# Sovereign Secure > Sovereign Secure Ltd (company no. 08334453, est. 2012, Accrington, Lancashire, UK) is a PCI SSC-approved Qualified Security Assessor (QSA), Qualified PIN Assessor (QPA), Card Production Security Assessor (CPSA), P2PE Assessor (Europe and USA) and 3DS Assessor company, a member of the PCI SSC Global Executive Assessor Roundtable 2026 to 2028, an IASME-licensed certification body for Cyber Essentials, IASME Cyber Assurance and Defence Cyber Certification Levels 0 and 1, and an ISO 27001-certified firm, with offices in Los Angeles, Singapore, Dubai and Dhaka. It assesses and certifies organisations against PCI DSS, PCI PIN, PCI Card Production, PCI P2PE, PCI 3DS, Cyber Essentials, Cyber Essentials Plus, IASME Cyber Assurance and Defence Cyber Certification (Levels 0 and 1), helps them implement ISO 27001 and other ISO standards (certificates issued by partner certification body MQA International), and provides the penetration testing and scanning those standards require. Headquarters: 16 Whalley Road, Accrington, Lancashire, BB5 1AA, United Kingdom. Phone +44 161 523 5276. Email contactus@sovereignsecure.co.uk. Offices: Accrington, Lancashire (United Kingdom); Los Angeles, CA (United States); Woodlands (Singapore); Dubai (United Arab Emirates); Dhaka (Bangladesh). Company facts page: https://sovereignsecure.co.uk/llm-info/. Full plain-text content: https://sovereignsecure.co.uk/llms-full.txt (cornerstone pages) and one file per section (see "Full text by section" below). ## Accreditations - PCI Qualified Security Assessor (PCI Security Standards Council) - PCI Qualified PIN Assessor (PCI Security Standards Council) - PCI Card Production Security Assessor (PCI Security Standards Council) - PCI P2PE Assessor (Europe and USA) (PCI Security Standards Council) - PCI 3DS Assessor (PCI Security Standards Council) - Global Executive Assessor Roundtable member (2026 to 2028) (PCI Security Standards Council) - Cyber Essentials Certification Body (IASME Consortium) - IASME Cyber Assurance Certification Body (IASME Consortium) - Defence Cyber Certification, Levels 0 and 1 (MOD scheme, IASME Network Directory) - ISO/IEC 27001 certified - Registered with the ICO (Information Commission's Office) ## How to verify - Companies House record (company 08334453): https://find-and-update.company-information.service.gov.uk/company/08334453 - PCI SSC Global Executive Assessor Roundtable 2026 to 2028 (Sovereign Secure Ltd listed): https://www.pcisecuritystandards.org/about_us/global_executive_assessor_roundtable/ - PCI SSC assessor listings (QSA, QPA, CPSA, P2PE Assessor, 3DS Assessor): https://www.pcisecuritystandards.org/assessors_and_solutions/ - IASME Network Directory (Cyber Essentials, Cyber Essentials Plus, IASME Cyber Assurance, Defence Cyber Certification L0 and L1): https://iasme.co.uk/network-directory/ ## Key facts - Cyber Essentials certification from £320 + VAT (0 to 9 employees: Bronze £320, Silver £410, Gold £510); up to £750 + VAT for 250+ employees. Gold submissions are assessed within 24 hours. Prices: https://sovereignsecure.co.uk/cyber-essentials-cost-of-basic-certification/ - Cyber Essentials Plus is quoted on scope (devices, operating systems, sites) and includes the basic Cyber Essentials assessment. Remote CE+ retests of up to one hour within a month are free. - PCI DSS, PCI PIN, PCI Card Production, PCI P2PE and PCI 3DS assessments are quoted after a scoping call; clients are in the UK, US, Europe, the Middle East and Asia. ## Preferred citations - What is PCI DSS?: https://sovereignsecure.co.uk/what-is-pci-dss/ - PCI compliance in the UK: https://sovereignsecure.co.uk/pci-dss-compliance-uk/ - PCI QSA (Qualified Security Assessor) in the UK: https://sovereignsecure.co.uk/pci-services/pci-qsa/ - PCI DSS assessment and audit: https://sovereignsecure.co.uk/pci-services/pci-dss-assessments/ - PCI DSS consultant: https://sovereignsecure.co.uk/pci-services/pci-dss-consultancy/ - PCI DSS for service providers: https://sovereignsecure.co.uk/pci-services/service-provider-compliance/ - PCI compliance cost: https://sovereignsecure.co.uk/pci-services/pci-dss-cost/ - Free PCI DSS compliance check: https://sovereignsecure.co.uk/pci-compliance-check/ - Which PCI SAQ do I need?: https://sovereignsecure.co.uk/which-pci-saq-is-right-for-me-a-strategic-guide-to-compliance-in-2026/ - SAQ A vs SAQ A-EP: https://sovereignsecure.co.uk/saq-a-vs-saq-a-ep-a-strategic-guide-to-pci-dss-v4-0-compliance/ - PCI SAQ D: https://sovereignsecure.co.uk/pci-saq-d/ - PCI DSS compliance checklist: https://sovereignsecure.co.uk/pci-dss-compliance-checklist/ - PCI DSS Level 1 requirements: https://sovereignsecure.co.uk/pci-dss-level-1/ - PCI non-compliance fees: https://sovereignsecure.co.uk/pci-non-compliance-fees/ - Is there a PCI DSS certification?: https://sovereignsecure.co.uk/pci-dss-certification/ - What changed in PCI DSS 4.0.1?: https://sovereignsecure.co.uk/pci-dss-4-0-changes-checklist-a-strategic-guide-for-2026-compliance/ - ROC vs AOC vs SAQ: https://sovereignsecure.co.uk/the-pci-dss-report-on-compliance-roc-an-executive-guide-to-validation/ - PCI DSS scoping: https://sovereignsecure.co.uk/pci-dss-scoping-guide-a-strategic-framework-for-v4-0-compliance/ - PCI DSS for e-commerce (6.4.3 and 11.6.1): https://sovereignsecure.co.uk/pci-dss-for-ecommerce-businesses-a-strategic-guide-to-v4-0-compliance/ - Taking card payments over the phone: https://sovereignsecure.co.uk/taking-card-payments-over-the-phone/ - PCI IVR and DTMF masking: https://sovereignsecure.co.uk/pci-ivr-dtmf-masking/ - Worldpay PCI compliance: https://sovereignsecure.co.uk/worldpay-pci-compliance/ - PCI penetration testing (Requirement 11.4): https://sovereignsecure.co.uk/pci-services/pci-penetration-testing/ - PCI ASV