus evidence count towards PCI DSS? It can inform your PCI DSS evidence, but it cannot replace it. The technical tests are similar in spirit and different in rules: - A Cyber Essentials Plus external scan is not an ASV scan. PCI DSS Requirement 11.3.2 needs passing external scans at least every three months, performed by a PCI SSC Approved Scanning Vendor. - Cyber Essentials Plus device scans are not your internal scanning programme. Requirement 11.3.1 needs internal scans of in-scope systems at least every three months, and 11.3.1.2 has required authenticated scanning since 31 March 2025. - Cyber Essentials Plus is not a penetration test. Requirement 11.4 needs internal and external penetration tests at least every 12 months and after significant change, to a defined methodology, plus segmentation tests where segmentation reduces your scope. What does carry across is supporting evidence: asset inventories, patch records, MFA settings and anti-malware reports can be reused where the scopes match. Our independence note. Sovereign Secure is both an IASME-licensed Cyber Essentials certification body and a PCI SSC QSA company. We keep each assessment to its own scheme’s rules. A Cyber Essentials Plus certificate from us never stands in for PCI DSS validation, and where we have advised you, we check IASME’s certification body rules on consultancy and assessment before we certify. Advice from us does not make any assessment easier to pass. ## Cyber security certification vs accreditation: what is the difference? Your organisation is certified; the body that certifies you is accredited, licensed or qualified to do so. People searching for “cyber security accreditation” usually mean a certificate their organisation can show buyers, but the words matter when a buyer asks for proof, and attestation and validation are different again. Term | What it means | Examples Certification | Your organisation receives a certificate from a licensed or independent body, valid for a fixed period | Cyber Essentials, Cyber Essentials Plus, IASME Cyber Assurance, ISO 27001 Accreditation, licensing or qualification | A scheme owner or accreditation body approves the organisation that assesses you | IASME licenses Cyber Essentials certification bodies; the PCI SSC qualifies QSA companies; accreditation bodies accredit ISO certification bodies Attestation | An auditor’s report giving an opinion on your controls | SOC 2 Type 1 and Type 2 Validation | A Report on Compliance or Self-Assessment Questionnaire with an Attestation of Compliance, sent to your acquirer, payment brands or customers | PCI DSS When a tender asks for an “accredited” certificate, check what it means in practice: for Cyber Essentials, a certificate from an IASME-licensed certification body; for ISO 27001, a certificate from a certification body accredited for that standard. Our ISO certification guide explains ISO accreditation in more detail. ## Which cyber security standards have no certificate? Several widely used cyber security standards and frameworks have no certificate at all. You can be assessed against them, and buyers may ask how you align, but nobody issues a pass: - NCSC Cyber Assessment Framework (CAF): outcome-based assessment for essential services, NHS bodies and the public sector. - NIST Cybersecurity Framework 2.0: six functions (Govern, Identify, Protect, Detect, Respond, Recover), common with US customers. - CIS Controls: a prioritised list of technical safeguards. - NCSC 10 Steps to Cyber Security: guidance written for medium to large organisations, although the principles apply to all. Among information security standards, ISO/IEC 27002 gives control guidance but is not certifiable; ISO/IEC 27001 is the one you certify against. ## Why Sovereign Secure Sovereign Secure Ltd was incorporated in 2012 and is headquartered in Accrington, Lancashire, with offices in Los Angeles, Singapore, Dubai and Dhaka. - IASME schemes. We are an IASME-licensed certification body and issue Cyber Essentials, Cyber Essentials Plus, IASME Cyber Assurance and Defence Cyber Certification Levels 0 and 1 certificates directly. - PCI SSC approvals. We are a Qualified Security Assessor (QSA) company, a Qualified PIN Assessor (QPA), a Card Production Security Assessor (CPSA), a P2PE Assessor (Europe and USA) and a 3DS Assessor, and a member of the PCI SSC Global Executive Assessor Roundtable (GEAR) for 2026 to 2028. - ISO 27001. We are ISO 27001 certified and provide ISO 27001 consultancy. Certification audits are carried out by our partner certification body, MQA International. - Testing. Penetration testing and vulnerability scanning, with external ASV scans delivered through a PCI SSC Approved Scanning Vendor partner. See how these fit together in our cyber security consultancy overview. ## Next step Tell us which contracts, customers or acquirers are asking for proof, and by when. We will tell you plainly which certification to start with. Contact our team or call +44 161 523 5276. Already know which one you need? Check where you stand for free with our Cyber Essentials readiness check, PCI compliance check or ISO 27001 checklist. Last reviewed October 2026 by the Sovereign Secure assessment team. div]:shrink-0 xl:[&>nav]:min-h-0 xl:[&>nav]:overflow-y-auto hidden"> FAQ ## Frequently asked questions What is the best cyber security certification for a UK business? + For most UK businesses, Cyber Essentials is the best first certification: it is quick, priced by organisation size and named in many public-sector contracts. Add Cyber Essentials Plus if buyers want an audit, ISO 27001 if enterprise or overseas customers ask for it, and PCI DSS if you take card payments. Which certification do customers ask for? + It depends on the customer. UK central government and NHS buyers ask for Cyber Essentials, and sometimes Cyber Essentials Plus. Enterprise and international buyers tend to ask for ISO 27001, US customers often ask for a SOC 2 report, and acquirers and card brands require PCI DSS compliance. Do I need Cyber Essentials if I have PCI DSS? + Yes, if a contract or tender asks for Cyber Essentials. PCI DSS covers your cardholder data environment and the systems connected to it, while Cyber Essentials covers your whole organisation or a clearly separated part of it. Neither replaces the other. Where does PCI DSS fit among UK certifications? + It is not a certification: the PCI Security Standards Council issues no certificate. You validate compliance each year with a Report on Compliance or Self-Assessment Questionnaire and an Attestation of Compliance. Our guide to PCI DSS certification explains the documents. What is the difference between certification and accreditation? + Organisations are certified; the bodies that assess them are licensed or qualified by the scheme owner, or accredited by an accreditation body. IASME licenses Cyber Essentials certification bodies and the PCI SSC qualifies QSA companies. In everyday use, 'cyber security accreditation' usually means a certificate your organisation holds. How long do cyber security certifications last? + Cyber Essentials and Cyber Essentials Plus certificates last 12 months. An ISO 27001 certificate lasts three years with surveillance audits every year. PCI DSS compliance is validated every year, and a SOC 2 report covers a past period, so most customers ask for a new one each year. Do UK companies need SOC 2 as well as ISO 27001? + Usually only when US customers ask for it. ISO 27001 is a certificate recognised worldwide, while SOC 2 is an attestation report that US customers often expect. Our ISO 27001 vs SOC 2 comparison covers doing both. Can the same company advise us and certify us? + It depends on the scheme's rules. For Cyber Essentials we check IASME's certification body rules on consultancy and assessment before certifying a client we have advised, and advice never changes how an assessment is marked. ISO 27001 certificates come from an independent certification body, not from your consultant. --- # Cyber Security Consultancy UK | QSA and IASME Body URL: https://sovereignsecure.co.uk/cyber-security-consultancy/ Cyber security consultancy ## Cyber Security Consultancy: PCI DSS, Cyber Essentials, ISO and Testing Under One Roof Advice, assessment and testing for PCI DSS, Cyber Essentials and ISO standards from one firm, with the regulations around them explained in plain guides. Contact us Get a quote - PCI SSC-approved QSA, QPA and CPSA company - IASME-licensed Cyber Essentials certification body - ISO 27001 certified, established 2012 The short answer Cyber security consultancy is expert help to work out which security standards apply to you, close the gaps and prove it to customers, auditors and regulators. Sovereign Secure is a PCI SSC-approved QSA, QPA and CPSA company, an IASME-licensed Cyber Essentials certification body and ISO 27001 certified, covering PCI DSS, Cyber Essentials, ISO consultancy and penetration testing. Cyber security consultancy is expert help to work out which security standards and risks apply to your organisation, close the gaps and produce evidence that customers, auditors and regulators accept. Sovereign Secure is a consultancy and an approved assessor in one firm: a PCI SSC-approved Qualified Security Assessor (QSA), Qualified PIN Assessor (QPA) and Card Production Security Assessor (CPSA) company, an IASME-licensed Cyber Essentials certification body and ISO 27001 certified. ## What does a cyber security consultant do? A cyber security consultant assesses how well you are protected, recommends fixes and helps you meet a standard or a customer’s security requirements. The work usually covers: - Scoping: which systems, sites and data a standard covers. - Gap analysis: what you do today against each requirement. - Remediation guidance: a prioritised plan your team or IT provider carries out. - Testing: penetration tests and scans that show what an attacker could exploit. - Assessment: the formal assessment or certificate, where we are the approved body. ## Which cyber security consulting services do we provide? Our cyber security consulting (also called IT security or information security consulting) covers four lines of cyber security services, each backed by an approval you can check at the source: Service line | What it covers | Our status | Start here PCI DSS, PIN, card production, P2PE and 3DS | Scoping, gap analysis, SAQ support, QSA assessments, PIN and card production audits, P2PE and 3DS assessments | PCI SSC-approved QSA, QPA, CPSA, P2PE Assessor (Europe and USA) and 3DS Assessor | PCI DSS consultancy Cyber Essentials, CE+ and other IASME schemes | Readiness support, certification, the CE+ technical audit, IASME Cyber Assurance and Defence Cyber Certification Levels 0 and 1 | IASME-licensed certification body | Cyber Essentials consultancy ISO management systems | ISO 27001 gap analysis, implementation and internal audit, plus ISO 9001, 14001, 22301 and others | ISO 27001 certified; certification audits by MQA International | ISO 27001 consultancy Testing and scanning | Web, API, network, cloud, mobile, hardware, wireless, social engineering and AI/LLM testing | ASV scans through a PCI SSC Approved Scanning Vendor partner | Penetration testing services Two guides sit across all four lines: what a cyber security audit measures, and how a cyber security risk assessment sets priorities. For each standard in more depth, see our guides on PCI DSS, Cyber Essentials and ISO 27001. ## What about NIS2, DORA, SOC 2 and other frameworks? We cover these in guides, not as separate services, because most ask for evidence our four lines already produce, such as an ISO 27001 management system or penetration test reports. More framework guides, including the NCSC Cyber Assessment Framework, are listed below. Framework | Who it affects | Guide NIS2 Directive | Essential and important entities in EU member states | NIS2 guide DORA | EU financial entities, since 17 January 2025 | DORA guide Cyber Security and Resilience Bill | Proposed UK law updating the NIS Regulations 2018 | Cyber Security and Resilience Bill guide SOC 2 | Service organisations selling to US customers | SOC 2 guide UK operational resilience | Firms in scope of the PRA and FCA rules | operational resilience guide AI governance | Organisations building or buying AI | AI governance guide Cyber Governance Code of Practice | Boards and directors of medium and large UK organisations | Cyber Governance Code of Practice guide CIS Controls v8.1 | Organisations wanting a prioritised technical security roadmap | CIS Controls guide Supply chain security | Any organisation that relies on IT providers, cloud services or third-party code | supply chain security guide ## How does a consultancy engagement run? - Scoping call to confirm what is driving the work and what is in scope. - Fixed quote for the agreed scope before any work starts. - Gap analysis or test through document review, interviews and technical testing. - Remediation by your team or IT provider, with our guidance. - Assessment or certification, where we are the approved body. PCI SSC and IASME both set independence rules, so we explain up front how advice and assessment are kept apart, and you are free to use a different assessor. ## How do I choose a cyber security consultancy? Choose a cybersecurity consultancy on credentials you can check and depth in your standard, not the length of a service list. - Verify approvals on the PCI SSC assessor listings and IASME’s Network Directory. - Ask about independence: who advises, who assesses, and can you appoint another assessor? - Insist on a fixed scope and price for each phase. - Expect honest limits. We do not provide managed security monitoring (SOC) or incident response retainers. ## Where should you start? Start with the standard a customer, acquirer or contract is asking you to meet. Each service line has a free first step you can take before you speak to anyone: If you need | Free first step PCI DSS compliance | PCI compliance check Cyber Essentials or Cyber Essentials Plus | Cyber Essentials readiness check ISO 27001 certification | ISO 27001 checklist A penetration test | Scope your test online If nobody has named a standard yet, our comparison of UK cyber security certifications helps you choose where to begin. ## Why Sovereign Secure Sovereign Secure Ltd (company no. 08334453, est. 2012) works across the UK, including London, Manchester and the North West, from its head office in Accrington, Lancashire, and internationally through offices in Los Angeles, Singapore, Dubai and Dhaka. For local services, see cyber security in Lancashire and cyber security in Manchester. We are also a member of the PCI SSC Global Executive Assessor Roundtable for 2026 to 2028. Clients shown on our site include Accor, Fiserv, Ticketmaster and Kuwait Finance House; see cyber security by industry for your sector’s standards. Tell us what is driving the work through the enquiry form, or call +44 161 523 5276, for a scope and fixed quote. ## In this section - AI governance AI governance explained for UK organisations: what a framework covers, ISO 42001 and NIST AI RMF, EU AI Act dates and the testing evidence you will need. - CIS Controls CIS Controls v8.1 explained: all 18 controls, 153 Safeguards and implementation groups IG1 to IG3, mapped to Cyber Essentials and ISO 27001 to plan your next step. - Cyber Assessment Framework (CAF) The NCSC Cyber Assessment Framework explained: the 4 objectives, 14 principles and 41 outcomes of CAF 4.0, who must use it and how it maps to ISO 27001. - Cyber Governance Code of Practice The Cyber Governance Code of Practice explained for UK boards: the 5 principles, the 22 director actions and a quarterly question list. Read the guide. - Cyber Security and Resilience Bill The Cyber Security and Resilience Bill explained: status, scope (MSPs, data centres, critical suppliers), 24-hour reporting and how it differs from NIS2. - Cyber security audit What a cyber security audit covers, how auditors test your controls against Cyber Essentials, ISO 27001 or PCI DSS, and how to prepare for a clean result. - Cyber security risk assessment How to run a cyber security risk assessment: identify assets and threats, score likelihood and impact, then build a risk register and treatment plan that works. - DORA regulation DORA regulation explained for UK firms: who the Digital Operational Resilience Act covers, its five pillars, testing and supplier rules, plus a checklist. - EU Cyber Resilience Act The EU Cyber Resilience Act for UK manufacturers: products in scope, key dates, essential requirements, 24-hour reporting and the test evidence you will need. - Incident response plan template Free incident response plan template (Word) for UK organisations, mapped to PCI DSS 12.10 and ISO 27001: roles, severity levels, ICO and acquirer notification. - NIS2 NIS2 explained for UK companies: who the EU directive covers, when UK firms are in scope, the Article 21 security measures, 24-hour reporting and ISO 27001 mapping. - NIST CSF 2.0 NIST CSF 2.0 explained for UK organisations: the six functions, tiers and profiles, NIST CSF vs ISO 27001, and a free mapping to ISO 27001 and Cyber Essentials. - Operational resilience Operational resilience for UK financial firms: PRA SS1/21, FCA PS21/3, impact tolerances, scenario testing and the Critical Third Parties regime explained. - Ransomware prevention How to prevent ransomware: protected backups, fast patching, MFA, remote access and Active Directory hardening, mapped to NCSC guidance. Use the checklist. - SOC 2 compliance SOC 2 compliance for UK companies: what SOC 2 is, SOC 1 vs SOC 2 vs SOC 3, Type 1 vs Type 2, how to prepare and the penetration testing evidence auditors expect. - Third-party risk management Third party risk management explained: the TPRM lifecycle, supplier tiering, contract terms and the DORA, PRA, PCI DSS and ISO 27001 rules behind each step. - UK cyber security certifications Cyber security certification in the UK compared: Cyber Essentials, CE+, ISO 27001, PCI DSS, SOC 2 and IASME Cyber Assurance, so you start with the right one. - Vendor risk assessment Vendor risk assessment guide: a supplier security questionnaire template, the evidence to request (AOC, Cyber Essentials, ISO 27001) and how to verify each one. - Virtual CISO (vCISO) What a vCISO does, how virtual and fractional CISOs differ, what drives the cost and when one beats a full-time hire. A plain guide for UK businesses. Last reviewed October 2026 by the Sovereign Secure assessment team. div]:shrink-0 xl:[&>nav]:min-h-0 xl:[&>nav]:overflow-y-auto"> FAQ ## Frequently asked questions How much does a cyber security consultant cost? + It depends on the standard and the scope. Published UK prices we reviewed in September 2026 put ISO consultant day rates at about £400 to £1,000 and penetration testing at about £1,000 to £1,500 a day, and our guides to ISO 27001 certification cost and penetration testing cost explain what moves the price. Our only published prices are Cyber Essentials packages from £320 + VAT, and everything else gets a fixed quote after scoping. Is a cyber security consultant the same as an auditor or assessor? + No. A consultant helps you get ready, and an assessor or auditor independently decides whether you meet the standard. We do both for PCI DSS and Cyber Essentials within PCI SSC and IASME independence rules, and ISO certification audits are carried out by our partner certification body, MQA International. Do you provide NIS2, DORA or SOC 2 consultancy? + We cover those frameworks in guides rather than as separate services. Our service lines are PCI DSS, PIN and card production; Cyber Essentials; ISO consultancy; and penetration testing and vulnerability scanning, which produce much of the evidence those frameworks ask for. SOC 2 reports themselves are issued by licensed CPA firms. Is Cyber Essentials enough, or do we need ISO 27001? + Cyber Essentials certifies five technical controls and suits most UK organisations as a first step. ISO 27001 is a full management system that