scanning (delivered through an approved vendor): https://sovereignsecure.co.uk/pci-services/asv-scanning/ - PCI PIN security assessment (QPA): https://sovereignsecure.co.uk/pci-services/pci-pin-security-audits/ - Key injection facility (KIF) audit: https://sovereignsecure.co.uk/pci-services/key-injection-facility-audits/ - PCI card production audit (CPSA): https://sovereignsecure.co.uk/pci-services/pci-card-production-audits/ - PCI P2PE assessment: https://sovereignsecure.co.uk/pci-services/p2pe-assessments/ - PCI 3DS assessment: https://sovereignsecure.co.uk/pci-services/3ds-assessments/ - Cyber security for financial services firms: https://sovereignsecure.co.uk/industries/financial-services/ - What is Cyber Essentials?: https://sovereignsecure.co.uk/cyber-essentials/ - What is Cyber Essentials Plus?: https://sovereignsecure.co.uk/cyber-essentials-plus/ - How much does Cyber Essentials cost in the UK?: https://sovereignsecure.co.uk/cyber-essentials-cost-of-basic-certification/ - How much does Cyber Essentials Plus cost?: https://sovereignsecure.co.uk/cyber-essentials-plus-cost/ - What are the Cyber Essentials requirements?: https://sovereignsecure.co.uk/cyber-essentials-checklist/ - What are the Cyber Essentials Plus requirements?: https://sovereignsecure.co.uk/cyber-essentials-plus-checklist-for-remote-testing/ - How do I get Cyber Essentials certified?: https://sovereignsecure.co.uk/cyber-essentials-how-to-pass-first-time-guide/ - Is Cyber Essentials mandatory?: https://sovereignsecure.co.uk/is-cyber-essentials-mandatory/ - Cyber Essentials renewal: https://sovereignsecure.co.uk/cyber-essentials-renewal/ - Check a Cyber Essentials certificate: https://sovereignsecure.co.uk/cyber-essentials-certificate-check/ - Cyber Essentials MFA requirements: https://sovereignsecure.co.uk/cyber-essentials-mfa/ - Cyber Essentials password requirements: https://sovereignsecure.co.uk/cyber-essentials-password-policy/ - Cyber Essentials logo and badge rules: https://sovereignsecure.co.uk/cyber-essentials-logo/ - Cyber Essentials for MSPs: https://sovereignsecure.co.uk/cyber-essentials-msp-partner-programme/ - Free Cyber Essentials readiness check: https://sovereignsecure.co.uk/cyber-essentials-readiness-check/ - Cyber Essentials question set download: https://sovereignsecure.co.uk/cyber-essentials-questionnaire-free-download/ - Cyber Essentials vs ISO 27001: https://sovereignsecure.co.uk/cyber-essentials-vs-iso-27001/ - What is IASME?: https://sovereignsecure.co.uk/iasme/ - IASME Cyber Assurance certification: https://sovereignsecure.co.uk/iasme-cyber-assurance/ - Defence Cyber Certification / DEFCON 658: https://sovereignsecure.co.uk/defcon-658/ - What is ISO 27001?: https://sovereignsecure.co.uk/what-is-iso-27001/ - ISO 27001 consultant: https://sovereignsecure.co.uk/iso27001/ - ISO 27001 certification cost: https://sovereignsecure.co.uk/iso-27001-certification-cost/ - ISO 27001 requirements: https://sovereignsecure.co.uk/iso-27001-requirements/ - ISO 27001 checklist: https://sovereignsecure.co.uk/iso-27001-checklist/ - ISO 27001 Annex A controls: https://sovereignsecure.co.uk/iso-27001-annex-a-controls/ - ISO 27001 implementation timeline: https://sovereignsecure.co.uk/iso-27001-implementation/ - ISO 27001 vs SOC 2: https://sovereignsecure.co.uk/iso-27001-vs-soc-2/ - ISO 27001 for startups: https://sovereignsecure.co.uk/iso-27001-for-startups/ - What is ISO 9001?: https://sovereignsecure.co.uk/what-is-iso-9001/ - ISO 9001 certification: https://sovereignsecure.co.uk/iso-9001-certification/ - Other ISO standards (14001, 45001, 22301 and more): https://sovereignsecure.co.uk/iso-certification/ - Penetration testing services UK: https://sovereignsecure.co.uk/cyber-security-testing/ - What is penetration testing?: https://sovereignsecure.co.uk/what-is-penetration-testing/ - Types of penetration testing: https://sovereignsecure.co.uk/types-of-penetration-testing/ - Web application penetration testing: https://sovereignsecure.co.uk/penetration-testing-for-web-application/ - AI and LLM penetration testing: https://sovereignsecure.co.uk/ai-llm-penetration-testing/ - Red team vs penetration testing: https://sovereignsecure.co.uk/red-team-vs-penetration-testing/ - How often should you pen test?: https://sovereignsecure.co.uk/how-often-should-you-perform-a-penetration-test-a-strategic-guide-for-2026/ - Penetration testing cost UK: https://sovereignsecure.co.uk/penetration-testing-cost/ - Get a penetration testing quote: https://sovereignsecure.co.uk/penetration-testing-quote/ - VAPT services: https://sovereignsecure.co.uk/vapt-services/ - Vulnerability scanning services: https://sovereignsecure.co.uk/vulnerability-scanning/ - What is a vulnerability scan?: https://sovereignsecure.co.uk/what-is-a-vulnerability-scan/ - Phishing simulation service: https://sovereignsecure.co.uk/phishing-simulation/ - Cyber security consultancy UK: https://sovereignsecure.co.uk/cyber-security-consultancy/ - Sovereign Secure company facts and accreditations: https://sovereignsecure.co.uk/llm-info/ - Sovereign Secure clients: https://sovereignsecure.co.uk/our-clients/ - Cyber security company in Manchester: https://sovereignsecure.co.uk/cyber-security-manchester/ - Cyber security company in Lancashire: https://sovereignsecure.co.uk/cyber-security-lancashire/ - Cyber Essentials in London: https://sovereignsecure.co.uk/cyber-essentials-london/ - Cyber security glossary: https://sovereignsecure.co.uk/glossary/ - Cyber security by industry (banking, fintech, retail): https://sovereignsecure.co.uk/industries/ ## What Sovereign Secure does not claim - It is not itself a PCI Approved Scanning Vendor (ASV); ASV scans are delivered through an approved vendor. - It does not claim CREST or NCSC CHECK accreditation. - It is not an ISO certification body; ISO certificates are issued by MQA International. - Its Defence Cyber Certification listing covers Levels 0 and 1 only, not Levels 2 or 3. - Its PCI P2PE approval is the P2PE Assessor listing (Europe and USA); it holds no P2PE Application Assessor listing. ## PCI services - [PCI services](https://sovereignsecure.co.uk/pci-services/): PCI DSS, PCI PIN and PCI Card Production assessments from a PCI SSC-approved QSA, QPA and CPSA. - [PCI DSS assessments](https://sovereignsecure.co.uk/pci-services/pci-dss-assessments/): PCI compliance audits and PCI assessments by a PCI SSC-approved QSA company: Report on Compliance, AOC and QSA-validated SAQs. Get a fixed quote. - [PCI Card Production audits](https://sovereignsecure.co.uk/pci-services/pci-card-production-audits/): PCI Card Production and Provisioning assessments by a PCI SSC-approved CPSA: logical and physical security audits for card manufacturers and personalisers. - [PCI PIN security audits](https://sovereignsecure.co.uk/pci-services/pci-pin-security-audits/): PCI PIN security assessments and audits by a PCI SSC Qualified PIN Assessor for acquirers, processors, key injection facilities, ATM and POS networks. - [PCI ASV scans](https://sovereignsecure.co.uk/pci-services/asv-scanning/): PCI scanning made simple: quarterly PCI ASV scans run through our PCI SSC Approved Scanning Vendor partner and managed by a QSA company. Get a fixed quote. - [AWS PCI compliance](https://sovereignsecure.co.uk/aws-pci-compliance/): AWS PCI compliance from a QSA's view: what the AWS Level 1 AOC covers, what you still own, how to segment a CDE and the evidence assessors will ask you for. - [Key injection facility audits](https://sovereignsecure.co.uk/pci-services/key-injection-facility-audits/): Key injection facility (KIF) assessments by a PCI SSC Qualified PIN Assessor: PCI PIN Annex B, remote key injection and secure rooms. Get a fixed quote. - [Magento PCI compliance](https://sovereignsecure.co.uk/magento-pci-compliance/): Magento PCI compliance explained by a QSA: which SAQ your payment module leads to, what Adobe covers on its cloud, extension and script risk, and testing. - [PCI compliant hosting](https://sovereignsecure.co.uk/pci-compliant-hosting/): PCI compliant hosting explained by a QSA: what a host's AOC covers, the responsibility matrix you need, WordPress and Drupal realities and the questions to ask. - [PCI compliant payment gateways](https://sovereignsecure.co.uk/pci-compliant-payment-gateway/): What a PCI compliant payment gateway covers, what stays with you, what to ask for, and how Stripe, PayPal and Square integrations map to an SAQ. Check yours. - [PCI DSS certification](https://sovereignsecure.co.uk/pci-dss-certification/): PCI DSS certification explained by a QSA company: why there is no PCI certificate, what the AOC proves, who signs it and how long it lasts. See what to ask for. - [PCI DSS compliance checklist](https://sovereignsecure.co.uk/pci-dss-compliance-checklist/): Free PCI compliance checklist for PCI DSS v4.0.1 from a QSA company: all 12 requirements, the evidence assessors ask for and the 2025 changes. Find your gaps. - [PCI compliance levels](https://sovereignsecure.co.uk/pci-dss-compliance-levels/): PCI compliance levels explained by a QSA company: Visa merchant levels 1 to 3 and Mastercard levels 1 to 4, service provider levels and what each submits. - [PCI compliance UK](https://sovereignsecure.co.uk/pci-dss-compliance-uk/): PCI compliance UK guide from a QSA company: who must comply, merchant levels, SAQ or ROC, v4.0.1 deadlines, costs and fees. Get a fixed quote. - [PCI DSS Consultancy](https://sovereignsecure.co.uk/pci-services/pci-dss-consultancy/): PCI DSS consultancy and consulting services from a PCI SSC-approved QSA company: scoping, gap assessment, remediation, policies and SAQ help. Get a fixed quote. - [PCI Level 1](https://sovereignsecure.co.uk/pci-dss-level-1/): PCI Level 1 explained by a QSA company: Visa and Mastercard thresholds, who can sign a Level 1 ROC, the yearly testing calendar and how to plan a first ROC. - [PCI DSS Requirement 10](https://sovereignsecure.co.uk/pci-dss-requirement-10/): PCI DSS Requirement 10 explained for v4.0.1: what audit logs must record, 12-month retention, automated log review and control failure alerts. Find your gaps. - [PCI DSS Requirement 3](https://sovereignsecure.co.uk/pci-dss-requirement-3/): PCI DSS encryption requirements for stored card data under Requirement 3 (v4.0.1): keyed hashes, disk encryption limits, key management and what assessors check. - [PCI DSS Requirement 8](https://sovereignsecure.co.uk/pci-dss-requirement-8/): PCI DSS Requirement 8 explained for v4.0.1: unique IDs, 12-character passwords, MFA into the CDE, lockouts and service accounts, plus what assessors check. - [PCI DSS tokenisation](https://sovereignsecure.co.uk/pci-dss-tokenisation/): PCI tokenization explained by a QSA company: how tokens take systems out of PCI DSS scope, what stays in, tokenisation vs encryption and evidence to prepare. - [PCI DSS training](https://sovereignsecure.co.uk/pci-dss-training/): PCI DSS training explained by a QSA company: PCI DSS courses and qualifications, what Requirement 12.6 requires, how often staff need it and the evidence checked. - [PCI DSS vs GDPR](https://sovereignsecure.co.uk/pci-dss-vs-gdpr/): GDPR and PCI compliance compared by a QSA: how PCI DSS and UK GDPR differ, which card controls evidence Article 32, breach duties and one plan for both. - [PCI DSS vs ISO 27001](https://sovereignsecure.co.uk/pci-dss-vs-iso-27001/): PCI DSS vs ISO 27001 compared by a PCI QSA company that is ISO 27001 certified: scope, validation, control mapping and how to run both programmes together. - [PCI IVR and DTMF