larger customers and overseas buyers often ask for. Our Cyber Essentials vs ISO 27001 comparison sets out when you need each. Can you work alongside our IT provider or MSP? + Yes. Your IT provider can join scoping calls and receive the gap list or test findings, so the people making the changes know exactly what the assessor or tester will check. Do you work outside the UK? + Yes. Our head office is in Accrington, Lancashire, and we have offices in Los Angeles, Singapore, Dubai and Dhaka. Clients shown on our site include banks and payment firms in the US, the Middle East and Asia. --- # Cyber Security Lancashire | Accrington HQ, PCI and CE URL: https://sovereignsecure.co.uk/cyber-security-lancashire/ Lancashire head office ## Cyber Security in Lancashire: PCI, Cyber Essentials and Testing From Accrington Cyber security for Lancashire organisations from our head office at 16 Whalley Road, Accrington: PCI DSS, Cyber Essentials, ISO consultancy and penetration testing, remotely or on site. Get a quote Contact us - Head office at 16 Whalley Road, Accrington - PCI QSA company and IASME Cyber Essentials body - On-site work across Lancashire when needed The short answer Sovereign Secure is a cyber security company headquartered at 16 Whalley Road, Accrington, Lancashire, BB5 1AA (+44 161 523 5276). It is a PCI SSC-approved QSA, QPA and CPSA company, an IASME-licensed Cyber Essentials certification body and ISO 27001 certified, providing PCI DSS, Cyber Essentials, ISO consultancy and penetration testing across Lancashire, remotely or on site. Sovereign Secure provides cyber security in Lancashire from its head office at 16 Whalley Road, Accrington, BB5 1AA. From Accrington we provide PCI DSS assessments, Cyber Essentials and Cyber Essentials Plus certification, ISO consultancy and penetration testing to organisations across Lancashire, the wider North West and internationally. We are a PCI SSC-approved Qualified Security Assessor (QSA), Qualified PIN Assessor (QPA) and Card Production Security Assessor (CPSA) company, an IASME-licensed Cyber Essentials certification body and ISO 27001 certified. If your organisation is in Greater Manchester, our page on cyber security Manchester covers the city region. This page is about our Lancashire base, the county around it and the cyber security services we deliver from Accrington. ## Where is Sovereign Secure based? Our head office and registered office are in Accrington, in the borough of Hyndburn in East Lancashire, so if you are looking for cyber security in Accrington or Hyndburn, we are local. Our company and contact details: Aspect | Details Company | Sovereign Secure Ltd (legal name Sovereign Secure Limited) Head office | 16 Whalley Road, Accrington, Lancashire, BB5 1AA Phone | +44 161 523 5276 Email | contactus@sovereignsecure.co.uk Registered | Company no. 08334453, incorporated 18 December 2012 (Companies House record) Other offices | Los Angeles (US), Singapore, Dubai (UAE) and Dhaka (Bangladesh) ## How do you get to the Accrington office? Accrington sits between Blackburn and Burnley, just off the M65. The A56 links the town south to the M66 and Manchester, and Accrington railway station is on the East Lancashire line. Meetings at the office are by arrangement, so please call ahead on +44 161 523 5276. You can read more about the company, our approvals and how to verify them on our about us page. ## Do you work on site in Lancashire? Yes, whenever the work needs someone physically present. Most work is delivered remotely because it is quicker to arrange, but some can only be done in the building. Work that needs a visit: - Wireless penetration testing, because the tester must survey and test the Wi-Fi at each site. - Physical social engineering, such as tailgating and access tests. - Internal network testing, where a VPN, virtual machine or testing device is not practical. - PCI DSS assessment steps where a testing procedure calls for observation, for example physical security of card data. Work that is usually remote but can be done on site: - Cyber Essentials Plus audits. - ISO 27001 gap analysis workshops and internal audits. Work that is normally remote: basic Cyber Essentials (an online self-assessment that we assess), external, web application, API, cloud and mobile penetration testing, and external vulnerability scanning. Visits within East Lancashire are easy to fit around your working week, and visits further afield are planned into the project timetable at the quoting stage. ## Which parts of Lancashire do we cover? All of it, from East Lancashire to the Fylde coast, including Blackburn with Darwen and Blackpool: Area | Council areas | Main towns East Lancashire | Hyndburn, Burnley, Pendle, Rossendale, Ribble Valley, Blackburn with Darwen | Accrington, Burnley, Nelson, Colne, Rawtenstall, Clitheroe, Blackburn, Darwen Central Lancashire | Preston, South Ribble, Chorley | Preston, Leyland, Chorley West Lancashire | West Lancashire | Ormskirk, Skelmersdale North Lancashire and the Fylde coast | Lancaster, Wyre, Fylde, Blackpool | Lancaster, Morecambe, Fleetwood, Lytham St Annes, Blackpool ## What can we help Lancashire organisations with? The same verified services we deliver nationally, from our Lancashire base: - PCI DSS, PIN and card production. Scoping, SAQ support and formal QSA assessments, plus PIN and card production audits. See our PCI compliance services. - Cyber Essentials and Cyber Essentials Plus. We assess and issue certificates as an IASME-licensed certification body, with basic packages from £320 + VAT. Start with Cyber Essentials certification. - ISO consultancy. ISO 27001 and other ISO standards, with certification audits carried out by our partner certification body, MQA International. See ISO 27001 consultancy. - Penetration testing and vulnerability scanning. Web, API, network, cloud, mobile, hardware and IoT, wireless and social engineering testing, with external ASV scans delivered through a PCI SSC Approved Scanning Vendor partner. See penetration testing services. ## Cyber Essentials in Lancashire: is it done locally or remotely? Mostly remotely, with a local option where it helps. For basic Cyber Essentials you answer the IASME question set online and we assess it as an IASME-licensed certification body, so nobody needs to visit. Cyber Essentials Plus adds a hands-on technical audit within three months of the basic certificate, which we can run remotely or at your premises anywhere in Lancashire. Check where you stand first with our free Cyber Essentials readiness check, and read our guide on how to get Cyber Essentials certification for the steps. ## Which cyber security standards do Lancashire organisations need? It depends on who you sell to and how you take payments. Four drivers come up most often: - Defence and aerospace supply chains. MOD contracts that carry DEFCON 658 require Cyber Essentials at every Cyber Risk Profile level, and Cyber Essentials Plus at Levels 2 and 3, alongside further controls from DEF STAN 05-138. - Card payments. Retailers, hospitality businesses and visitor attractions that take cards must comply with PCI DSS, usually through a Self-Assessment Questionnaire. - Public sector contracts. Cyber Essentials is required for many central government contracts that involve personal information, and many public bodies ask their suppliers for it. The NCSC’s Cyber Essentials overview explains the scheme. - Enterprise customers. Software and digital firms are often asked for a recent penetration test report or ISO 27001 certification before a contract is signed. ## Why choose Sovereign Secure for cyber security in Lancashire? When you compare cyber security companies in Lancashire, check each one’s approvals at the source rather than its website. Sovereign Secure Ltd (company no. 08334453, est. 2012, Accrington, Lancashire, UK) is a PCI SSC-approved QSA, QPA and CPSA company, a member of the PCI SSC Global Executive Assessor Roundtable for 2026 to 2028, an IASME-licensed certification body for Cyber Essentials, IASME Cyber Assurance and Defence Cyber Certification Levels 0 and 1, and an ISO 27001-certified firm, with offices in Los Angeles, Singapore, Dubai and Dhaka. - A local firm with approvals you can check. Our PCI approvals and GEAR membership are published by the PCI Security Standards Council, our Cyber Essentials licence comes from IASME, and we are registered with the ICO. - Compliance and testing from one team. One set of evidence can support Cyber Essentials, PCI DSS and ISO 27001. - Clients well beyond the county, including The Growth Company, Fiserv, Accor, Cashplus and Kuwait Finance House. ## How do you get started? - Call or enquire. Ring +44 161 523 5276, use the enquiry form on this page or see our contact details for every office. - Share your scope. For Cyber Essentials or CE+, complete our Cyber Essentials scoping questionnaire. For testing, PCI or ISO, a short call is enough. - Get a fixed quote for the agreed scope before any work starts. - Book dates, remotely or at your premises in Lancashire. Last reviewed October 2026 by the Sovereign Secure assessment team. div]:shrink-0 xl:[&>nav]:min-h-0 xl:[&>nav]:overflow-y-auto"> FAQ ## Frequently asked questions Can we meet you at the Accrington office? + Meetings at the office are by arrangement. Call +44 161 523 5276 or email contactus@sovereignsecure.co.uk first, so we can make sure the right assessor or consultant is there. Why do you use a 0161 phone number? + +44 161 523 5276 is the main number for the whole business. Our head office is in Accrington, Lancashire, and we do not have a Manchester office. How much does Cyber Essentials cost for a Lancashire business? + The same as anywhere in the UK. Our basic Cyber Essentials packages cost £320 to £750 + VAT, depending on organisation size and the package you choose. Cyber Essentials Plus, PCI DSS, ISO and penetration testing are quoted at a fixed price once the scope is agreed. Can you help Lancashire manufacturers and defence suppliers? + Yes. MOD contracts that carry DEFCON 658 require Cyber Essentials at every Cyber Risk Profile level and Cyber Essentials Plus at Levels 2 and 3, and we issue both certificates. We also certify Defence Cyber Certification Levels 0 and 1 (not Levels 2 or 3) and test connected equipment through hardware and IoT penetration testing. Is the Cyber Essentials Plus audit done on site? + It can be. Most Cyber Essentials Plus audits run remotely, using screen sharing and a scanning tool we provide, and we can carry out the audit at your premises in Lancashire if that suits you better. Do you work with organisations in Preston and Central Lancashire? + Yes. Preston, Leyland and Chorley are reached from Accrington along the M65, so on-site work in Central Lancashire is straightforward to arrange, and most work is delivered remotely in any case. Do you cover Blackpool, Lancaster and the Fylde coast? + Yes. We work with organisations across the whole county, including Lancaster, Morecambe, Blackpool, Fleetwood and Lytham St Annes. Most work is remote, and visits are planned into the project timetable when someone needs to be on site. --- # Cyber Security Risk Assessment: Method, Outputs, Frequency URL: https://sovereignsecure.co.uk/cyber-security-risk-assessment/ Risk assessment guide ## Cyber Security Risk Assessment: Identify, Score and Treat Your Risks Updated October 2026 A practical method for identifying, scoring and treating cyber risks in a way your board, auditors and customers will accept, from an ISO 27001-certified PCI SSC QSA company. Contact us Get a quote - ISO 27001 certified ourselves - PCI SSC QSA company - Testing evidence for realistic scores The short answer A cyber security risk assessment (or cybersecurity risk assessment) identifies the information and systems you rely on, the threats and weaknesses that could affect them, and how likely and damaging each would be. The output is a scored risk register and a treatment plan that says which risks you will reduce, avoid, transfer or accept. Review it every 12 months. A cyber security risk assessment is how you work out which cyber threats could genuinely hurt your organisation and which to deal with first. You identify the information, systems and services you depend on, the threats and weaknesses that could affect them, and how likely and damaging each scenario would be. The output is a scored risk register and a treatment plan that names an owner, an action and a deadline for every significant risk. Done well, it justifies your security budget. Done badly, it is a spreadsheet of generic threats nobody reads. The difference is the method, set out below. ## What is a cyber security risk assessment? A cyber security risk assessment estimates the likelihood and impact of threats exploiting weaknesses in the things you depend on. Risk is the combination of the two: a likely event with a small impact can matter less than a rare event that would stop the business. Impact is usually judged against the CIA triad: what a risk would do to the confidentiality, integrity and availability of your information. You will see several names for the same work: - Cyber risk assessment or cyber security risk assessment: digital threats to systems, data and services. - IT risk assessment or IT security risk assessment: usually narrower, focused on technology. - Information security risk assessment: broader, covering all information, including paper, people and suppliers. This is the term ISO 27001 uses. The method below works for all three. Change the scope, not the approach. ## How do you carry out a cyber security risk assessment in 6 steps? Work through six steps. The NCSC publishes a basic risk assessment and management method that follows the same logic, and it is a good companion to this guide. For where risk management sits among the other nine areas, see our map of the NCSC 10 Steps to Cyber Security. - Set the context and scope. Agree which parts of the organisation are in scope, your business priorities, your legal and contractual obligations, and how much risk the board is willing to carry. Define your scoring scales now, before anyone scores anything. - Identify what matters. List the information, systems, services, suppliers and people the business depends on, and give each an owner. Ask what would happen if each were unavailable, leaked or altered. - Identify threats and vulnerabilities. For each important asset, list who or what could cause harm (criminals, insiders, supplier compromise, human error, outages) and the weaknesses they could use. - Assess existing controls. Record what already reduces the risk, and how confident you are that it works. Test results are better evidence than assumptions. - Score likelihood and impact. Rate each scenario on your agreed scales and combine them into a risk score. - Evaluate and decide. Compare each score with your risk appetite, decide how to treat it, and record the decision, owner and date. ## Example likelihood and impact scales The NCSC warns that risk matrices can lead to errors and miscommunication if the meaning of each scale is not carefully communicated. Write the definitions down. These are examples to adapt, not a standard: Score | Likelihood | Impact 1 | Rare: not expected within five years | Minimal: no customer effect, fixed within a day 2 | Unlikely: could happen within five years | Minor: brief disruption, small internal cost 3 | Possible: could happen within two years | Moderate: service outage of hours, some customers affected 4 | Likely: expected within a year | Major: multi-day outage, reportable data breach or lost contract 5 | Almost certain: already happening to similar organisations | Severe: threat to the business, regulatory action or major loss Multiply likelihood by impact to get a score from 1 to 25, then band the results so everyone reads them the same way: 1 to 4 low, 5 to 9 medium, 10 to 16 high and 20 to 25 critical. ## Cyber security risk assessment template: what does a risk register look like? The risk register is the main output. Each row is one risk scenario, written so a non-specialist understands it. Our free cyber security risk assessment template (Excel) has the columns below, plus threat, vulnerability, scoring rationale and treatment actions. For ISO 27001 scales, acceptance criteria and worked examples, see our ISO 27001 risk assessment template guide. A short extract: Risk scenario | Score (likelihood x impact) | Treatment | Owner Phishing email leads to ransomware that encrypts the file server and backups | 4 x 5 = 20, Critical | Reduce: MFA everywhere, endpoint protection, offline backups with tested restores, phishing simulation | IT manager Compromised supplier account with remote access reaches internal systems | 3 x 4 = 12, High | Reduce: named supplier accounts, MFA, access only when needed, logging | Operations director Malicious script on the online checkout page skims card details | 2 x 5 = 10, High | Reduce: payment page script controls (PCI DSS 6.4.3 and 11.6.1), or move to a hosted payment page | E-commerce lead Unencrypted laptop with customer data is lost | 3 x 3 = 9, Medium | Reduce: full-disk encryption and remote wipe | IT manager Cloud provider region outage stops the customer portal | 2 x 3 = 6, Medium | Accept, with a documented recovery plan | Head of product Alongside the register, a risk treatment plan lists each action, its owner, budget, due date and the target score once it is done. Re-score the risk when the action is complete so the register shows progress. ## What are your options for treating a risk? Every significant risk needs one of four decisions, recorded with a reason. Option | What it means | Example Reduce | Add or improve controls to lower likelihood or impact | Enforce MFA on all cloud services Avoid | Stop the activity that creates the risk | Stop storing card numbers you do not need Transfer or share | Move part of the financial impact to someone else | Cyber insurance, or outsourcing to a specialist provider Accept | Carry the risk knowingly, within your appetite | A low-scoring risk where the fix costs more than the loss Transferring a risk rarely transfers accountability. If a supplier loses your customers’ data, you still answer to your customers and the regulator. ## How often should you do a cyber risk assessment? Review the full assessment at least once every 12 months, and update it whenever something significant changes. Triggers include: - a new system, cloud platform or major software release - a merger, acquisition or new line of business - a new supplier with access to your systems or data - a serious incident or near miss, inside or outside your organisation - a change in law, regulation or customer contract terms - a penetration test or audit that reveals weaknesses you had not scored High and critical risks deserve a monthly or quarterly check on their treatment actions, not just the annual review. ## Who should carry out the risk assessment? The business owns the risks; security staff facilitate. Process owners know what a disruption would really cost, and security specialists know how attacks happen. You need both in the room. The board or senior management should set the risk appetite, approve the results and track the critical risks. The UK government’s Cyber Governance Code of Practice, published in April 2025, sets out what boards and directors should do to govern cyber risk. An external facilitator helps when you lack threat knowledge in-house or need challenge from someone with no stake in the scores. Where nobody senior owns security day to day, a virtual CISO (vCISO) is one way smaller organisations get that challenge on an ongoing basis. ## How does a cyber risk assessment support ISO 27001, PCI DSS and UK GDPR? A good general risk assessment feeds several frameworks, but it does not replace their specific requirements. Framework | What it asks for | Does a general cyber risk assessment cover it? ISO 27001 | A defined, repeatable information security risk assessment and treatment process | It is a strong starting point; the standard adds