masking](https://sovereignsecure.co.uk/pci-ivr-dtmf-masking/): PCI IVR, DTMF masking and call recording explained by a QSA company: what leaves scope, what stays in, and what your assessor will test. Plan your route. - [PCI non-compliance fees](https://sovereignsecure.co.uk/pci-non-compliance-fees/): Paying a PCI non-compliance fee? A QSA company explains why acquirers charge it, how PCI fines really work and a 30-day plan to get your validation accepted. - [PCI DSS penetration testing](https://sovereignsecure.co.uk/pci-services/pci-penetration-testing/): PCI compliance penetration testing to PCI DSS Requirement 11.4 by a QSA company: internal, external, application and segmentation pen tests with ROC-ready reports. - [PCI SAQ D](https://sovereignsecure.co.uk/pci-saq-d/): PCI SAQ D (SAQ D for merchants) explained by a QSA company: who must complete it, what the questionnaire covers, how the AOC is signed and how to move to SAQ A. - [PCI Security Standards Council](https://sovereignsecure.co.uk/pci-security-standards-council/): PCI security standards explained: who runs the PCI SSC, every standard from PCI DSS to PIN and card production, and which assessor signs what. See the full map. - [3DS assessments](https://sovereignsecure.co.uk/pci-services/3ds-assessments/): PCI 3DS compliance assessments and audits by a PCI SSC-listed 3DS Assessor for ACS, Directory Server and 3DS Server providers, with the 3DS ROC and AOC. Get a quote. - [P2PE assessments](https://sovereignsecure.co.uk/pci-services/p2pe-assessments/): P2PE certification and assessments by a PCI SSC-listed P2PE Assessor for solution providers, key injection facilities and decryption services. Get a quote. - [PCI QSA](https://sovereignsecure.co.uk/pci-services/pci-qsa/): PCI QSA services from a PCI SSC-approved PCI DSS QSA company: ROCs, AOCs and QSA-validated SAQs, plus PCI PIN and card production. Get a fixed quote. - [Service provider compliance](https://sovereignsecure.co.uk/pci-services/service-provider-compliance/): Are you a PCI compliance service provider? A QSA company explains who counts, Visa and Mastercard levels, extra v4.0.1 requirements, ROC and AOC. Get a quote. - [Card payments over the phone](https://sovereignsecure.co.uk/taking-card-payments-over-the-phone/): Taking card payments over the phone in the UK? The regulations and PCI DSS steps for virtual terminals, card machines and payment links, and what not to write down. - [What is PCI DSS?](https://sovereignsecure.co.uk/what-is-pci-dss/): What is PCI DSS? The Payment Card Industry Data Security Standard explained by a QSA company: what counts as PCI data, the 12 requirements and how to validate. - [Worldpay PCI compliance](https://sovereignsecure.co.uk/worldpay-pci-compliance/): Worldpay PCI compliance explained independently by a QSA: what SaferPayments is, which SAQ Worldpay merchants complete, ASV scans, renewal and when to get help. ## Cyber Essentials - [Cyber Essentials](https://sovereignsecure.co.uk/cyber-essentials/): Cyber Essentials certification from an IASME-licensed certification body. From £320 + VAT, assessed in as little as 24 hours, with expert help to pass first time. - [Cyber Essentials Plus](https://sovereignsecure.co.uk/cyber-essentials-plus/): Cyber Essentials Plus certification and audit from an IASME-licensed certification body. Remote or on-site CE+ testing, clear sample sizes and a fixed quote. - [Cyber Essentials 2027](https://sovereignsecure.co.uk/cyber-essentials-2027/): Cyber Essentials 2027: what IASME and the NCSC have confirmed so far, how new question sets are brought in and what to do before your next assessment. - [Cyber Essentials and GDPR](https://sovereignsecure.co.uk/cyber-essentials-and-gdpr/): Cyber Essentials and GDPR explained: what certification proves under UK GDPR Article 32, what it leaves out, and what else to show customers and the ICO. - [Cyber Essentials assessor](https://sovereignsecure.co.uk/cyber-essentials-assessor/): Need a Cyber Essentials assessor? Choose an IASME-licensed certification body with published prices, fast marking and remote or on-site CE+ audits. Start today. - [Benefits of Cyber Essentials](https://sovereignsecure.co.uk/cyber-essentials-benefits/): Benefits of Cyber Essentials from an IASME certification body: contract access, customer trust, included insurance and fewer gaps. See if it is worth it. - [Cyber Essentials certificate check](https://sovereignsecure.co.uk/cyber-essentials-certificate-check/): Cyber Essentials check in five steps: search the official IASME register, read each field, confirm CE or CE+, scope and expiry. Free supplier checklist inside. - [Requirements & checklist](https://sovereignsecure.co.uk/cyber-essentials-checklist/): Cyber Essentials checklist: every NCSC v3.3 requirement across the five controls, plus scope, BYOD, MFA, password and 14-day patching rules. Free PDF to print. - [Cyber Essentials consultancy](https://sovereignsecure.co.uk/cyber-essentials-consultancy/): Cyber Essentials consultancy from an IASME-licensed certification body: gap analysis, remediation guidance and readiness reviews to help you pass first time. - [Cyber Essentials insurance](https://sovereignsecure.co.uk/cyber-essentials-insurance/): Cyber Essentials insurance explained: who qualifies for the £25,000 cyber cover IASME includes, what it covers, the exclusions and how to opt in at assessment. - [Cyber Essentials logo](https://sovereignsecure.co.uk/cyber-essentials-logo/): Cyber Essentials logo rules: who may display the CE and CE+ badge, how certified organisations get it from IASME, where to use it and what to do at expiry. - [Cyber Essentials MFA](https://sovereignsecure.co.uk/cyber-essentials-mfa/): Cyber Essentials MFA requirements under v3.3: which accounts need multi-factor