specific requirements, covered in our ISO 27001 risk assessment guide PCI DSS v4.0.1 | A targeted risk analysis for each requirement that lets you set how often a control runs and calls for one (Requirement 12.3.1, mandatory since 31 March 2025), reviewed at least every 12 months | No. Each is a separate document; see our guide to the PCI DSS targeted risk analysis UK GDPR | Security measures appropriate to the risk to personal data (Article 32) | It helps show your measures are proportionate; see the ICO’s guide to data security Cyber Essentials | Five fixed technical controls, whatever your risk profile | Not needed to certify, but it tells you what to do beyond the baseline ## What is the difference between a risk assessment and an audit? A risk assessment decides what matters most; an audit checks whether your controls meet a benchmark. They are often confused with gap analysis and penetration testing because all four use similar evidence. Activity | The question it answers | Main output Risk assessment | What could go wrong, and how much would it matter? | Risk register and treatment plan Cyber security audit | Do our controls meet the benchmark, and do they work? | Findings against criteria, maturity score ISO 27001 gap analysis | How far are we from meeting ISO 27001? | Gap register and roadmap to certification Penetration test | Can an attacker actually get in? | Exploited vulnerabilities and fixes Technical testing makes your likelihood scores honest. A score of “unlikely” for an internet-facing system means little until penetration testing or vulnerability scanning has looked at it. ## What are the most common risk assessment mistakes? - Scoring before agreeing what each number means, or rating everything “medium”. - Listing generic threats with no link to a business process or asset. - Leaving out suppliers. IT providers with remote access and cloud services holding your data belong in the assessment, and high-scoring ones need a proper third-party risk management process. - Treating the assessment as a one-off document for an auditor, with no owners or review dates. ## Why Sovereign Secure Sovereign Secure Ltd was incorporated in 2012 and is headquartered in Accrington, Lancashire, with offices in Los Angeles, Singapore, Dubai and Dhaka. Risk assessment runs through the services we already deliver: - ISO 27001. We are ISO 27001 certified, so our own management system rests on a documented risk assessment. Our ISO 27001 consultancy includes the risk assessment and Statement of Applicability. Certification audits are carried out by our partner certification body, MQA International. - PCI DSS. We are a PCI SSC Qualified Security Assessor (QSA) company, Qualified PIN Assessor (QPA) and Card Production Security Assessor (CPSA), and a GEAR member for 2026 to 2028. Our PCI DSS consultancy helps you write the targeted risk analyses v4.0.1 requires. - Evidence for likelihood. Penetration testing and vulnerability scanning show which weaknesses are real. External ASV scans run through a PCI SSC Approved Scanning Vendor partner. - Cyber Essentials. We are an IASME-licensed certification body for Cyber Essentials and Cyber Essentials Plus, the baseline most treatment plans start from. ## Next step Tell us what the risk assessment is for (ISO 27001, PCI DSS, a customer questionnaire or the board) and we will tell you which of our services fits. Contact our team or call +44 161 523 5276. Starting on your own? Download the free risk register template (Excel) and work through the six steps above. If ISO 27001 is the goal, our free ISO 27001 checklist shows what the standard adds. Last reviewed October 2026 by the Sovereign Secure assessment team. div]:shrink-0 xl:[&>nav]:min-h-0 xl:[&>nav]:overflow-y-auto hidden"> FAQ ## Frequently asked questions What should a cyber risk assessment include? + A defined scope, a list of the assets and data you depend on with an owner for each, the threats and vulnerabilities that could affect them, likelihood and impact scores on agreed scales, and a treatment plan that gives every significant risk an owner, an action and a due date. Keep it in a risk register you review at least every 12 months. How often should you do a cyber risk assessment? + Review the whole assessment at least once every 12 months, and update it whenever something significant changes: a new system or cloud platform, an acquisition, a new supplier with access to your data, a serious incident or a new legal requirement. What is the difference between a risk assessment and an audit? + A risk assessment estimates what could go wrong and how much it would matter, so you can set priorities. An audit checks whether your controls meet a benchmark such as ISO 27001 or PCI DSS. See our guide to a cyber security audit. Who should carry out a cyber security risk assessment? + The people who own the business processes should own the risks, with a security lead or external facilitator running the method and challenging the scores. The board or senior management should set the risk appetite and approve the results. What are the 5 steps of a security risk assessment? + Many guides use five steps: identify assets, identify threats and vulnerabilities, analyse the risk, treat it, then document and review. Our six steps cover the same ground: scope and assets (steps 1 and 2), threats and vulnerabilities (step 3), existing controls, likelihood and impact (steps 4 and 5) and treatment decisions (step 6), with the risk register and regular review completing the cycle. Is an IT risk assessment the same as an information security risk assessment? + They overlap. An IT risk assessment usually focuses on technology and systems, while an information security risk assessment covers all information, including paper records, people and suppliers. A cyber security risk assessment sits between the two and focuses on digital threats. Does a general cyber risk assessment satisfy PCI DSS Requirement 12.3.1? + No. Requirement 12.3.1, mandatory since 31 March 2025, asks for a separate targeted risk analysis for each PCI DSS requirement that lets you choose how often a control is performed and calls for one. Our PCI DSS consultancy helps you write these analyses. Do small businesses need a cyber risk assessment? + If you handle personal data, UK GDPR (Article 32) requires security measures appropriate to the risk, which is hard to show without some form of risk assessment. For a small business it can be short: a list of key systems and data, the main threats, and the controls you rely on, starting with the five Cyber Essentials controls. --- # Cyber Security Glossary: A to Z of Terms, PCI to Pen Testing URL: https://sovereignsecure.co.uk/glossary/ Glossary ## Cyber Security Glossary: PCI DSS and Security Terms in Plain English Plain-English definitions of the cyber security terms and acronyms used in PCI DSS, Cyber Essentials, ISO 27001 and penetration testing, written by a PCI SSC-approved QSA, QPA and CPSA company. Contact us Get a quote - Written by a PCI QSA, QPA and CPSA company - Over 100 terms, from APT to zero trust - Short definitions linked to full guides The short answer A cyber security glossary defines the terms and acronyms used in security standards, testing reports and incident advice. This one covers more than 100 terms: general security terms from APT to zero trust, plus payment terms such as QSA (Qualified Security Assessor) and QPA (Qualified PIN Assessor), and Cyber Essentials, ISO 27001 and penetration testing terms. This cyber security glossary explains the terms buyers, auditors and IT teams meet in PCI DSS, Cyber Essentials, ISO 27001 and penetration testing, grouped by topic, then lists about 90 general cyber security terms from A to Z. Terms with their own full entry, such as PCI PTS, CVSS and the OWASP Top 10, are listed at the end of the page. ## What is a cyber security glossary for? It gives everyone in a project the same meaning for the same word. A cyber security glossary (often spelt cybersecurity glossary) matters most in compliance work, because acronyms sound alike but carry different responsibilities: a QSA and an ASV are both PCI SSC approvals, yet an ASV only runs external scans, while a QSA assesses the whole standard and signs the Report on Compliance. Where our wording differs from an official definition, the official one wins: the PCI SSC glossary for payment terms and the NCSC glossary for general security terms. ## What do the PCI DSS glossary terms mean, from QSA to KIF? Term | Meaning QSA (Qualified Security Assessor) | A company approved by the PCI SSC to assess PCI DSS compliance and sign a Report on Compliance QPA (Qualified PIN Assessor) | An assessor approved to validate organisations that handle PINs and PIN keys against the PCI PIN Security Requirements CPSA (Card Production Security Assessor) | An assessor approved to audit card vendors against the PCI Card Production and Provisioning requirements ASV (Approved Scanning Vendor) | A company approved to run the quarterly external scans in Requirement 11.3.2; ours are delivered through a partner ASV SAQ (Self-Assessment Questionnaire) | The validation form for eligible merchants and service providers; the type depends on how you take payments ROC (Report on Compliance) | The full report of a PCI DSS assessment, normally completed by a QSA AOC (Attestation of Compliance) | The signed declaration of compliance status that accompanies every SAQ or ROC CDE (cardholder data environment) | The people, processes and systems that store, process or transmit cardholder data or sensitive authentication data, plus systems with unrestricted connectivity to them PAN (primary account number) | The card number that identifies the issuer and the cardholder’s account, and the core element of cardholder data TRA (targeted risk analysis) | The documented analysis PCI DSS v4.0.1 requires when you set a control’s frequency (12.3.1) or use the customised approach (12.3.2) P2PE (point-to-point encryption) | A PCI SSC standard for validated solutions that encrypt card data in the terminal, which can reduce merchant scope 3DS (3-D Secure) | The protocol card issuers use to authenticate online payments; PCI 3DS is the separate security standard for the companies that run its servers KIF (key injection facility) | A facility that loads cryptographic keys into payment terminals, assessed under the PCI PIN Security Requirements GEAR | The PCI SSC Global Executive Assessor Roundtable, an advisory group of assessor company executives ## What do the Cyber Essentials terms mean? Term | Meaning Cyber Essentials (CE) | The UK government-backed certification covering five controls: firewalls, secure configuration, security update management, user access control and malware protection CE+ (Cyber Essentials Plus) | The same controls, verified by an assessor’s hands-on technical testing IASME | The NCSC’s Cyber Essentials delivery partner, which licenses certification bodies and publishes the question set Certification body | An organisation licensed by IASME to assess and certify Cyber Essentials applications ## What do the ISO 27001 terms mean? Term | Meaning ISO 27001 | ISO/IEC 27001:2022, the certifiable international standard for information security management ISMS | Information security management system: the policies, risk process and controls an organisation runs Annex A | The 93 reference controls in ISO 27001:2022, in organisational, people, physical and technological themes SoA (Statement of Applicability) | The document recording each Annex A control, whether it applies, why, and whether it is implemented ## What do the penetration testing terms mean? Term | Meaning Penetration test | An authorised, manual attempt to exploit weaknesses and show what an attacker could achieve Vulnerability scan | An automated check for known weaknesses, usually repeated on a schedule VAPT | Vulnerability assessment and penetration testing, bought as one engagement Red team | An objective-led attack simulation that tests detection and response, not just defences Purple team | Attackers and defenders working side by side to improve detection ## Cyber security terms, A to Z The general cyber security terms below come up in board papers, supplier questionnaires, incident advice and test reports. Payment, Cyber Essentials, ISO 27001 and testing acronyms are in the tables above, and terms with a full guide of their own are listed further down the page. A · B · C · D · E · F · G · H · I · K · L · M · N · O · P · R · S · T · U · V · W · Z ## A - Access control: The rules and technology that decide who can use which systems and data, and what they can do there. Cyber Essentials, ISO 27001 and PCI DSS all require it, built on least privilege. - Adversary-in-the-middle (AiTM) phishing: A phishing kit that relays the real sign-in page between the victim and the service, capturing the password and the session once MFA is complete. Phishing-resistant methods such as passkeys defeat it. - Allow listing: Permitting only approved applications, senders or network addresses and blocking everything else, the opposite of a block list. Cyber Essentials accepts application allow listing as one way to meet its malware protection control. - Antivirus: Software that detects and removes known malware on a device. Modern products are usually sold as anti-malware or endpoint protection, and EDR goes further by recording activity and spotting suspicious behaviour. - APT (advanced persistent threat): A well-resourced attacker, often state-backed, that gets into a network and stays hidden for a long time to steal data or prepare disruption. - Assumed breach: A test that starts from inside, typically with a standard user account, to see how far an attacker who already has a foothold could get. See breach and attack simulation. - Attack surface: Everything an attacker could try to reach: internet-facing systems, cloud services, applications, user accounts and supplier connections. Attack surface management keeps an up-to-date inventory of it. - Authentication and authorisation: Authentication proves who a user is, with a password, passkey or MFA prompt; authorisation decides what that user may then do. Many serious web flaws, such as IDOR, are authorisation failures. ## B - Backdoor: A hidden way into a system that bypasses normal sign-in, planted by an attacker after a compromise so they can return, or left in software by mistake. - Black box testing: A penetration test where the tester starts with no inside knowledge, as an outside attacker would. Our guide to black box vs white box testing compares the options. - Botnet: A network of compromised computers or devices controlled remotely by a criminal, often used for DDoS attacks, spam and credential stuffing. - Brute force attack: Guessing passwords or keys by trying many combinations. Account lockout, rate limiting, long passwords and MFA are the usual defences, and Cyber Essentials requires protection against it. - BYOD (bring your own device): Staff using personal laptops, phones or tablets for work. Personal devices that access company email or data generally fall within Cyber Essentials scope, as our scoping questionnaire explains. ## C - CAF (Cyber Assessment Framework): The NCSC’s outcome-based framework for organisations that run essential services, used by regulators under the NIS Regulations. See the Cyber Assessment Framework. - Chargeback: A card payment reversed by the cardholder’s bank after a dispute. Most card-not-present fraud losses reach merchants as chargebacks. - CISA KEV: The US Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalogue, a list of vulnerabilities with evidence of active exploitation that many teams use to set patching priorities. See vulnerability management. - Compensating control: An alternative control an assessor can accept when a PCI DSS requirement cannot be met as written because of a legitimate, documented constraint, provided it meets the intent and rigour of the original. Our guide to compensating controls explains the worksheet. - Credential stuffing: Trying usernames and passwords leaked in one breach against other services, betting that people reuse passwords. MFA and checks against known breached passwords stop most of it. - CVE (Common Vulnerabilities and Exposures): The public catalogue that gives each known vulnerability an identifier, such as CVE-2021-44228. The identifier names the flaw; CVSS rates its severity. - CWE (Common Weakness Enumeration): MITRE’s catalogue of software weakness types, such as CWE-79 for cross-site scripting. A CVE is one instance of a flaw; a CWE is the kind of mistake behind it. ## D - Data breach: A security incident in which data is lost, destroyed, altered, disclosed or accessed without authorisation. Under UK GDPR, a notifiable personal data breach must be reported to the ICO within 72 hours of becoming aware of it, where feasible. - DDoS (distributed denial of service): Flooding a website or network with traffic from many sources so genuine users cannot reach it, an attack on availability in CIA triad terms. - Defence in depth: Layering independent controls so that one failure does not lead straight to a breach, for example MFA, endpoint protection and monitoring working together. - DLP (data loss prevention): Tools and rules that detect and block sensitive data, such as card numbers or customer records, leaving through email, web uploads or removable media. - DMARC, SPF and DKIM: Three email authentication records. SPF lists the servers allowed to send for your domain, DKIM signs messages, and DMARC tells receiving servers what to do with mail that fails, which makes spoofing your exact domain harder. See business email compromise. - DORA (Digital Operational Resilience Act): The EU regulation on ICT risk, incident reporting, resilience testing and third-party risk for financial entities, applied since 17 January 2025. See our DORA guide. ## E - EDR (endpoint detection and response): Software on laptops and servers that records activity, detects suspicious behaviour and lets responders isolate a device. It goes further than traditional antivirus. - Encryption: Scrambling data with a key so only holders of the right key can read it. It protects data in transit, for example with TLS, and at rest, for example with disk encryption. - Exploit: Code or a technique that takes advantage of a vulnerability. A flaw with a working public exploit is far more urgent to fix, which is what EPSS tries to predict. ## F - File integrity monitoring (FIM): Alerting when critical system files, configuration or content change unexpectedly. PCI DSS Requirement 11.5.2 requires a change-detection mechanism of this kind. - Firewall: A device or software that allows or blocks network traffic according to rules. Firewalls are one of the five Cyber Essentials controls, and a firewall configuration review checks the rule base. ## G - Grey box testing: A penetration test where the tester has some inside knowledge, such as user accounts or architecture diagrams, which gives more depth in the same time than black box testing. ## H - Hashing: A one-way function that turns data into a fixed-length value. Passwords should be stored as salted hashes, and PCI DSS accepts keyed cryptographic hashes of the full card number as one way to render stored card numbers unreadable. - Honeypot: A decoy system, account or file that no legitimate user has any reason to touch, so any activity on it is a strong sign of an intruder. - HSM (hardware security module): A tamper-resistant device that generates, stores and uses cryptographic keys. Payment HSMs protect PINs and card keys, and are evaluated under PCI PTS. ## I - IAM (identity and access management): The processes and tools that create, change and remove user identities and their access rights, including single sign-on and MFA. - IDS and IPS: Intrusion detection and intrusion prevention systems watch network traffic for attack patterns; an IDS alerts, while an IPS can also block. PCI DSS Requirement 11.5.1 requires intrusion detection or prevention