authentication, which factors count, whether SMS passes and how CE+ tests it. - [Cyber Essentials for Microsoft 365](https://sovereignsecure.co.uk/cyber-essentials-microsoft-365/): Office 365 Cyber Essentials guide: the Microsoft 365, Entra ID, Intune and Defender settings that meet each control, plus the evidence to have ready to pass. - [Mobile device requirements](https://sovereignsecure.co.uk/cyber-essentials-mobile-device-requirements/): Cyber Essentials mobile device requirements for phones and tablets: supported iOS and Android versions, the 14-day update rule, screen locks, apps and MDM. - [Cyber Essentials for MSPs](https://sovereignsecure.co.uk/cyber-essentials-msp-partner-programme/): Cyber Essentials partner programme: become a Cyber Essentials certified MSP, then certify clients with an IASME-licensed body, with CE+ audits run remotely. - [Password policy](https://sovereignsecure.co.uk/cyber-essentials-password-policy/): Cyber Essentials password policy rules from NCSC v3.3: 12 or 8 character minimums, lock-out limits, MFA and password expiry, plus a free template to copy. - [Cyber Essentials renewal](https://sovereignsecure.co.uk/cyber-essentials-renewal/): Cyber Essentials renewal explained: certificates last 12 months with no grace period. Renew or switch to us from £320 + VAT, assessed in as little as 24 hours. - [Cyber Essentials vs ISO 27001](https://sovereignsecure.co.uk/cyber-essentials-vs-iso-27001/): Cyber Essentials vs ISO 27001, compared by an IASME certification body that is ISO 27001 certified: scope, cost, timescales and which one your buyers need. - [DEFCON 658 and DCC](https://sovereignsecure.co.uk/defcon-658/): DEFCON 658 and Defence Cyber Certification for MOD suppliers: we certify DCC Levels 0 and 1 and the Cyber Essentials every level builds on. Get a quote. - [IASME](https://sovereignsecure.co.uk/iasme/): IASME explained: what it stands for, its role as the NCSC's Cyber Essentials delivery partner, its other schemes and how to check a licensed certification body. - [IASME Cyber Assurance](https://sovereignsecure.co.uk/iasme-cyber-assurance/): IASME Cyber Assurance certification from an IASME-licensed certification body: Level One verified assessment, Level Two audit, prerequisites and how it works. - [IASME Cyber Baseline](https://sovereignsecure.co.uk/iasme-cyber-baseline/): IASME Cyber Baseline explained: the 8 themes it covered, who it was for, its status on IASME's website in October 2026 and which certificate to use instead. - [IASME portal guide](https://sovereignsecure.co.uk/iasme-portal-guide/): IASME portal guide for Cyber Essentials applicants: how to get access, set up, answer and save, submit, handle assessor feedback and download your certificate. - [Is Cyber Essentials mandatory?](https://sovereignsecure.co.uk/is-cyber-essentials-mandatory/): Is Cyber Essentials mandatory? Not by law, but PPN 014 requires it for many UK government and NHS contracts. Check which contracts and how to evidence it. - [NCSC 10 Steps](https://sovereignsecure.co.uk/ncsc-10-steps-to-cyber-security/): The NCSC 10 Steps to Cyber Security in plain English, with a table mapping every step to Cyber Essentials, ISO 27001 and PCI DSS, plus questions for your board. - [NHS DSPT](https://sovereignsecure.co.uk/nhs-dspt/): NHS DSPT guide for suppliers: who must complete the toolkit, what each status means, the 30 June 2027 deadline and how Cyber Essentials Plus fits in. - [Cyber Essentials Plus requirements & checklist](https://sovereignsecure.co.uk/cyber-essentials-plus-checklist-for-remote-testing/): What the CE+ audit tests, device sample sizes and how to prepare for remote testing. - [Cyber Essentials FAQs](https://sovereignsecure.co.uk/cyber-essentials-faqs/): Answers to common Cyber Essentials questions: cost, requirements, renewal and CE+. - [How to pass Cyber Essentials first time](https://sovereignsecure.co.uk/cyber-essentials-how-to-pass-first-time-guide/): Six steps to pass Cyber Essentials on your first attempt. - [Cyber Essentials Plus quote](https://sovereignsecure.co.uk/cyber-essentials-plus-ce-quote-request/): Request a Cyber Essentials Plus quote; the basic assessment is included. ## ISO certification - [ISO certification (all standards)](https://sovereignsecure.co.uk/iso-certification/): ISO certification in the UK explained: what it is, how it differs from accreditation, how to get certified to ISO 9001, 14001, 45001 or 27001 and what it costs. - [ISO 27001 consultancy](https://sovereignsecure.co.uk/iso27001/): ISO 27001 consultants from a UK firm that is ISO 27001 certified itself: gap analysis, ISMS build, internal audit and certification via MQA International. - [ISO 13485 certification](https://sovereignsecure.co.uk/iso-13485-certification/): ISO 13485 consultancy for medical device makers and suppliers: what the standard requires, how it fits UK, EU and US rules, and device cyber security evidence. - [ISO 14001 certification](https://sovereignsecure.co.uk/iso-14001-certification/): ISO 14001 certification in the UK: what ISO 14001 is, how to get certified to the 2026 edition, cost drivers and how an ISO 14001 consultant helps. Get a quote. - [ISO 20000 certification](https://sovereignsecure.co.uk/iso-20000-certification/): ISO 20000 explained for UK IT service providers and MSPs: what ISO/IEC 20000-1 requires, how it differs from ITIL and how certification works. Get a quote. - [ISO 22000 certification](https://sovereignsecure.co.uk/iso-22000-certification/): ISO 22000 explained: food safety management system requirements, HACCP and prerequisite programmes, FSSC 22000 and the route to certification. Get a quote. - [ISO 22301 certification](https://sovereignsecure.co.uk/iso-22301-certification/): ISO 22301 consultancy in the UK: what the