techniques. - Incident response: The planned way an organisation detects, contains, investigates and recovers from a security incident. Our incident response plan template is a starting point. - Indicator of compromise (IoC): Evidence that a system may have been breached, such as a known malicious IP address, file hash or domain name. - Insider threat: Risk from people with legitimate access, such as staff, contractors or suppliers, who misuse it deliberately or cause harm by mistake. Least privilege, prompt removal of leavers’ access and monitoring reduce it. - IoT (internet of things): Network-connected devices such as cameras, sensors, smart TVs and building controls. Many ship with weak default settings and rarely receive updates, so they belong on a separate network segment; see IoT and hardware penetration testing. ## K - Keylogger: Malware or a small hardware device that records keystrokes to capture passwords, card numbers and messages as they are typed. ## L - Lateral movement: An attacker moving from the first compromised machine to others in the network, usually by reusing credentials. Segmentation and monitoring limit it, and an internal penetration test shows how far it could go. - Least privilege: Giving each user, service and system only the access it needs for its job, and no more, which limits the damage from any one compromised account. ## M - Magecart: The name given to card-skimming attacks that inject malicious JavaScript into online checkouts. PCI DSS 6.4.3 and 11.6.1 target them, as our e-commerce PCI guide explains. The name comes from early attacks on Magento stores; our guide to Magento PCI compliance covers that platform. - Malware: Malicious software, including viruses, worms, trojans, ransomware and spyware. Malware protection is one of the five Cyber Essentials controls. - Man-in-the-middle attack: An attacker positioned between two parties who reads or alters their traffic, for example on an untrusted Wi-Fi network. TLS with proper certificate checks is the standard defence. - MDR (managed detection and response): An outsourced service in which a provider monitors your environment, investigates alerts and helps contain threats, usually around the clock. - MFA (multi-factor authentication): Signing in with two or more different types of factor: something you know, have or are. Cyber Essentials requires it on cloud services wherever the service offers it; see Cyber Essentials MFA rules and two-factor vs two-step verification. ## N - Network segmentation: Separating a network into zones with controlled traffic between them. In PCI DSS, segmentation can take systems out of scope, and penetration testing must confirm it works, as our PCI DSS scoping guide explains. - NIS2: The EU directive that widens cyber security duties and incident reporting for medium and large organisations in 18 sectors. It does not apply in the UK itself, but it can reach UK firms that operate or offer services in the EU. See NIS2. - NIST CSF: The US National Institute of Standards and Technology Cybersecurity Framework. Version 2.0, published in February 2024, groups security outcomes under six functions: govern, identify, protect, detect, respond and recover. See NIST CSF. ## O - OSINT (open-source intelligence): Information gathered from public sources, such as websites, social media, company filings and leaked data. Attackers use it to plan phishing; testers use it to show what an attacker could learn about you. ## P - Passkey: A phishing-resistant sign-in method based on public key cryptography and unlocked on your device with a fingerprint, face or PIN. It only works on the genuine site, so a fake login page cannot capture it. - Patch management: Finding, testing and installing software updates. Cyber Essentials requires critical and high-risk updates within 14 days of release, and PCI DSS requires critical patches within one month. - PCI DSS (Payment Card Industry Data Security Standard): The security standard for organisations that store, process or transmit payment card data. The current version is v4.0.1. See what PCI DSS is. - PCI SSC (PCI Security Standards Council): The body founded by the major card brands that writes PCI DSS and the other PCI standards and qualifies assessors. See the PCI Security Standards Council. - Pretexting: A social engineering technique built on an invented story, such as a caller posing as IT support, to get information or access. It is common in vishing. - Privilege escalation: Gaining more access than an account was given, for example moving from a standard user to local administrator or domain administrator. Penetration testers look for it after the first foothold. - PTaaS (penetration testing as a service): Penetration testing delivered through an online platform, where findings and fixes are tracked as the work happens rather than only in a final report. See penetration testing as a service. ## R - Ransomware: Malware that encrypts or steals data and demands payment to restore it or keep it unpublished. Tested offline backups are the key recovery control; see ransomware prevention. - Remote code execution (RCE): A vulnerability that lets an attacker run their own commands on a system over a network. RCE flaws on internet-facing systems are usually rated Critical. - Risk assessment: Identifying what could go wrong, how likely it is and how much it would hurt, then deciding how to treat each risk. See our cyber security risk assessment guide. - Rootkit: Malware that hides itself and other malicious activity deep in the operating system, usually with the highest privileges, which makes it hard to detect and remove; rebuilding the device is often the safest fix. ## S - Sandboxing: Running untrusted code, or opening a suspicious file, in an isolated environment so it cannot affect the rest of the system. Email security tools often open attachments in a sandbox before delivering them. - SAST (static application security testing): Automated analysis of source code without running it, which points to the file and line at fault. Our DAST guide compares the two approaches. - SIEM (security information and event management): A platform that collects logs from across your systems, correlates them and raises alerts, while keeping the records investigators need. See PCI DSS Requirement 10 for the logging rules card businesses follow. - SOC (security operations centre): The team, in-house or outsourced, that monitors security alerts and responds to incidents. - SOC 2: An attestation report, under AICPA rules, on a service organisation’s controls against the Trust Services Criteria, common in US software procurement. It has nothing to do with a security operations centre; see SOC 2 compliance. - Social engineering: Manipulating people into breaking security, through phishing emails, phone calls, texts or visits in person. Social engineering testing measures how staff respond. - Software composition analysis (SCA): Scanning the open-source and third-party components in your software for known vulnerabilities and licence issues. - Spoofing: Faking an identity, such as an email sender, caller ID, website or IP address, so that a message or connection looks trustworthy. It underpins most phishing and payment fraud. - Spyware: Malware that secretly monitors a device and sends information such as browsing, messages, location or passwords to an attacker. - SQL injection: A flaw where user input is run as part of a database query, letting an attacker read or change data. It sits under Injection in the OWASP Top 10. - Strong Customer Authentication (SCA): The UK and EU rule that most customer-initiated online payments need two independent factors. For cards it is applied through 3-D Secure, which also shifts liability for card-not-present fraud. - Supply chain attack: Compromising a target through a supplier, such as a software update, a managed service provider or a shared code library. See supply chain security. ## T - Threat intelligence: Information about attackers, their techniques and their infrastructure that helps you anticipate and detect attacks. ISO 27001:2022 Annex A 5.7 covers it. - TLS (Transport Layer Security): The protocol that encrypts web and email traffic in transit, shown by https in the browser. PCI DSS requires strong cryptography, such as current TLS versions, for card data sent over open, public networks. - Tokenisation: Replacing a card number with a token that is useless to an attacker, so fewer systems hold real card data. See PCI DSS tokenisation. - Trojan: Malware disguised as legitimate software or a document, which the victim installs or opens themselves. ## U - UK GDPR: The UK’s version of the General Data Protection Regulation, which requires appropriate security for personal data and the reporting of notifiable breaches to the ICO. Our comparison of PCI DSS and GDPR shows where the two overlap. ## V - Virus: Malware that attaches itself to legitimate files or programs and spreads when they are run or shared. The word is often used loosely for any malware. - VPN (virtual private network): An encrypted tunnel between a device and a network, used for remote access. Internet-facing VPN appliances are a frequent target, so they need prompt patching and MFA. - Vulnerability: A weakness in software, hardware, configuration or process that an attacker could exploit. Published software flaws receive a CVE identifier, and our guide to what a vulnerability scan is explains how known ones are found. ## W - WAF (web application firewall): A filter in front of a web application that blocks common attacks such as SQL injection and cross-site scripting. PCI DSS Requirement 6.4.2 requires an automated solution of this kind for public-facing web applications. - Whaling: Spear phishing aimed at senior executives, often to approve payments or share sensitive data. - White box testing: A penetration test or code review with full information, such as source code and architecture documents, giving the deepest coverage in the time available. - Worm: Malware that spreads across a network by itself, exploiting vulnerabilities in connected systems without anyone opening a file. WannaCry, in 2017, was a ransomware worm. ## Z - Zero-day: A vulnerability that attackers know about before the vendor has released a fix, so there is no patch to apply yet. - Zero trust: A security model that never trusts a connection because of where it comes from, and checks identity, device and context on every request. The NCSC publishes design principles for zero trust architecture. ## Who writes these definitions? Sovereign Secure: a UK firm founded in 2012, a PCI SSC-approved QSA, QPA and CPSA company, also listed as a P2PE Assessor and 3DS Assessor, a GEAR member for 2026 to 2028, an IASME-licensed Cyber Essentials certification body and ISO 27001 certified. If a term you need is missing, ask our team. ## Glossary guides, A to Z B C D E I O P Q S T V W ## B - Breach and attack simulation (BAS) Breach and attack simulation (BAS) explained: how automated attack tools test your controls and how BAS differs from penetration testing and red teaming. - Business email compromise (BEC) Business email compromise explained: how BEC invoice and CEO fraud work, the payment checks and Microsoft 365 settings that stop them, and how to report it. ## C - Card-not-present fraud Card not present fraud explained: what a CNP transaction is, how the fraud works online and by phone, who pays, and the PCI DSS and 3-D Secure controls that help. - CIA triad The CIA triad means confidentiality, integrity and availability. See what each means, breach examples and how ISO 27001, PCI DSS and UK GDPR use it. - Cross-site scripting (XSS) Cross site scripting (XSS) explained: stored, reflected and DOM-based XSS, the risk to payment pages and the fixes that work. Find and close XSS in your apps. - CTEM CTEM (continuous threat exposure management) explained: the five stages, how it differs from vulnerability management, and where penetration testing fits in. - CVSS CVSS explained: how the Common Vulnerability Scoring System rates severity from 0 to 10, what changed in CVSS 4.0 and how scores set patching deadlines. ## D - DAST DAST (dynamic application security testing) explained: how a DAST scan tests a running app, SAST vs DAST, the main tool types and where each fits in a release. ## E - EPSS EPSS score explained: what the Exploit Prediction Scoring System measures, how it differs from CVSS and how to use it to order patching inside fixed deadlines. ## I - IDOR IDOR explained: how changing an ID in a URL or API call exposes other users' data, why scanners miss it, how to prevent it and how penetration testers find it. ## O - OWASP ASVS OWASP ASVS explained: what the Application Security Verification Standard covers, the three levels, what version 5.0 changed and how to scope a test with it. - OWASP LLM Top 10 OWASP LLM Top 10 explained: the ten 2026 risks in LLM apps, from prompt injection to improper output handling, what changed from 2025 and how testers use it. - OWASP Top 10 OWASP Top 10 explained: the ten 2025 web application risk categories in plain English, what changed from 2021, how often it updates and how testers use it. ## P - PCI MPoC PCI MPoC explained: the PCI SSC standard behind SoftPOS, tap to pay and PIN on glass on phones and tablets, how it replaces SPoC and CPoC and what merchants check. - PCI PTS PCI PTS explained: what PTS POI v7.0 and HSM approval mean, how to check a device on the PCI SSC list, what happens at expiry and how PTS links to PCI PIN and P2PE. - Phishing What is a phishing attack? A plain-English definition, the main types from spear phishing to quishing, the defences that work and how to report it in the UK. - Prompt injection Prompt injection explained: how direct and indirect attacks hijack LLM apps and AI agents, four worked examples, and the defences that limit the harm. ## Q - Quishing What is quishing? How QR code phishing works, the common lures, why email filters miss QR codes and the checks that help staff spot a malicious code. ## S - Smishing Smishing (SMS phishing) explained: how scam texts work, the UK lures to watch for, the risk to business accounts and how to report a text to 7726. - Spear phishing What is spear phishing? A plain-English definition, how it differs from phishing and whaling, finance, HR and supplier examples, and the defences that stop it. ## T - Threat modelling Threat modelling explained: the five-step process, STRIDE with a worked example, attack trees, free tools, when to do it and what a useful threat model contains. - Two-factor vs two-step verification What is two-factor vs two-step verification? 2FA needs two different types of factor, 2SV only two steps. See examples, passkeys and what counts as MFA. ## V - Vishing Vishing is voice phishing: scam calls posing as banks, IT help desks or executives. See common scripts, the deepfake voice risk and how to test your staff. - Vulnerability management Vulnerability management explained: the lifecycle from discovery to verified fix, prioritising with CVSS and EPSS, and the PCI DSS and Cyber Essentials deadlines. ## W - White hat hacker What is a white hat hacker? White, black and grey hat hackers compared, how ethical hackers work legally and what the Computer Misuse Act 1990 says in the UK. Last reviewed October 2026 by the Sovereign Secure assessment team. div]:shrink-0 xl:[&>nav]:min-h-0 xl:[&>nav]:overflow-y-auto"> FAQ ## Frequently asked questions What is a QSA company? + A company the PCI Security Standards Council has qualified to assess compliance with PCI DSS. Its Qualified Security Assessors (QSAs) carry out the assessments, write the Report on Compliance and sign the Attestation of Compliance. Sovereign Secure is a QSA company. What does QPA stand for? + Qualified PIN Assessor. A QPA is approved by the PCI SSC to assess organisations that handle PINs and the keys protecting them, such as acquirers, processors and key injection facilities, against the PCI PIN Security Requirements. What does CPSA stand for? + Card Production Security Assessor. A CPSA audits card manufacturers, personalisers and provisioning providers against the PCI Card Production and Provisioning security requirements, which cover both physical and logical security. What is the difference between an ASV and a QSA? + An Approved Scanning Vendor runs the quarterly external vulnerability scans PCI DSS requires, while a QSA assesses the whole standard. Sovereign Secure is a QSA company and delivers ASV scans through a partner Approved Scanning Vendor. What is a cyber security glossary for? + It gives everyone in a project, from the board to the IT team and the auditor, the same meaning for the same term. That matters most in compliance work, where similar acronyms carry very different responsibilities. Is there a PDF glossary of cyber security terms? + Yes. The PCI DSS v4.0.1 standard, a free PDF in the PCI SSC document library, ends with a glossary of terms in Appendix G, and NIST's online glossary grew out of its PDF publication NIST IR 7298. To keep a copy of this glossary, use your browser's print option and choose Save as PDF. Where can I find the official PCI DSS glossary? + The PCI Security Standards Council publishes its own PCI SSC glossary, and its wording is what an assessment relies on. This page explains the same terms in plain English and links to guides that go further. --- # Cyber Security by Industry: Which Standards Apply to You URL: https://sovereignsecure.co.uk/industries/ Industries ## Cyber Security by Industry: Banking, Payments, Retail, Healthcare and More Banks, payment firms, card producers, retailers, healthcare suppliers, manufacturers, SaaS companies, schools, law firms and charities face different security standards. Find your sector and the standards that apply to it. Contact us Get a quote - PCI SSC-approved QSA, QPA and CPSA company - IASME-licensed Cyber Essentials certification body - Clients in banking, payments, card production and retail The short answer Cyber security by industry depends on the data you handle and who you sell to. Any business taking card payments must comply with PCI DSS, many UK public sector contracts require Cyber Essentials, organisations with access to NHS patient data complete the DSPT, EU financial entities fall under DORA, and SaaS firms are often asked for ISO 27001 or SOC 2. Cyber security by industry comes down to two things: the data you handle and who you sell to. Those decide which standards you must meet and prove. Taking card payments brings PCI DSS. Bidding for UK central government contracts often brings Cyber Essentials. Access to NHS patient data brings the Data Security and Protection Toolkit (DSPT). Enterprise and overseas customers often ask for ISO 27001 or a SOC 2 report. The table below maps the common standards by sector and links to a page for each. ## Cyber security by industry: which standards apply to yours? Sector | Standards you are most likely to meet | Sector page Financial services (lenders, insurers, wealth managers and payment firms) | PCI DSS wherever card data is handled, Cyber Essentials or ISO 27001 for partner due diligence, annual penetration testing, UK operational resilience, DORA for EU entities | Cyber security for financial services Banking | PCI DSS, PCI PIN, PCI Card Production for in-house card issuing, UK operational resilience, DORA for EU entities, SWIFT CSP | Cyber security for banks Fintech and payments | PCI DSS as a service provider, PCI PIN, ISO 27001, DORA for EU entities, SOC 2 for US customers | Fintech cybersecurity Card production and personalisation | PCI Card Production and Provisioning (logical and physical security requirements) | PCI card production audits Retail, e-commerce and hospitality | PCI DSS (SAQ or ROC), ASV scans where required, Cyber Essentials | Cyber security for retail Healthcare | NHS DSPT, Cyber Essentials, ISO 27001 | Cyber security in healthcare SaaS and software | ISO 27001, SOC 2, web application and API testing, PCI DSS if you handle card data | SaaS penetration testing Manufacturing | Cyber Essentials and CE+ for supply chains, DEFCON 658 on defence contracts, ISO 27001 | Manufacturing cyber security Schools and colleges | Cyber Essentials, the DfE cyber security standards, PCI DSS for card payments | Cyber Essentials for schools Law firms | Cyber Essentials, ISO 27001, client and insurer security questionnaires | Cyber Essentials for law firms Charities | Cyber Essentials, PCI DSS for card donations | Cyber Essentials for charities Small businesses | Cyber Essentials, PCI DSS SAQs | Cyber security for small business ## How does cyber security differ by industry? Mostly in the standard you report against, not the controls underneath. Most organisations meet two or three of these standards at once, and the controls overlap: the five Cyber Essentials controls (firewalls, secure configuration, security update management, user access control and malware protection) also appear in ISO 27001 and PCI DSS, and one penetration test can support PCI DSS Requirement 11.4 and ISO 27001 Annex A control 8.8. What changes from sector to sector is who checks the evidence and how often: Standard | Who checks it | How often PCI DSS | Your acquirer or the card brands, who receive a QSA’s Report on Compliance or your Self-Assessment Questionnaire | Every year Cyber Essentials | An IASME-licensed certification body | Renewed each year NHS DSPT | Your own self-assessment, submitted online to NHS England | Every year ISO 27001 | An independent certification body | Surveillance audits each year, recertification every three years Planning the work together lets one set of evidence serve several standards. ## What do we deliver in every sector? The same four verified service lines, applied to your sector’s rules: - PCI DSS, PIN and card production assessment and consultancy, as a PCI SSC-approved QSA, QPA and CPSA company. - Cyber Essentials and Cyber Essentials Plus certification, as an IASME-licensed certification body. - ISO 27001 and other ISO consultancy, with certification audits by our partner certification body, MQA International. - Penetration testing and vulnerability scanning, with ASV scans delivered through our PCI SSC Approved Scanning Vendor partner. Our cyber security consultancy page explains how these fit together. ## Which sectors do our clients come from? Sector | Clients and testimonials shown on our site Banking | Ahli United Bank, Kuwait Finance House, AYA Bank, Bank of Palestine, First National of Nebraska Payments and fintech | Fiserv, Cashplus, Liquid Pay Card production | Nitecrest, Bamcard, Intelligent Card Production Systems Retail, ticketing and hospitality | JCPenney, Albertsons, Ticketmaster, Accor Find your sector in the list below, or tell us what you need through the enquiry form on this page. ## In this section - Financial services Cyber security for financial services firms in the UK: PCI DSS, PIN and card production, Cyber Essentials Plus, ISO 27001 and penetration testing. Get a quote. - Banking PCI compliance and cyber security for banks and card issuers: how PCI DSS, PCI PIN and card production apply, plus SWIFT CSP and DORA. Get a fixed quote. - Fintech Fintech cybersecurity for payment, e-money and open banking firms: PCI DSS as a service provider, API and app pentests, Cyber Essentials and DORA test evidence. - Retail and e-commerce Cyber security for retail, e-commerce and hospitality: the most common attacks, and the PCI DSS route, Cyber Essentials and testing each channel needs. - Healthcare Cyber security in healthcare for NHS suppliers, clinics and device makers: the main threats, the DSPT, Cyber Essentials Plus, penetration testing and PCI DSS. - SaaS SaaS penetration testing for B2B software firms: multi-tenant isolation, API and web app scope, release-cycle testing and reports enterprise customers accept. - Manufacturing Manufacturing cyber security: Cyber Essentials Plus scope for factory systems, safe OT and IoT testing, MOD supplier rules and product law. Get a fixed quote. - Cyber Essentials for schools Cyber Essentials for schools and trusts: how it fits the DfE standards, what is in scope, free help with cyber security for schools and prices from £320 + VAT. - Cyber Essentials for law firms Cyber Essentials for law firms: the Legal Aid Agency rule, what Lexcel and the SRA expect, scoping remote fee earners, and CE or CE+. Certify from £320 + VAT. - Cyber Essentials for charities Cyber Essentials for charities: what the Charity Commission expects, whether free funding still exists, how volunteers' devices are scoped and what it costs. - Small business cyber security Small business cyber security made practical: the threats UK SMEs face, a step-by-step plan, a checklist, where Cyber Essentials fits and when to add a pentest. Last reviewed October 2026 by the Sovereign Secure assessment team. div]:shrink-0 xl:[&>nav]:min-h-0 xl:[&>nav]:overflow-y-auto"> FAQ ## Frequently asked questions Is Cyber Essentials mandatory in my sector? + For most private organisations it is not a legal requirement. It is required for many central government contracts that involve personal information or certain ICT services, and many public bodies and larger companies ask suppliers for it. See is Cyber Essentials mandatory? for the detail. Does PCI DSS apply to charities and schools that take card payments? + Yes. PCI DSS applies to any organisation that accepts, stores, processes or transmits payment card data, including charities taking donations and schools taking payments. Most smaller organisations validate with a Self-Assessment Questionnaire chosen by how they take payments. Does DORA apply to UK firms? + DORA is an EU regulation that has applied to EU financial entities since 17 January 2025. UK firms feel it when they belong to an EU group or provide ICT services to EU financial entities, which must manage that third-party risk under DORA. Our DORA guide explains the requirements. Is the NHS DSPT the same as Cyber Essentials? + No. The Data Security and Protection Toolkit is an annual self-assessment for organisations with access to NHS patient data and systems, while Cyber Essentials certifies five technical controls. They overlap on basic controls, but neither replaces the other. See our NHS DSPT guide. Do you only work with financial services firms? + No. Payment security is our deepest specialism, and our guide to cyber security for financial services covers banks, payment firms, lenders and insurers, but we certify Cyber Essentials for organisations of every size and provide ISO consultancy and penetration testing across all sectors. Can one assessment cover several standards? + Usually not, because each standard has its own assessment or certificate. Evidence can be shared, though: one penetration test report can support both PCI DSS and ISO 27001, so planning the work together avoids duplication. --- # ISO 13485 Explained: Requirements and Certification (UK) URL: https://sovereignsecure.co.uk/iso-13485-certification/ ISO 13485 medical devices ## ISO 13485 Certification: QMS Consultancy for Medical Devices ISO 13485 consultancy for medical device manufacturers and their supply chain, from gap analysis to certification audit, with device penetration testing from the same team. The certification audit is carried out by an independent certification body. Get an ISO quote Compare ISO standards - Design controls, ISO 14971 risk management and supplier control - Explained against UK, EU and US device rules - Device, firmware and companion app penetration testing alongside The short answer ISO 13485 is the international standard for quality management systems in the medical device industry. The current edition, ISO 13485:2016, requires documented control of design, risk, suppliers, production, traceability, complaints and reporting to regulators. Certification is voluntary, but UK approved bodies and EU notified bodies use it as the quality system benchmark, and the US FDA's QMSR incorporates it. ISO 13485 is the international standard for quality management systems (QMS) in the medical device industry. It sets out how an organisation that designs, makes, supplies or services medical devices must control design, risk, suppliers, production, traceability, complaints and reporting, so that devices are consistently safe and effective and meet regulatory requirements. The current edition is ISO 13485:2016. Certification is voluntary, but it is the benchmark regulators, notified bodies and customers use to judge a device maker’s quality system. Sovereign Secure provides ISO 13485 consultancy, from gap analysis to certification audit, as part of our wider ISO certification service. We do not issue certificates: the audit is carried out by an independent certification body. Because device security is now part of regulatory evidence, we can also test the device itself. ## What is ISO 13485? (in plain English) In plain English, ISO 13485 is the rulebook a medical device business follows to prove it makes safe devices the same way every time, and can show a regulator the records to back that up. Its full title is Medical devices: quality management systems, requirements for regulatory purposes, and it is the standard a medical device QMS is built and audited against. The ISO 13485:2016 listing shows the current, third edition. It is based on the older ISO 9001:2008 structure rather than the clause 4 to 10 structure of modern management system standards, and it stands alone: an ISO 13485 certificate does not imply ISO 9001 conformity, or the other way round. Aspect | ISO 9001 | ISO 13485 Purpose | Customer satisfaction and continual improvement | Safe, effective devices and regulatory compliance Structure | Clauses 4 to 10 | Clauses 4 to 8 Risk | Risks and opportunities for the QMS | Product risk management throughout realisation, plus a risk-based approach to QMS processes Documentation | Flexible: document what you need | Many required documented procedures and a medical device file per device type or family Improvement | Continual improvement | Maintain effectiveness; preventive action kept as a requirement Software | No specific requirement | Validation of software used in the QMS, production and monitoring ## Who needs ISO 13485 certification? ISO 13485 applies to any organisation involved in one or more stages of a medical device’s life cycle, and to suppliers that provide products or services to them. Organisation | Why ISO 13485 matters Device manufacturers | EU law requires a QMS, UK and EU conformity assessment for many devices includes a QMS audit, and ISO 13485 is the recognised benchmark Software developers whose software is a medical device | The software is regulated as a device, so the same QMS expectations apply Contract manufacturers and component suppliers | Manufacturers must control suppliers in proportion to risk, and often require certification Sterilisation, calibration and servicing providers | Outsourced processes stay the manufacturer’s responsibility and are audited through the supply chain Distributors and importers | Storage, handling and traceability requirements, often written into contracts Our healthcare cyber security page covers the wider security picture for providers and their suppliers. ## What are the ISO 13485 requirements? ISO 13485 requirements sit in clauses 4 to 8. Design and development (7.3) can only be excluded where device regulations allow it, and other requirements in clauses 6, 7 and 8 can be marked not applicable only where you do not carry out that activity. Clause | What it requires | Common gap 4 Quality management system | Documented QMS, outsourced process control, software validation (4.1.6), medical device file (4.2.3), record retention | Software tools (eQMS, spreadsheets) never validated 5 Management responsibility | Quality policy, objectives, regulatory awareness, management review | Review that skips complaints and regulatory reporting 6 Resource management | Competence, infrastructure, work environment and contamination control | Training records without evidence of effectiveness 7 Product realisation | Risk management, design and development, purchasing, production, process validation, identification and traceability | Design changes not assessed for their effect on risk and regulatory status 8 Measurement, analysis and improvement | Feedback, complaint handling, reporting to regulators, internal audit, nonconforming product, corrective and preventive action | Complaints closed without deciding whether they are reportable ## Design controls (clause 7.3) Design controls cover planning, inputs, outputs, review, verification, validation, transfer to production, control of changes and a design and development file for each device type or family. Auditors sample the trail from user needs and regulatory requirements to verified outputs, and check that every design change was reviewed for its effect on safety, performance and risk. ## Risk management with ISO 14971 ISO 13485 requires documented risk management processes throughout product realisation (clause 7.1). The method used almost everywhere is ISO 14971:2019, which covers identifying hazards, estimating and evaluating risks, controlling them, judging residual risk and collecting production and post-production information. ## Supplier control and records Suppliers must be evaluated, selected and monitored using criteria proportionate to the risk of what they supply (clause 7.4), and outsourced processes stay your responsibility. Records must be kept for at least the lifetime of the device as you define it, and never less than two years from release, or longer where regulations require. ## How does ISO 13485 fit UK, EU and US medical device regulation? ISO 13485 certification sits beside device regulation, not in place of it. This is an overview, not regulatory advice: your notified body, UK approved body or regulatory adviser confirms the route for each device. Market | Law and regulator | Where ISO 13485 fits Great Britain | Medical Devices Regulations 2002 (as amended), regulated by the MHRA; UKCA marking | A UK approved body assesses the QMS where third-party conformity assessment is required European Union and Northern Ireland | EU MDR (2017/745) and IVDR (2017/746); CE marking | Manufacturers must run a QMS; EN ISO 13485 is a harmonised standard, and notified bodies assess the QMS for many device classes United States | FDA Quality Management System Regulation (21 CFR Part 820) | Incorporates ISO 13485:2016 by reference from 2 February 2026; the FDA inspects manufacturers itself and does not require ISO 13485 certificates Several markets at once | Medical Device Single Audit Program (MDSAP) | One audit against ISO 13485 plus the requirements of the participating regulators In Great Britain, CE marked devices can currently be placed on the market until 30 June 2028 or 30 June 2030 at the latest (or earlier, if an EU directive certificate expires first), depending on the device and the EU legislation it meets, and the government has said it will consult on recognising CE marking indefinitely. Check the MHRA’s guidance on regulating medical devices in the UK for the current position. ## What cyber security evidence do medical device makers need? Regulators now expect connected devices and device software to show that security was designed in and verified. The EU MDR’s general safety and performance requirements (Annex I, section 17) require software to be developed to the state of the art, taking account of risk management including information security, and require manufacturers to set out the minimum IT security measures, including protection against unauthorised access, needed to run the software as intended. The Medical Device Coordination Group’s guidance MDCG 2019-16 explains how manufacturers can meet these requirements, and in the US, section 524B of the Federal Food, Drug, and Cosmetic Act sets cyber security requirements for “cyber devices”, including a software bill of materials. ISO 13485 is where that evidence lives. Security requirements are design inputs (7.3.3), security testing is design verification (7.3.6), security risks are handled in your ISO 14971 process, and vulnerability reports arrive through feedback and complaint handling (8.2). IEC 81001-5-1 gives a security life cycle that fits alongside it. Independent testing gives auditors and regulators the verification evidence they look for: - Hardware and IoT penetration testing of the device, its firmware, debug interfaces and wireless links such as Bluetooth. - Mobile app penetration testing of the companion app, plus testing of the cloud services and APIs the device talks to. - Source code review of device and backend software before release. Test reports and retest results can then be kept as design verification records, showing that security risk controls were implemented and are effective. One point on scope: the EU Cyber Resilience Act does not apply to products covered by the MDR or IVDR, so device cyber security is assessed under those regulations. Connected products you sell that are not themselves medical devices may fall under the Cyber Resilience Act instead. ## How do you get ISO 13485 certification? You get ISO 13485 certification by building and running a medical device QMS, then passing a two-stage audit by an independent certification body. - Agree the scope: which sites, device types and life cycle stages (design, production, servicing, distribution) the certificate must cover, and which regulatory markets it supports. - Run a gap analysis against clauses 4 to 8, including which requirements can be justified as not applicable. - Build the QMS: quality manual, documented procedures, the medical device file for each device type or family, and record controls. - Put design control and risk management in place, linking design files to an ISO 14971 risk management file. - Control suppliers and outsourced processes, with quality agreements where needed. - Run the QMS long enough to produce records: complaints, nonconforming product, supplier monitoring, training and validation. - Complete an internal audit and a management review. - Stage 1 audit: the certification body reviews your documentation and readiness. - Stage 2 audit: the certification body samples records and interviews staff, then decides on certification. The certificate lasts three years, with surveillance audits in between. ## How long does ISO 13485 certification take? There is no fixed timescale. It depends on what you do and how much of the system already exists. Factor | Shortens the project | Lengthens the project Design activity | No design (for example, distribution or contract services) | New device designs with incomplete design files Existing systems | ISO 9001 or a working QMS already in place | No documented procedures Outsourcing | Few, well-controlled suppliers | Critical processes such as sterilisation outsourced without agreements Software | Validated tools already in use | Unvalidated eQMS, spreadsheets or production software Whatever the starting point, the QMS must run long enough to produce the records an auditor samples, including an internal audit and a management review, before Stage 2. If you already hold ISO 9001, our ISO 9001 consultancy team can show where your existing system meets ISO 13485 and where it does not. ## How much does ISO 13485 certification cost? There is no fixed price. ISO 13485 certification cost depends on what you do across the device life cycle, and it has two parts: the certification body’s audit fees over the three-year cycle and any consultancy you buy to get ready. These drivers move both: Cost driver | Why it changes the cost People in scope | Certification bodies set audit days largely from headcount Design activity | Designing devices brings design control and design files into scope, which takes more audit and consultancy time Device types and risk class | More device families and higher-risk devices mean more medical device files and risk management files to build and sample Sites and outsourced processes | More locations, and critical outsourced