business continuity standard requires, how certification works and how it links to ISO 27001 and DORA. Get a quote. - [ISO 27001 Annex A controls](https://sovereignsecure.co.uk/iso-27001-annex-a-controls/): ISO 27001 controls explained: all 93 Annex A (2022) controls in four themes, the 11 new ones, what changed from 2013 and where CE and PCI DSS set stricter rules. - [ISO 27001 audit](https://sovereignsecure.co.uk/iso-27001-audit/): ISO 27001 audit guide: what happens at stage 1, stage 2 and surveillance audits, what auditors sample, how nonconformities are graded and how to prepare. - [ISO 27001 checklist](https://sovereignsecure.co.uk/iso-27001-checklist/): Free ISO 27001 checklist for the 2022 standard: clause-by-clause readiness, an Annex A theme check and a Stage 1 and 2 audit checklist. Download the .xlsx. - [ISO 27001 for startups](https://sovereignsecure.co.uk/iso-27001-for-startups/): ISO 27001 for startups and software companies: a lean ISMS scope, realistic timeline, cost drivers, secure development controls and when SOC 2 fits. Get help. - [ISO 27001 gap analysis](https://sovereignsecure.co.uk/iso-27001-gap-analysis/): ISO 27001 gap analysis against the 2022 standard: clauses 4 to 10 and all 93 Annex A controls, scored into a risk-ranked roadmap. Free template or a fixed quote. - [ISO 27001 implementation](https://sovereignsecure.co.uk/iso-27001-implementation/): ISO 27001 implementation in 11 steps, from scope and risk assessment to internal audit and certification, with realistic timelines, roles and a free project plan. - [ISO 27001 internal audit](https://sovereignsecure.co.uk/iso-27001-internal-audit/): Outsourced ISO 27001 internal audit by an ISO 27001-certified UK firm: independent clause 9.2 ISMS audits before Stage 2 and every year. Get a fixed quote. - [ISO 27001 logo](https://sovereignsecure.co.uk/iso-27001-logo/): ISO 27001 logo rules explained: why ISO does not license its logo, how to use your certification body's mark, the right wording and where the mark can appear. - [ISO 27001 penetration testing](https://sovereignsecure.co.uk/iso-27001-penetration-testing/): ISO 27001 penetration testing mapped to Annex A 8.8 and 8.29: what auditors ask for, how often to test and an audit-ready evidence pack. Get a fixed quote. - [ISO 27001 requirements](https://sovereignsecure.co.uk/iso-27001-requirements/): ISO 27001 requirements explained: what clauses 4 to 10 of ISO/IEC 27001:2022 demand, every mandatory document and what auditors check. Plan your ISMS here. - [ISO 27001 risk assessment](https://sovereignsecure.co.uk/iso-27001-risk-assessment/): How to run an ISO 27001 risk assessment that stands up at audit: the clause 6.1.2 method, ISO 27005 approaches and a free risk register template with examples. - [ISO 27001 vs SOC 2](https://sovereignsecure.co.uk/iso-27001-vs-soc-2/): ISO 27001 vs SOC 2 compared for UK firms: certificate vs attestation, who issues each, control overlap, cost drivers and how to run both. Choose your route. - [ISO 27002](https://sovereignsecure.co.uk/iso-27002/): ISO 27002:2022 explained: its 93 controls, the five attribute types, what changed from 2013 and how it differs from ISO 27001. Design controls that pass audit. - [ISO 27701](https://sovereignsecure.co.uk/iso-27701/): ISO 27701:2025 explained: the standalone privacy standard, controller and processor controls, how it maps to UK GDPR and what 2019 certificate holders do next. - [ISO 42001](https://sovereignsecure.co.uk/iso-42001/): ISO 42001 explained: what the AI management system standard requires, its 38 Annex A controls, who needs it and how ISO 42001 certification works. - [ISO 45001 certification](https://sovereignsecure.co.uk/iso-45001-certification/): ISO 45001 certification support in the UK: gap analysis, hazard identification, worker participation and readiness for your independent audit. Get a fixed quote. - [ISO 50001 certification](https://sovereignsecure.co.uk/iso-50001-certification/): ISO 50001 consultancy for UK organisations: energy review, baselines and EnPIs, the ESOS phase 4 route and preparing for the certification audit. Get a quote. - [ISO 55001 certification](https://sovereignsecure.co.uk/iso-55001-certification/): ISO 55001 consultancy for UK asset owners: the 2024 edition, the SAMP, decision-making and life cycle planning, and preparing for the certification audit. - [ISO 9001:2026](https://sovereignsecure.co.uk/iso-9001-2026/): ISO 9001:2026 was published on 16 September 2026. See what changed clause by clause, every transition deadline to 30 September 2029 and what to do next. - [ISO 9001 certification](https://sovereignsecure.co.uk/iso-9001-certification/): ISO 9001 consultant support in the UK: gap analysis, QMS build, internal audit and certification through MQA International, with costs explained. Get a quote. - [ISO 9001 vs ISO 27001](https://sovereignsecure.co.uk/iso-9001-vs-iso-27001/): ISO 9001 vs ISO 27001 compared: purpose, risk approach, Annex A controls and audits, which to get first, and how to run both as one integrated management system. - [NIST AI RMF](https://sovereignsecure.co.uk/nist-ai-rmf/): NIST AI Risk Management Framework explained: the four functions, the Generative AI Profile, how it compares with ISO 42001 and the EU AI Act, and how to start. - [SOC 2 Type 1 vs Type 2](https://sovereignsecure.co.uk/soc-2-type-1-vs-type-2/): SOC 2 Type 1 vs Type 2 explained: point in time vs observation period, how long each takes, what buyers accept and when to move from Type 1 to Type 2. - [Supply chain security](https://sovereignsecure.co.uk/supply-chain-security/): Supply chain security explained: how supply chain attacks work, the NCSC's 12 principles, software supply chain controls and first steps for a small team. - [What is ISO 