processes such as sterilisation, widen the audit Existing systems | An ISO 9001 system or validated eQMS reduces the work Regulatory route | A notified body, UK approved body or MDSAP audit adds requirements beyond the certificate itself Budget for the full three-year cycle, not just the first audit. We give you a fixed quote for the consultancy once we know your scope. ## How does an ISO 13485 consultant help? An ISO 13485 consultant builds the QMS with you and prepares you for the certification audit. Our route has six steps: - Gap analysis against every clause, with a prioritised plan. - QMS design and procedures, including the medical device file and record controls, written to fit how you work. - Design control and risk management, linking design files to your ISO 14971 risk management file. - Supplier and outsourced process controls, with quality agreements where they are needed. - Internal audit and management review, carried out impartially before the certification audit. - Certification audit support at Stage 1 and Stage 2, and help closing any findings. The independent certification body makes its own decision. ## Why Sovereign Secure - We hold ISO 27001 ourselves, so we know the certified side of an audit. - Quality and security from one team: ISO 13485 consultancy plus hardware, firmware, mobile, cloud and API penetration testing, including point-of-sale and PIN entry devices. - Independent certification. We never certify a system we helped build, and we are not a notified body or UK approved body. Our partner certification body is MQA International; we confirm the certification body for your ISO 13485 scope when we quote. - A UK company since 2012, headquartered in Accrington, Lancashire, with offices in Los Angeles, Singapore, Dubai and Dhaka. ## Get an ISO 13485 quote Tell us what you do across the device life cycle, your device types and classes, the markets you sell into, how many people and sites are in scope and any certificates you already hold. We will scope the consultancy, and any device testing, and send a fixed quote. Request your ISO 13485 quote or call +44 161 523 5276. Last reviewed October 2026 by the Sovereign Secure assessment team. div]:shrink-0 xl:[&>nav]:min-h-0 xl:[&>nav]:overflow-y-auto"> FAQ ## Frequently asked questions What is ISO 13485? + ISO 13485 is the international standard for a medical device quality management system, written for regulatory purposes. The current edition is ISO 13485:2016. Who needs ISO 13485 certification? + Medical device manufacturers, and increasingly the organisations that supply them: contract manufacturers, component and software suppliers, sterilisation and calibration providers, and distributors. Customers often make it a supplier requirement. How long does ISO 13485 certification take? + It depends on whether you design devices, how many processes you outsource and how complete your records already are. The system must run long enough to produce records, an internal audit and a management review before the Stage 2 audit. Is ISO 13485 mandatory in the UK? + No, the certificate is not a legal requirement in itself. But for many device classes UKCA or CE marking involves a UK approved body or EU notified body assessing your quality management system, EU law requires every manufacturer to run one, and ISO 13485 is the standard that system is normally built and assessed against. What is the difference between ISO 13485 and ISO 9001? + ISO 9001 is a general quality standard focused on customer satisfaction and continual improvement. ISO 13485 is specific to medical devices, focuses on safety, effectiveness and regulatory compliance, and requires far more documented procedures and records. Does an ISO 13485 certificate let me CE or UKCA mark a device? + No. CE and UKCA marking depend on the conformity assessment route for your device's class, which for many devices involves a notified body or UK approved body. An ISO 13485 certificate does not replace that assessment. Which edition of ISO 13485 applies? + ISO 13485:2016, the third edition, is the one you are certified against. In Europe it is published as EN ISO 13485:2016+A11:2021, and in the US the FDA's Quality Management System Regulation has incorporated ISO 13485:2016 by reference since 2 February 2026. Can Sovereign Secure certify us to ISO 13485? + No. We provide the consultancy and an independent certification body carries out the audit. Certification bodies must stay impartial under ISO/IEC 17021-1, so the organisation that helps build your QMS cannot also certify it. --- # PCI 3DS Compliance Assessment & Audit | 3DS Assessor URL: https://sovereignsecure.co.uk/pci-services/3ds-assessments/ PCI 3DS Core Security Standard · 3DS Assessor ## PCI 3DS Compliance Assessments for ACS, Directory Server and 3DS Server Providers Sovereign Secure is listed by the PCI Security Standards Council as a 3DS Assessor for Europe, the USA, Canada, CEMEA and Asia Pacific. We assess PCI 3DS compliance for the environments that run 3-D Secure, against the PCI 3DS Core Security Standard, and produce the Report on Compliance and Attestation of Compliance the payment brands ask for. Get a PCI quote Free PCI compliance check - PCI SSC-listed 3DS Assessor in five regions - Part 1 planned with your PCI DSS assessment - QSA, QPA, CPSA and P2PE approvals in one team The short answer A PCI 3DS assessment checks that an organisation running a 3DS Server, Directory Server or Access Control Server meets the PCI 3DS Core Security Standard. A PCI SSC-qualified 3DS Assessor tests the baseline controls (Part 1) and the 3DS-specific controls (Part 2), then records the results in a 3DS Report on Compliance and Attestation of Compliance. A PCI 3DS assessment is how an organisation that runs part of the 3-D Secure infrastructure proves PCI 3DS compliance. A 3DS Assessor qualified by the PCI Security Standards Council (PCI SSC) tests your 3DS environment against the PCI 3DS Core Security Standard, then documents the results in a 3DS Report on Compliance (ROC) and Attestation of Compliance (AOC) for the payment brands, acquirers and issuers that rely on your service. Sovereign Secure is listed by the PCI SSC as a 3DS Assessor for Europe, the USA, Canada, CEMEA (Central Europe, Middle East and Africa) and Asia Pacific. We are also a Qualified Security Assessor (QSA) company, so the PCI DSS assessment that most 3DS providers also need can be planned alongside the 3DS work, by the same team. ## Who needs a PCI 3DS assessment? The standard applies to organisations that perform or provide the three core 3-D Secure functions defined in EMVCo’s 3DS specification. Whether you must validate, and how often, is set by the payment brands’ compliance programmes, so the trigger is usually a brand, an issuer or an acquirer asking for your AOC. 3DS component | Usually operated by | What it does 3DS Server (3DSS) | Payment gateways, payment service providers and specialist 3DS providers, on behalf of merchants | Starts each authentication request with transaction and device data Directory Server (DS) | The payment brands, or operators acting for them | Routes messages between 3DS Servers and the right issuer Access Control Server (ACS) | Issuers, or ACS providers acting for them | Decides whether to approve without friction or challenge the cardholder Third-party services | Hosting, HSM, managed security and other providers to the above | May need to meet the requirements that apply to the service they provide Merchants that use 3-D Secure through their gateway to cut card-not-present fraud do not normally need a 3DS assessment of their own. Our guide to what PCI 3DS is and how 3-D Secure works explains the protocol and the merchant’s position. ## What does a PCI 3DS assessment cover? It covers your 3DS data environment (3DE): every system component that stores, processes or transmits 3DS sensitive data, plus the systems that can affect its security. The PCI 3DS Core Security Standard splits the requirements into two parts, and the PCI 3DS Data Matrix identifies which 3DS data elements count as sensitive and which key types need HSM protection. Part | What we test | Can PCI DSS results be used? Part 1: Baseline Security Requirements | General security controls common to many standards: security policies, network security, secure systems, vulnerability management, access management, physical security and incident response | Yes, where the 3DE and cardholder data environment are combined, PCI DSS has been validated for every 3DS component, and your acquirer or the brands agree Part 2: 3DS Security Requirements | Controls specific to 3DS: validating the scope of the 3DE, security governance, protecting 3DS systems, applications and data, logical access, cryptography and key management, and physically securing 3DS systems | No: Part 2 is always assessed directly Not every requirement applies to every component. The PCI SSC’s FAQs, for example, make the data centre and CCTV requirements in P2-7 mandatory for Directory Server and ACS systems but only recommended where a location hosts a 3DS Server alone, so scoping by function matters. The published standard is v1.0, released in 2017 and supported by technical FAQs, which the PCI SSC treats as a mandatory part of the standard, and the Data Matrix. The PCI SSC consulted on a draft v2.0 from December 2023 to January 2024. We confirm the version in force when we scope, and you can check the PCI SSC 3DS Core page yourself. ## What do you receive as proof of PCI 3DS compliance? You receive two documents, both in the PCI SSC’s templates: - A 3DS Report on Compliance. The detailed record of how each applicable requirement was tested and what was found. Where Part 1 relies on your PCI DSS validation, the report documents that coverage. - A 3DS Attestation of Compliance. The summary you give to the payment brands, acquirers or issuers that ask for evidence of PCI 3DS compliance. Unlike P2PE, there is no public PCI SSC list of 3DS-compliant entities, so the AOC is your proof. Validating PCI 3DS Part 1 does not replace your PCI DSS obligations, and a 3DS assessment cannot be used for PCI DSS validation. ## How does a PCI 3DS audit run? Each PCI 3DS audit follows the same five stages: - Scoping. We confirm which 3DS functions you perform, map the 3DE with you, identify HSMs, sites and third parties, and agree whether Part 1 will rely on PCI DSS or be assessed directly. - Readiness review (optional). A gap assessment against both parts of the standard, often focused on key management and HSM procedures, where 3DS environments most often need work. Advisory and assessment work are kept separate. - Fieldwork. We review documents and records, interview staff, examine configurations and logs, sample systems and observe processes such as key management and access reviews. Sites are visited where the testing procedures call for observation. - Reporting. We write the 3DS ROC and AOC, put them through our internal quality review and agree the findings with you before they are signed. - The next cycle. The brands set how often you revalidate. We can line up your next 3DS and PCI DSS assessments so evidence is collected once. How long it takes depends on your environment and readiness, so we give you a plan with dates after scoping rather than a standard timescale. ## How does PCI 3DS relate to PCI DSS, PCI PIN and P2PE? PCI 3DS and PCI DSS are separate, independent PCI security standards, but most 3DS providers need both, because a 3DS Server or ACS usually handles card numbers too. Standard | Assessor programme | Where it meets PCI 3DS PCI DSS | QSA | Applies wherever account data is stored, processed or transmitted. It can support Part 1 if the 3DE was in scope, but never Part 2. An entity handling only payment tokens for 3DS may fall outside PCI DSS PCI PIN Security Requirements | QPA | No formal link, but the same key management disciplines, such as dual control, split knowledge and HSM management, run through Part 2 PCI P2PE | P2PE Assessor | Covers card-present encryption rather than online authentication; relevant to providers that offer both channels EMVCo 3DS approval | Lab testing, not a PCI programme | Confirms your 3DS product works to EMVCo’s specification; it does not assess the security of your environment Planning the PCI DSS assessment and the 3DS assessment together, with aligned scope and timing, reduces duplicated evidence. Most 3DS providers are also PCI DSS service providers, which our page on PCI DSS for service providers covers. 3DS Servers and Access Control Servers expose APIs and web interfaces to the internet, so independent API penetration testing and PCI penetration testing are a sensible part of preparing for both assessments. ## Why Sovereign Secure for PCI 3DS assessments? - A listed 3DS Assessor. Sovereign Secure Ltd is on the PCI SSC 3DS Assessor list for Europe, the USA, Canada, CEMEA and Asia Pacific. We checked the listing on 13 October 2026, and you should check it yourself. - QSA and 3DS Assessor in one company. If Part 1 is to rely on your PCI DSS validation, one team can make sure the PCI DSS scope covers the 3DE and the timing works. - Key management depth. As a Qualified PIN Assessor and P2PE Assessor we already assess HSMs, key ceremonies and cryptographic key management, which is where Part 2 is most demanding. - Five PCI SSC approvals. QSA, QPA, CPSA, P2PE Assessor and 3DS Assessor, and a member of the PCI SSC Global Executive Assessor Roundtable for 2026 to 2028. - International reach. Headquarters at 16 Whalley Road, Accrington, Lancashire, with offices in Los Angeles, Singapore, Dubai and Dhaka. - Fixed quotes. You get a fixed price after a short scoping call, so you know the cost before work starts. ## Talk to a 3DS Assessor Tell us which 3DS functions you run, where your environment is hosted, whether you already validate PCI DSS and who is asking for your AOC. We will confirm the scope and send a fixed quote. Contact our PCI team or call +44 161 523 5276. Last reviewed October 2026 by the Sovereign Secure assessment team. div]:shrink-0 xl:[&>nav]:min-h-0 xl:[&>nav]:overflow-y-auto"> FAQ ## Frequently asked questions Who has to be PCI 3DS compliant? + Organisations that perform or provide 3DS Server, Directory Server or Access Control Server functions. Third parties whose services can affect the security of those environments may need to meet the requirements that apply to them. Whether and how often you must validate is set by the payment brands' compliance programmes. Do merchants need a PCI 3DS assessment? + Not usually. Merchants that use a 3DS service from a gateway or payment provider do not need their own assessment, though they should ask the provider for evidence that it is validated. They still validate PCI DSS in the normal way. Can our PCI DSS assessment cover Part 1 of PCI 3DS? + Sometimes. Where the 3DS and cardholder data environments are combined and PCI DSS has been applied and validated for every 3DS system component, the PCI SSC allows those results to be used for Part 1, if your acquirer or the payment brands agree. They can never be used for Part 2, and the 3DS Assessor records the PCI DSS coverage in the 3DS Report on Compliance. Does the PCI SSC list companies that are PCI 3DS compliant? + No. The PCI SSC says it has no plans to list entities assessed to the 3DS Core Security Standard. Your Attestation of Compliance is the evidence you share with the payment brands, acquirers or issuers that ask for it. Which version of the PCI 3DS Core Security Standard applies? + The published standard is v1.0, released in 2017 and supported by technical FAQs and the PCI 3DS Data Matrix. The PCI SSC consulted on a draft v2.0 from December 2023 to January 2024, so we confirm the version in force when we scope your assessment. Is PCI 3DS the same as EMVCo 3DS certification? + No. EMVCo approves 3DS products, such as Access Control Server software, for functional conformance with its 3-D Secure specification after lab testing. PCI 3DS is a security assessment of the environment where those products run. The two are separate, and an operator may be asked for evidence of both. Do you assess 3DS SDKs? + This page covers the 3DS Core Security Standard, which is what our 3DS Assessor listing relates to. 3DS SDKs, the software inside merchant apps, are covered by a separate PCI SSC standard and assessor programme. How long does a PCI 3DS assessment take? + It depends on the size of your 3DS environment, how many sites and HSMs are involved, whether Part 1 can rely on PCI DSS, and how ready your evidence is. We agree a plan with dates after scoping rather than quoting a standard timescale. --- # PCI Scanning UK: Quarterly ASV Scans (PCI DSS 11.3.2) URL: https://sovereignsecure.co.uk/pci-services/asv-scanning/ PCI DSS Requirement 11.3.2 ## PCI ASV Scans: Quarterly PCI Compliance Scanning Quarterly external scans for PCI DSS Requirement 11.3.2, run through our PCI SSC Approved Scanning Vendor partner and managed by a QSA company that handles scoping, result reviews, disputes and rescans for you. Get a PCI quote Free PCI compliance check - Scans run by a PCI SSC-listed Approved Scanning Vendor - Managed by a PCI SSC QSA company and GEAR member - False-positive disputes and rescans handled for you The short answer An ASV scan is the external vulnerability scan PCI DSS Requirement 11.3.2 requires at least once every three months, run by a PCI SSC Approved Scanning Vendor against every internet-facing IP address and domain in scope. To pass, no component can have an unresolved vulnerability with a CVSS base score of 4.0 or higher. An ASV scan, often just called a PCI scan, is the external vulnerability scan that PCI DSS v4.0.1 Requirement 11.3.2 asks for. At least once every three months, a PCI SSC Approved Scanning Vendor (ASV) scans every internet-facing IP address and domain in scope. You fix or dispute what it finds and rescan until the ASV issues a passing report. If your validation includes Requirement 11.3.2, you need four passing scans a year, one in each three-month period. Sovereign Secure is not an ASV. Your scans run through our PCI SSC Approved Scanning Vendor partner, and we manage the programme around them: scope, result reviews, false-positive disputes with the ASV, and rescans timed around your PCI DSS assessment. As a PCI SSC-approved Qualified Security Assessor (QSA) company, we read an ASV report the way an assessor does. ASV scanning is one part of our PCI DSS compliance services. ## What is an Approved Scanning Vendor? An Approved Scanning Vendor is a company the PCI Security Standards Council has qualified to run external scans for PCI DSS, using a scan solution the Council has tested. Only a company on the PCI SSC list of Approved Scanning Vendors can produce a report that meets Requirement 11.3.2. Output from any other scanner does not count. ASVs follow the Council’s ASV Program Guide (in the PCI SSC document library), which sets the rules for scope, failures and disputes. Each report has three parts: an Attestation of Scan Compliance signed by you and the ASV, a summary by component, and the vulnerability details. ## Who needs a PCI ASV scan? Anyone whose validation includes Requirement 11.3.2. Your acquirer can also ask for scans, so check its compliance portal; our guide to Worldpay PCI compliance shows how one acquirer’s programme handles them. If you are unsure of your questionnaire, our guide to which PCI SAQ you need walks through the options. How you validate | ASV scans required? Report on Compliance (Level 1) | Yes, a passing scan in every three-month period SAQ D, merchant or service provider | Yes, all internet-facing systems in scope SAQ C and SAQ B-IP | Yes, the public IP addresses of the payment environment SAQ A-EP | Yes, the servers that deliver or affect your payment page SAQ A (v4.0.1) | Yes, the website that redirects to or embeds the payment form SAQ B, SAQ C-VT and SAQ P2PE | Not in the questionnaire ## How our managed ASV scan service works The ASV runs the scan and decides pass or fail. We do the work around it. Task | You | ASV partner | Sovereign Secure Scope | Sign it off | Scans what is declared, flags anything else found | Builds the list from your CDE diagram and DNS Scan | Let the scanner through your IPS and WAF | Scans with its approved solution | Schedules each quarter Pass or fail | - | Decides | Explains each failure in plain English Fixes | Patch and reconfigure | - | Prioritises the work Disputes | Supply evidence | Accepts or rejects | Prepares the dispute with you Evidence | Upload to your acquirer if asked | Issues the attested report | Maps reports to your SAQ or ROC ## What does an ASV scan cover? Every externally facing IP address and domain that is part of your cardholder data environment (CDE) or gives a route into it. An ASV vulnerability scan looks at those systems from the internet, without logging in, for known vulnerabilities and weak configurations. You declare the scope, and anything else the ASV discovers must be scanned or explained. Typical in-scope component | Why Web servers and e-commerce sites | They take, redirect to or embed the payment page Firewalls, routers and VPN gateways | They sit on the CDE boundary Load balancers, reverse proxies and WAFs | The scan must reach the services behind them Cloud and hosted public IPs | Yours to scan unless your provider’s ASV evidence covers them The scan must run without interference: a scan blocked by your intrusion prevention system or WAF cannot give a valid result. A PCI vulnerability scan of this kind is narrower than an internal scan or a penetration test. If you are new to scanning, our guide to what a vulnerability scan is explains the basics. ## What counts as a passing ASV scan? A scan passes when no component in scope has a vulnerability with a CVSS base score of 4.0 or higher, apart from any the ASV has accepted on dispute. The Program Guide also fails some findings whatever their score. Finding | Result CVSS 0.0 to 3.9 | Pass (still worth fixing) CVSS 4.0 or higher | Fail until fixed or a dispute is accepted SQL injection or cross-site scripting | Fail Operating system no longer supported by its vendor | Fail Database reachable from the internet | Fail SSL or early TLS, or a backdoor or malware | Fail Special notes, such as remote-access software | Not a fail on its own; you confirm the business need and how it is secured ## What happens if you fail an ASV scan? A failed scan is not a failed quarter. You fix the findings or dispute them with evidence, then rescan until that three-month period has a passing result. - Triage. We sort each failure into real vulnerability, false positive, compensating control or out of scope. - Remediate. Your team fixes the real issues, working from our priority list. - Dispute. We prepare the evidence, for example proof that a Linux distribution backported a fix while the version banner still shows the old number. - ASV review. The ASV accepts or rejects each dispute and records accepted exceptions in the report. - Rescan. Several reports can be combined to show everything in scope passed in that period. ## Quarterly ASV scan calendar Scan early in each three-month period so there is time to fix, dispute and rescan before it ends. Your periods do not have to follow calendar quarters; this example assumes they do. Period | First scan | Passing report by January to March | Early January | Early March April to June | Early April | Early June July to September | Early July | Early September October to December | Early October | Late November, before any peak-trading change freeze Your assessor will look for a passing scan in each of the four periods before your SAQ or ROC date. In your first year, four passing scans are not required if your most recent scan passed, you have a documented three-monthly scanning process, and earlier findings were fixed and rescanned. After any significant change, Requirement 11.3.2.1 also calls for an external scan, which need not be run by an ASV. ## ASV scans vs internal scans and penetration tests PCI DSS needs all three; none replaces the others. Aspect | ASV scan (11.3.2) | Internal scan (11.3.1) | Penetration test (11.4) Viewpoint | From the internet | Inside your network | Both Who runs it | A PCI SSC-listed ASV only | Qualified, independent staff or a third party | Qualified, independent tester Method | Automated, unauthenticated | Automated, authenticated (11.3.1.2) | Manual exploitation Frequency | Every three months | Every three months and after significant change | Every 12 months and after significant change Must fix | CVSS 4.0+ and automatic fails | High-risk and critical findings | Exploitable vulnerabilities, then retest We run authenticated internal scans through our vulnerability scanning services and carry out PCI DSS penetration testing, including segmentation tests, on the same schedule. ## Preparing for your first ASV scan - Know your scope. Reconcile your asset list with DNS, so the ASV does not find forgotten subdomains first. - Shrink the attack surface. Close remote management and database ports that need not be public, patch internet-facing software, retire unsupported operating systems and disable SSL and early TLS. - Clear the way. Allowlist the ASV’s scanner in your IPS and WAF for the scan window, and gather evidence for backported patches in advance. Our guide on how to pass a PCI ASV scan covers the common failures in more detail. ## How much does an ASV scan cost? Cost depends mainly on how many IP addresses and domains are in scope. We give a fixed annual price after scoping, rather than a list price that may not fit your estate. Cost driver | Lower cost | Higher cost Scope | A handful of public IPs and one domain | Many IPs, domains and cloud endpoints Disputes | Patched, current systems | Legacy systems and backported patches needing evidence each quarter Rescans | Findings fixed before the first scan | Repeated fail, fix and rescan cycles Extras | External ASV scans only | Internal scans (11.3.1) and change-driven scans (11.3.2.1) added Some acquirers include ASV scans in their compliance portals, so check what your merchant agreement already covers. For the whole budget, including assessment and testing, see our guide to PCI compliance cost. ## Why Sovereign Secure for ASV scanning - Managed by an assessor company. We are a PCI SSC-approved QSA, Qualified PIN Assessor (QPA) and Card Production Security Assessor (CPSA) company, and a member of the PCI SSC Global Executive Assessor Roundtable (GEAR) for 2026 to 2028. - Independent evidence. Reports are produced and attested by our ASV partner, not by us. - One plan. Scans, penetration tests and your PCI DSS audit can share one set of dates. - UK head office in Accrington, Lancashire, with offices in Los Angeles, Singapore, Dubai and Dhaka. Clients include Fiserv, Cashplus and Ticketmaster. ## Get a quote for PCI ASV scanning Send us your public IP addresses and domains, your SAQ type or ROC date, and your last ASV report if you have one. We will confirm the scope and come back with a fixed annual price. Contact us or call +44 161 523 5276. Last reviewed October 2026 by the Sovereign Secure assessment team. div]:shrink-0 xl:[&>nav]:min-h-0 xl:[&>nav]:overflow-y-auto"> FAQ ## Frequently asked questions What is an ASV scan? + An ASV scan is an external vulnerability scan of your internet-facing systems, run at least once every three months by a company on the PCI SSC list of Approved Scanning Vendors. It meets PCI DSS Requirement 11.3.2, and the ASV's attested report is the evidence your acquirer or QSA accepts. What does ASV stand for? + ASV stands for Approved Scanning Vendor: a company the PCI Security Standards Council has qualified to run the quarterly external scans that PCI DSS Requirement 11.3.2 requires. Sovereign Secure is a QSA company, not an ASV, so your scans run through our PCI SSC Approved Scanning Vendor partner. Who needs a PCI ASV scan? + Any merchant or service provider whose SAQ or Report on Compliance includes Requirement 11.3.2. Under PCI DSS v4.0.1 that covers a ROC, SAQ D, SAQ C, SAQ B-IP, SAQ A-EP and SAQ A. Our guide to which PCI SAQ you need helps you check. What happens if I fail an ASV scan? + You fix the failing items, or dispute false positives with evidence, then rescan until the ASV issues a passing report for that three-month period. We triage the results, prepare disputes and plan the rescans with you. How long does a PCI scan take? + The scan itself is automated, so its length depends mainly on how many IP addresses and domains are in scope. Reaching a passing report takes longer when findings need fixing, disputes need evidence or several rescans are needed, which is why we schedule the first scan early in each three-month period. Which vendors are approved for PCI scanning? + Only companies on the list of Approved Scanning Vendors that the PCI Security Standards Council publishes and keeps up to date. Your scans run through our PCI SSC Approved Scanning Vendor partner, a listed ASV, and you can check any vendor on the PCI SSC ASV list. Can I use any vulnerability scanner for PCI DSS? + Not for the quarterly external scans in Requirement 11.3.2, which must be run by a PCI SSC-listed ASV using its approved solution. Internal scans (11.3.1) and external scans after a significant change (11.3.2.1) can be run by any qualified, organisationally independent person. Is Sovereign Secure an ASV? + No. Sovereign Secure is a PCI SSC Qualified Security Assessor (QSA) company, not an Approved Scanning Vendor. Your quarterly scans are run through our PCI SSC Approved Scanning Vendor partner, and our QSA team manages the scope, reviews the results and handles disputes and rescans. How serious is PCI compliance? + Serious enough to plan for: a missing or failed quarterly scan can leave your validation incomplete, which usually means a monthly non-compliance fee from your acquirer, and a breach while non-compliant costs far more. Our guide to PCI non-compliance fees and fines explains what you can be charged. Do I need an ASV scan after a significant change? + You need an external scan after any significant change (Requirement 11.3.2.1), with findings scored CVSS 4.0 or higher resolved. That scan does not have to be run by an ASV, but it must be run by qualified, independent personnel. How much does an ASV scan cost? + It depends mainly on how many IP addresses and domains are in scope, and how much help you need with disputes and rescans. We give a fixed annual price after scoping; our guide to PCI compliance cost shows how it fits your wider budget. --- # Penetration Testing Cost UK (2026): Pen Test Prices by Type URL: https://sovereignsecure.co.uk/penetration-testing-cost/ Penetration testing pricing ## Pen Test Cost in the UK: Penetration Testing Prices for 2026 Updated October 2026 Pen test cost in the UK explained: sourced price ranges by test type, what a tester-day buys, and the scoping choices that push a quote up or down. Get a fixed quote Talk to a tester - PCI SSC QSA company, GEAR member 2026 to 2028 - IASME Cyber Essentials certification body - ISO 27001 certified The short answer Pen test cost in the UK ranged from £550 for a small fixed-scope external network test to £25,000+ for a full multi-scope assessment in the published prices we reviewed in September 2026. Day rates were about £1,000 to £1,500 per tester-day, and a single web application test was priced £1,650 to £10,000+. Your price depends on how many tester-days your scope needs. Penetration testing cost in the UK runs from about £550 for a small, fixed-scope external network test to £25,000 or more for a full assessment across several scopes. In the published prices from UK providers we reviewed in September 2026, consultant day rates sat at roughly £1,000 to £1,500, and a single web application test was priced from £1,650 to £10,000+. What decides your penetration test cost is simple: how many tester-days your scope needs. This guide sets out those published ranges by test type, shows how to check what a quote actually buys, explains what pushes the price up or down, and covers where PCI DSS, ISO 27001 and Cyber Essentials Plus add cost. Sovereign Secure does not publish a pen test price list. We scope each test and give you a fixed quote, which you can start on our penetration testing quote page. ## Pen test cost by test type: UK price list (2026) UK pen test pricing comes in two shapes: fixed-price packages for a tightly defined scope, and scoped engagements priced by the day. The table shows both, using published prices from UK providers we reviewed in September 2026. It is a small sample, not a market survey, and providers do not always say whether prices include VAT. Test type | Published UK prices (Sep 2026) | What moves the price External network penetration test | £550 (1 to 5 IPs) to £3,500 (50+ IPs) as fixed packages; £3,750 to £6,250+ as scoped engagements | Live IPs, exposed services, VPN and remote access, email and DNS Internal network penetration test | From £1,800 | Sites and subnets, Active Directory size, on-site or remote access Web application penetration test | £1,650 (basic), £2,750 (advanced), £4,950 (enterprise) as packages; £6,250 to £10,000+ scoped | User roles, functions and workflows, authenticated testing, APIs behind the app Mobile app penetration test | From £1,650 | iOS, Android or both; whether the backend API is in scope API penetration test | No fixed price published in our sample | Number of endpoints, authentication methods, roles, quality of documentation Cloud penetration test | No fixed price published in our sample | Accounts or subscriptions, services in use, configuration review versus attack testing Full assessment (several scopes together) | £12,500 to £25,000+ | Number of scopes, sites and applications Consultant day rate | About £1,000 to £1,500 per tester-day | Seniority, specialism, notice period Two things stand out. The same test type can vary more than five-fold in price, because a package and a scoped engagement are not buying the same number of days. And API and cloud tests rarely carry a public price, because their size depends on endpoints, roles and cloud services that differ too much from one client to the next. ## What is the day rate for a penetration tester in the UK? UK penetration testing day rates in our September 2026 sample were about £1,000 to £1,500 per tester-day, and one provider published a flat £1,200. Almost every quote, fixed-price or not, is a day rate multiplied by an estimate of days for testing and reporting. That makes any quote easy to sanity-check: divide the price by a typical day rate to see how much consultant time you are buying. Published price | Implied consultant time at £1,000 to £1,500/day | Ask the provider £550 fixed external package (1 to 5 IPs) | About half a day | How much of this is manual testing rather than an automated scan? £3,750 to £6,250+ external engagement | About 2.5 to 6 days | How many live IPs and services does that cover? £6,250 to £10,000+ web application test | About 4 to 10 days | How many user roles, and is authenticated testing included? £12,500 to £25,000+ full assessment | About 8 to 25 days | Which scopes are included, and is a retest in the price? If two quotes for the same scope differ widely, ask each provider how many days they have allowed and what happens in those days. That one question explains most of the gap. ## What drives the cost of a penetration test? Scope drives pen testing cost. The more hosts, applications, user roles and environments a tester has to cover properly, the more days the job takes. These drivers account for most of the difference between quotes. Cost driver | Why it changes the price | How to keep it in check Number of IPs, hosts or applications | Each live target needs discovery and manual testing | Scope live assets only and retire old IPs first User roles and functions | Access-control testing is repeated for each role | Test representative roles, not every variation Authenticated (grey-box) testing | Adds time, but many serious flaws in access control and business logic only appear after login | Keep it, and supply credentials before testing starts Black-box versus white-box | Black-box testing spends paid days on discovery you could simply hand over | Share architecture diagrams and API documentation Environment and testing window | Out-of-hours testing or fragile production systems slow the work | Test a staging copy of production where one exists On-site versus remote | Travel and on-site days add cost, mostly for internal tests | Provide remote access through a VPN or a test device Compliance evidence | PCI DSS segmentation tests and mapped reporting add scope | Name the standard at scoping, not after the report Retest | Some quotes include it, others charge separately | Confirm the retest window before you sign ## Why are some pen tests so cheap? A very low price usually means you are buying an automated vulnerability scan with a report template, not a penetration test. One UK provider’s pricing guide states that anything at £300 or less is not a penetration test, and at typical day rates £300 buys a couple of hours of consultant time. A scanner finds known weaknesses by signature. A penetration tester confirms which findings are genuinely exploitable, chains lower-risk issues into real attack paths, tests the business logic and access control that no scanner understands, and removes false positives. The NCSC’s penetration testing guidance treats a pen test as a way to check that your vulnerability management works, not as a replacement for it. Signs that a cheap quote is really a scan: - no scoping questions about user roles, workflows or network layout; - the same delivery time whatever the size of your estate; - a sample report that is a list of scanner findings with no attack narrative or proof of exploitation; - no stated methodology, such as the OWASP Web Security Testing Guide for web applications. ## Pen test vs vulnerability scan: how do the costs compare? A vulnerability scan costs a fraction of a penetration test because it is mostly automated and designed to run far more often. The two do different jobs, and most organisations need both. Aspect | Vulnerability scan | Penetration test How it works | An automated tool checks for known issues | A consultant tests manually and attempts exploitation Typical frequency | Monthly or quarterly (quarterly for PCI DSS) | At least annually and after significant change Finds business-logic and access-control flaws | Rarely | Yes False positives removed | Partly | Yes Pricing basis | Per IP or asset, often a subscription | Tester-days For regular scanning, see our vulnerability scanning services. Providers that sell scanning and testing together often call the package VAPT services (vulnerability assessment and penetration testing). PCI DSS quarterly external scans must be run by a PCI SSC Approved Scanning Vendor, and Sovereign Secure delivers these through an ASV partner. ## How do PCI DSS, ISO 27001 and Cyber Essentials Plus affect cost? Compliance changes the cost mainly by fixing the scope and frequency for you. PCI DSS is the most prescriptive, ISO 27001 leaves it to your risk assessment, and Cyber Essentials Plus does not require a penetration test at all. Driver | What it requires | What it means for cost PCI DSS v4.0.1, Requirement 11.4 | Internal (11.4.2) and external (11.4.3) penetration tests at least every 12 months and after significant change; exploitable findings corrected and retested (11.4.4); segmentation controls tested every 12 months (11.4.5), or every six months for service providers (11.4.6) | At least two scopes plus segmentation testing and a retest each year; service providers pay for segmentation testing twice a year ISO/IEC 27001:2022, Annex A 8.8 and 8.29 | Management of technical vulnerabilities (8.8) and security testing in development and acceptance (8.29). Penetration testing is not named as mandatory | Scope follows your risk assessment and Statement of Applicability; a common approach is to test annually and after major changes Cyber Essentials