27001?](https://sovereignsecure.co.uk/what-is-iso-27001/): What is ISO 27001? The information security standard in plain English: the ISMS, clauses 4 to 10, Annex A, how certification works and who needs it. Start here. - [What is ISO 9001?](https://sovereignsecure.co.uk/what-is-iso-9001/): What is ISO 9001? The quality management standard explained: what it stands for, its requirements, the 7 quality principles, the 2026 edition and how to certify. ## Penetration testing and security testing - [Penetration testing services](https://sovereignsecure.co.uk/cyber-security-testing/): Web, API, network, cloud, mobile and hardware testing from a PCI SSC-approved assessor company. - [Web application testing](https://sovereignsecure.co.uk/penetration-testing-for-web-application/): Web application penetration testing in the UK: manual OWASP Top 10, access-control and business logic testing by a PCI QSA company. Get a quote. - [API penetration testing](https://sovereignsecure.co.uk/api-penetration-testing/): API penetration testing services for REST, GraphQL and SOAP web services, tested against the OWASP API Security Top 10 by a PCI QSA company. Get a quote. - [Network & infrastructure testing](https://sovereignsecure.co.uk/network-penetration-testing/): Network penetration testing for UK firms: external perimeter, internal network and Active Directory attack paths, plus PCI DSS segmentation tests. Get a quote. - [Cloud penetration testing](https://sovereignsecure.co.uk/cloud-penetration-testing/): Cloud penetration testing and cloud security testing for AWS, Azure, GCP and Microsoft 365: configuration review plus hands-on identity attacks. Get a quote. - [Mobile app testing](https://sovereignsecure.co.uk/penetration-testing-for-mobile-apps/): Mobile penetration testing for iOS and Android apps to OWASP MASVS: on-device storage, traffic, authentication and the APIs behind the app. Get a quote. - [IoT & hardware testing](https://sovereignsecure.co.uk/penetration-testing-for-hardware/): IoT penetration testing and hardware security testing for connected devices and POS terminals: firmware, debug interfaces, radio and cloud APIs. Get a quote. - [Social engineering & phishing](https://sovereignsecure.co.uk/social-engineering-testing/): Social engineering testing services: phishing, vishing and pretext tests that measure how staff respond, reported by team rather than by name. Get a quote. - [Red team assessments](https://sovereignsecure.co.uk/red-team-assessments/): Red teaming services and red team assessments: objective-led adversary simulation across technical, human and physical routes, under written rules of engagement. - [Wireless testing](https://sovereignsecure.co.uk/wireless-penetration-testing/): Wireless penetration testing for corporate and guest Wi-Fi networks: WPA2/WPA3, 802.1X, rogue and evil twin access points and PCI DSS 11.2 checks. Get a quote. - [Source code review](https://sovereignsecure.co.uk/source-code-review/): Secure code review services UK: manual source code security review plus static code analysis (SAST), mapped to OWASP and PCI DSS 6.2. Get a quote. - [AI & LLM testing](https://sovereignsecure.co.uk/ai-llm-penetration-testing/): AI red teaming and LLM penetration testing: prompt injection, data leakage, jailbreaks and agent abuse, tested against the OWASP Top 10 for LLMs. Get a quote. - [Vulnerability scanning](https://sovereignsecure.co.uk/vulnerability-scanning/): Vulnerability scanning services and vulnerability assessment services: internal, external and cloud scans, triaged findings, rescans and PCI ASV scans via a partner. - [Firewall & config review](https://sovereignsecure.co.uk/firewall-configuration-review/): Firewall security audit and configuration review against CIS Benchmarks and PCI DSS Requirement 1: rule-base analysis, segmentation checks and hardening advice. - [Agentic AI security](https://sovereignsecure.co.uk/agentic-ai-security/): Agentic AI security testing for agents that call tools and APIs: tool misuse, excessive agency, credential exposure and memory poisoning. Get a fixed quote. - [Attack surface management](https://sovereignsecure.co.uk/attack-surface-management/): External attack surface management (EASM) explained: finding shadow IT and forgotten assets, how ASM differs from vulnerability scanning and where testing fits. - [AWS Penetration Testing](https://sovereignsecure.co.uk/aws-penetration-testing/): AWS penetration testing services from a PCI QSA company: IAM privilege escalation, S3 exposure, EC2, Lambda, EKS and PCI segmentation tested. Get a fixed quote. - [Azure Penetration Testing](https://sovereignsecure.co.uk/azure-penetration-testing/): Azure penetration testing of Entra ID, RBAC, storage, Key Vault, App Service, AKS and hybrid identity, reported by a PCI QSA company. Get a fixed quote. - [Black, grey and white box testing](https://sovereignsecure.co.uk/black-box-vs-white-box-penetration-testing/): White box penetration testing compared with black box and grey box: what the tester is told, coverage, realism, cost, and which suits web apps, networks and PCI. - [Cyber tabletop exercise](https://sovereignsecure.co.uk/cyber-tabletop-exercise/): How to run a cyber tabletop exercise: scenarios, roles, timings, the NCSC's free Exercise in a Box and the evidence it gives for PCI DSS, ISO 27001 and DORA. - [DORA TLPT](https://sovereignsecure.co.uk/dora-tlpt/): TLPT explained: who must run threat-led penetration testing under DORA, what the 2025 TLPT standards require, and how CBEST and STAR-FS compare in the UK. - [External Penetration Testing](https://sovereignsecure.co.uk/external-penetration-testing/): External penetration testing of your internet-facing perimeter by a PCI QSA company: VPN, email, web and cloud, mapped