Plus | A hands-on technical audit of a sample of devices plus an external vulnerability scan, carried out by the certification body. It is not a penetration test | Priced as a certification, not in tester-days For card-data environments, scope a PCI DSS penetration test around the cardholder data environment (CDE) and its segmentation controls from the start, so the report gives your assessor the evidence Requirement 11.4 asks for. Requirement 11.4.1 also expects a documented testing methodology. The standard and the PCI SSC’s penetration testing guidance are free from the PCI SSC document library. For ISO 27001, tie the scope to the risks and controls in your Statement of Applicability; our guide to ISO 27001 penetration testing explains how test results feed your ISMS evidence. ## Testing on a smaller budget A lower price should come from a tighter scope, not a cheaper tester: start with what attackers can reach, test live assets only, and keep manual, authenticated testing and a report your developers can act on. Our guide to affordable penetration testing for small businesses sets out what to test first and how to right-size the scope. ## How to get an accurate penetration testing quote An accurate penetration testing price needs a clear scope. Have this ready before you ask for prices: For | Information to have ready External or internal network | Number of live IPs or ranges, sites, VPN and remote access, whether Active Directory is in scope Web application or API | URLs, number of user roles, authenticated or not, API endpoints (an OpenAPI or Swagger file helps), staging or production Mobile app | iOS, Android or both, and whether the backend API is in scope Cloud | Provider (AWS, Azure, Google Cloud, Microsoft 365) and number of accounts or subscriptions Every test | Compliance driver (PCI DSS, ISO 27001, a customer contract), deadline, testing windows, retest expectations Our penetration testing quote form asks for exactly this and turns it into a fixed-price proposal. For an overview of every test type we run, see our penetration testing services, or our network penetration testing page for infrastructure scopes. ## Why Sovereign Secure Sovereign Secure Ltd is a PCI SSC-approved QSA, QPA and CPSA company, an IASME-licensed Cyber Essentials certification body and ISO 27001 certified, based in Accrington, Lancashire, and established in 2012. - Compliance-aware testing. As a QSA company and a member of the PCI SSC Global Executive Assessor Roundtable (GEAR) 2026 to 2028, we know what evidence an assessor expects from Requirement 11.4 testing. - One provider, many test types. Web applications, APIs, networks and infrastructure, cloud, mobile apps, hardware and IoT (including POS and PIN devices), wireless, AI and LLM applications, source code review, firewall review, social engineering and red team. - Trusted by regulated businesses. Clients include Accor, Fiserv, Ticketmaster and Cashplus. - UK-based, internationally present. Headquarters in Accrington, with offices in Los Angeles, Singapore, Dubai and Dhaka. ## Get a fixed penetration testing quote Tell us what you need tested and why, and we will scope it and send a fixed quote. Start with the quote form, call +44 161 523 5276 or email contactus@sovereignsecure.co.uk. Last reviewed October 2026 by the Sovereign Secure assessment team. div]:shrink-0 xl:[&>nav]:min-h-0 xl:[&>nav]:overflow-y-auto hidden"> FAQ ## Frequently asked questions How much does a pen test cost in the UK? + Published UK prices we reviewed in September 2026 ranged from £550 for a small fixed-scope external test to £25,000+ for a full multi-scope assessment. Day rates were about £1,000 to £1,500 per tester-day, so the price mostly reflects how many days your scope needs. Why do penetration testing quotes vary so much? + Quotes differ mainly in the number of tester-days allowed and how much of that time is manual testing rather than automated scanning. Divide each quote by a typical day rate and ask each provider what the tester will do with that time. Is retesting included in the price? + It depends on the provider, so check whether the quote includes a retest, how long you have to fix issues and whether the retest is remote. For PCI DSS, Requirement 11.4.4 expects exploitable findings to be corrected and the test repeated to verify the fixes. How many testing days should a quote include? + Going by published scoped prices and day rates, a single external or web application test usually represents roughly 2.5 to 10 days of consultant time, including reporting; small fixed-price packages buy less. Multi-scope assessments take longer, and a good proposal states the number of days allowed. How long does a pen test take? + Going by the published UK prices and day rates in the tables above, an external engagement represents about 2.5 to 6 tester-days, a web application test about 4 to 10 and a full multi-scope assessment about 8 to 25, including reporting. A very small scope, such as a handful of internet-facing addresses, can take under a day of testing. Calendar time is usually a little longer, because the report follows the testing. How often should a pen test be done? + At least once a year and after any significant change, such as a new application, a major release, a network redesign or a cloud migration. PCI DSS Requirement 11.4 sets that minimum for internal and external tests; our guide on how often penetration testing should be done also covers ISO 27001 and cyber insurance expectations. Do I need a penetration test for PCI DSS or ISO 27001? + PCI DSS v4.0.1 Requirement 11.4 requires internal and external penetration tests at least every 12 months and after significant change; see PCI DSS penetration testing. ISO 27001 does not name penetration testing as mandatory, but it is a common way to evidence Annex A controls 8.8 and 8.29. Is Cyber Essentials Plus priced like a penetration test? + No. Cyber Essentials Plus is not a penetration test: it is a hands-on technical audit of a sample of your devices plus an external vulnerability scan, carried out by the certification body against the Cyber Essentials controls, and it is priced as a certification; see our Cyber Essentials Plus cost guide. Can I get a pen test price without a scoping call? + Fixed-price packages exist for small, standard scopes such as a handful of external IPs. For anything larger, an accurate price needs a short scope: use our penetration testing quote form and we will send a fixed quote. --- # vCISO Services UK: Virtual and Fractional CISOs Explained URL: https://sovereignsecure.co.uk/virtual-ciso/ Security leadership ## Virtual CISO (vCISO): What a Fractional CISO Does and When You Need One Updated October 2026 A virtual CISO gives you senior security leadership for an agreed number of days rather than a full-time salary. This guide covers what the role includes, what drives the cost, where its limits are and how to choose one. Contact us Get a quote - PCI SSC QSA, QPA and CPSA company - IASME-licensed Cyber Essentials certification body - ISO 27001 certified, with ISO 27001 consultancy The short answer vCISO stands for virtual chief information security officer: an experienced security leader who works for you part-time, usually on a monthly retainer for a set number of days, rather than as an employee. A vCISO sets security strategy, owns the risk register, reports to the board and runs compliance programmes such as PCI DSS, ISO 27001 and Cyber Essentials. A vCISO (virtual chief information security officer) is a senior security leader who works for your organisation part-time, usually for an agreed number of days a month, instead of as a full-time employee. The role is the same as an in-house CISO’s: set the security strategy, own the risks, report to the board and keep compliance programmes such as PCI DSS, ISO 27001 and Cyber Essentials on track. You pay for the time and deliverables you agree, not a permanent salary. For many small and mid-sized UK firms, a virtual CISO is the most practical way to get that leadership when the workload does not justify a full-time executive. This guide explains what a vCISO does, how the different labels compare, what drives the cost, what a vCISO cannot do for you and how to choose one. ## What does a vCISO do? A vCISO turns security from a list of IT tasks into a managed programme with an owner. The typical scope looks like this: Area | Typical vCISO work | What you should receive Strategy | Assess where you are and set priorities for the next 12 months | A security roadmap the board has agreed Risk | Run risk assessments and keep the risk register current | Risk register and treatment plan Board reporting | Report risk, incidents and progress in business terms | A regular board pack Compliance programmes | Plan and run PCI DSS v4.0.1, ISO 27001:2022 or Cyber Essentials work | Project plan and evidence tracker Policies | Write and maintain the policy set staff actually follow | Approved, version-controlled policies Suppliers | Set due diligence for suppliers that handle your data or systems | Supplier register with risk ratings Incident readiness | Own the incident response plan and run exercises | Tested plan and exercise reports Security testing | Commission penetration tests and scans, then track fixes | Test schedule and remediation tracker Customer assurance | Answer security questionnaires and due diligence requests | Consistent, evidenced answers The risk work is the foundation for everything else. Our guide to cyber security risk assessment explains how that assessment is done. ## vCISO vs fractional CISO vs CISO as a service: what is the difference? The labels overlap, and none has a legal or industry-standard definition. In common use: Term | What it usually means | Typical commitment vCISO | A part-time security leader, often remote, from a firm or working independently | Agreed days per month Fractional CISO | A named individual holding your CISO role for a fixed share of each week, often part of the leadership team | Regular days each week CISO as a service | A firm-delivered retainer, with a lead adviser backed by a wider team | Retainer with a defined scope Interim CISO | A full-time leader for a fixed period, often between permanent hires | Full-time, temporary Read the contract rather than the label. It should name who does the work, how many days you get, what happens to unused days and who covers holidays and absence. ## When does a vCISO beat a full-time hire? A vCISO makes sense when you need senior judgement but not a full-time executive. Typical triggers: - A compliance deadline: a first PCI DSS assessment, an ISO 27001 certification target or a contract that requires Cyber Essentials Plus. - Customer pressure: enterprise buyers sending long security questionnaires, or investors running due diligence. - A board that wants assurance: directors who need to show they are governing cyber risk. - A gap: your security lead has left and recruitment will take months. - Specialist knowledge: your IT team is capable, but nobody has run a PCI DSS or ISO 27001 programme before. A full-time CISO is usually the better choice when security is a daily operational job: a large or complex estate, a sizeable security team to manage, round-the-clock incident leadership, or regulation that expects a dedicated executive. Many organisations use a vCISO first, then hire once the programme is built and the workload is clear. ## What happens in the first three months of a vCISO engagement? A well-run engagement starts with discovery and ends the first quarter with a roadmap the board has signed off. A typical shape: Period | Focus | Output Month 1 | Interviews, review of existing policies, contracts, incidents and previous audit or test reports | Current-state assessment and a short list of urgent fixes Month 2 | Risk assessment and agreement on any certification or compliance target, such as ISO 27001 or Cyber Essentials Plus | Risk register and draft roadmap Month 3 | Roadmap approval, policy updates and a schedule of assessments and tests | Approved roadmap and the first board report After that, the retainer usually settles into a monthly cycle of roadmap delivery, risk review and reporting. If you have a single goal, such as a first ISO 27001 certification, a fixed-scope project with a defined end point may suit you better than an open-ended retainer. ## How much does a virtual CISO cost? There is no standard price. Fees depend on how much time you buy and what is included. These are the main cost drivers: Cost driver | Lower cost | Higher cost Time | A few days a month | Several days a week Delivery | Advice and oversight only | Hands-on work: writing policies, running projects, preparing evidence Compliance load | One framework, such as Cyber Essentials | Several, such as PCI DSS as a service provider plus ISO 27001 Size and complexity | One site, one entity | Several entities, countries or cloud platforms Availability | Business hours, planned work | On call for incidents Location | Remote | Regular on-site attendance To compare a vCISO with a permanent hire, cost the hire properly: salary, employer National Insurance, pension, benefits, recruitment fees, training and the months the post may sit empty. Then ask each vCISO provider for a fixed monthly fee with defined days, deliverables and a notice period. Remember that a vCISO fee rarely covers independent assessments. A PCI DSS assessment by a Qualified Security Assessor, an ISO 27001 certification audit, Cyber Essentials certification and penetration testing are separate budget lines. ## What can a vCISO not do for you? Three limits are worth knowing before you sign: - Take on your accountability. Under ISO 27001:2022 clause 5, top management must lead the information security management system. PCI DSS v4.0.1 Requirement 12.4.1 requires executive management of service providers to take responsibility for protecting cardholder data and for the PCI DSS compliance programme. A vCISO can run the work, but your leadership still owns it. - Audit their own work. The person who designed your controls should not be the one assessing them. ISO/IEC 17021-1 bars a certification body from providing management system consultancy to the organisations it certifies, and the PCI SSC’s qualification requirements for QSAs include independence rules. Expect a separate, independent assessment. - Replace operations. A vCISO leads and decides. Monitoring alerts, patching and incident handling still need people and tools, in-house or from a managed provider. ## How do you choose a vCISO? Ask these questions before you commit: Question | Why it matters Which frameworks have you run programmes for? | PCI DSS v4.0.1 and ISO 27001:2022 experience is specific, so ask for examples Which security qualifications do you hold? | CISSP, CISM and ISO 27001 Lead Auditor or Lead Implementer are common; check them with the issuing body and weigh them against programmes actually delivered Who exactly will do the work, and who covers absence? | You are buying a person’s judgement, not a brand What will I receive each month? | Fixed deliverables stop the retainer drifting into ad hoc support How quickly will you respond during an incident? | Response times should be written into the contract Can I verify your credentials? | PCI SSC lists approved assessor companies, IASME lists Cyber Essentials certification bodies, and ISO certificates can be checked with the issuing body How do you keep advice and assessment separate? | Protects the independence of your audits What happens when we end the contract? | Policies, registers and evidence should belong to you ## How does a vCISO report to the board? A good vCISO makes board reporting routine. The UK government’s Cyber Governance Code of Practice, published in April 2025 with the NCSC, sets out what boards and directors should do under five principles: risk management; strategy; people; incident planning, response and recovery; and assurance and oversight. A vCISO can structure each board pack around those principles and use the NCSC’s Board Toolkit to brief directors. Our guide to the Cyber Governance Code of Practice covers the director actions in detail. ## Where Sovereign Secure fits Sovereign Secure provides the specialist compliance and testing work that a vCISO or in-house security lead plans and commissions: - PCI DSS: we are a PCI SSC Qualified Security Assessor (QSA) company, also approved as a Qualified PIN Assessor (QPA) and Card Production Security Assessor (CPSA), and a member of the PCI SSC Global Executive Assessor Roundtable (GEAR) 2026-2028. See our PCI DSS consultancy. - Cyber Essentials: we are an IASME-licensed certification body and issue Cyber Essentials and Cyber Essentials Plus certificates. - ISO 27001: we are ISO 27001 certified and provide ISO 27001 consultancy; certification audits are carried out by our partner certification body, MQA International. - Testing: penetration testing and vulnerability scanning across web, API, network, cloud, mobile and AI systems. Sovereign Secure Ltd was founded in 2012 and is based in Accrington, Lancashire, with offices in Los Angeles, Singapore, Dubai and Dhaka. For an overview of how these services fit together, see our cyber security consultancy page. ## Next step If you have a security roadmap, or need one, talk to us about the PCI DSS, Cyber Essentials, ISO 27001 and testing work on it, and we will give you a fixed quote for each piece. Last reviewed October 2026 by the Sovereign Secure assessment team. div]:shrink-0 xl:[&>nav]:min-h-0 xl:[&>nav]:overflow-y-auto hidden"> FAQ ## Frequently asked questions What is a vCISO? + A vCISO, or virtual chief information security officer, is a senior security leader you engage part-time or on retainer instead of hiring. They lead security strategy, risk, board reporting and compliance for an agreed number of days. How much does a virtual CISO cost? + It depends mainly on the days per month, how much hands-on delivery is included and how many frameworks you must meet. Ask for a fixed monthly fee with defined days and deliverables, and remember that assessments, certification audits and penetration tests are usually budgeted separately. What is the difference between a vCISO and a fractional CISO? + The terms overlap and neither has a formal definition. Fractional CISO usually means a named individual who holds the CISO role for a fixed share of each week and sits with your leadership team. vCISO is the broader term and is often delivered remotely by a firm. What is the difference between a CISO and a vCISO? + The job is the same: strategy, risk, board reporting and compliance. A CISO is a full-time employee on a permanent salary, while a vCISO works part-time under a contract for an agreed number of days, which suits organisations whose workload does not yet justify a full-time executive. Is CISO as a service the same as a vCISO? + Usually, yes. CISO as a service tends to describe a firm-delivered retainer where a lead adviser is backed by a wider team, rather than one independent individual. Check the contract for who does the work and what is included. Can a vCISO be responsible for our PCI DSS or ISO 27001 compliance? + A vCISO can run the programme, but accountability stays with your leadership. ISO 27001:2022 clause 5 requires top management to lead the management system, and PCI DSS v4.0.1 Requirement 12.4.1 requires executive management of service providers to take responsibility for protecting cardholder data. Do small businesses need a vCISO? + Not always. Many small firms are better served by Cyber Essentials certification and a named internal owner. A vCISO earns its fee when customers, regulators or card brands start asking for evidence you cannot produce on your own. How does Sovereign Secure work alongside a vCISO or security lead? + We deliver the specialist work a security lead commissions: QSA-led PCI DSS consultancy and assessments, Cyber Essentials and Cyber Essentials Plus certification, ISO 27001 consultancy, and penetration testing and vulnerability scanning.