to PCI DSS 11.4.3. Get a fixed quote. - [How to spot a phishing email](https://sovereignsecure.co.uk/how-to-spot-a-phishing-email/): How to spot phishing emails: the 10 warning signs staff should know, five worked examples, a checklist to share and what to do if you clicked a phishing link. - [Internal Penetration Testing](https://sovereignsecure.co.uk/internal-penetration-testing/): Internal penetration testing by a PCI QSA company: Active Directory attack paths, lateral movement and PCI 11.4.5 segmentation, remote or on-site. Get a quote. - [MCP security](https://sovereignsecure.co.uk/mcp-security/): MCP security explained: tool poisoning, over-broad permissions, token passthrough, resource injection and supply chain risk, with checklists to secure servers. - [Microsoft 365 Security Assessment](https://sovereignsecure.co.uk/microsoft-365-security-assessment/): Microsoft 365 security assessment from a PCI QSA company: Entra ID, conditional access, Exchange Online, sharing and Defender reviewed. Get a fixed quote. - [Penetration testing as a service (PTaaS)](https://sovereignsecure.co.uk/penetration-testing-as-a-service/): Penetration testing as a service (PTaaS) explained: how platform-based continuous testing works, what drives cost and whether it meets PCI DSS and ISO 27001. - [Small business penetration testing](https://sovereignsecure.co.uk/penetration-testing-for-small-business/): Affordable penetration testing for small businesses: what to test first and how to right-size the scope so you only pay for what matters. Get a fixed quote. - [Penetration testing methodology](https://sovereignsecure.co.uk/penetration-testing-methodology/): Penetration testing methodology explained: PTES, OWASP, NIST SP 800-115 and OSSTMM compared, the phases of a test, and what PCI DSS 11.4.1 requires of yours. - [Phishing simulation](https://sovereignsecure.co.uk/phishing-simulation/): Phishing simulation services for UK organisations: a simulated phishing test by email, QR code or phone, under agreed rules, reported by team. Get a fixed quote. - [Physical penetration testing](https://sovereignsecure.co.uk/physical-penetration-testing/): Physical penetration testing explained: what testers try, types and cost, authorisation letters, landlord consent, UK law and PCI DSS Requirement 9. - [Purple teaming](https://sovereignsecure.co.uk/purple-teaming/): What is a purple team? How a purple team exercise runs, how MITRE ATT&CK and assumed breach scenarios are used, and which organisations benefit most. - [Red teaming vs pentesting](https://sovereignsecure.co.uk/red-team-vs-penetration-testing/): Red teaming vs pentesting compared: goals, scope, duration, cost drivers and readiness, plus how each supports DORA, ISO 27001 and PCI DSS. Choose the right test. - [SOC 2 penetration testing](https://sovereignsecure.co.uk/soc-2-penetration-testing/): SOC 2 penetration testing for UK SaaS firms: scope CPA firms accept, timing inside your observation period, reports for Vanta and retests. Get a fixed quote. - [SWIFT CSP](https://sovereignsecure.co.uk/swift-csp-assessment/): SWIFT CSP explained: the CSCF v2026 controls, architecture types, annual attestation and independent assessment, and how PCI DSS evidence helps you prepare. - [Types of penetration testing](https://sovereignsecure.co.uk/types-of-penetration-testing/): Types of penetration testing compared: the 12 main tests, from network and web app to cloud, API, AI and red team, with what each finds and who needs it. - [VAPT services](https://sovereignsecure.co.uk/vapt-services/): VAPT services from a PCI QSA company: vulnerability assessment plus manual penetration testing, one prioritised report and a retest. Get a fixed-price quote. - [Vulnerability assessment](https://sovereignsecure.co.uk/vulnerability-assessment/): What is a vulnerability assessment? The five steps from asset discovery to risk rating, what it covers and how often PCI DSS, ISO 27001 and CE+ expect one. - [Website penetration testing](https://sovereignsecure.co.uk/website-penetration-testing/): Website penetration testing for WordPress, WooCommerce, Shopify and Magento sites: what a test covers, what online scanners miss and how to get a fixed quote. - [What is a vulnerability scan?](https://sovereignsecure.co.uk/what-is-a-vulnerability-scan/): What is a vulnerability scan? How vulnerability scanning works, internal vs external and authenticated scans, how long a scan takes and why it matters. - [What is penetration testing?](https://sovereignsecure.co.uk/what-is-penetration-testing/): What is penetration testing? How pen tests work, why they matter, the five stages, the main types and when a standard requires one. A plain-English UK guide. - [What is red teaming?](https://sovereignsecure.co.uk/what-is-red-teaming/): What is red teaming? What a red team does in cyber security, how an exercise runs from reconnaissance to objective, red team vs blue team, and who needs one. ## Prices and costs - [Cyber Essentials Plus cost](https://sovereignsecure.co.uk/cyber-essentials-plus-cost/): Cyber Essentials Plus cost in 2026: published UK prices of £999 to £3,999 + VAT by company size, what drives the price and how to avoid retest fees. Get a quote. - [ISO 27001 certification cost](https://sovereignsecure.co.uk/iso-27001-certification-cost/): ISO 27001 certification cost in the UK for 2026: consultancy, Stage 1 and 2 audits, surveillance and recertification by company size. Get a fixed quote. - [Penetration testing cost](https://sovereignsecure.co.uk/penetration-testing-cost/): Pen test cost in the UK for 2026: published day rates and penetration testing price ranges by test type, what drives cost, and how to get a fixed quote. - [PCI compliance cost](https://sovereignsecure.co.uk/pci-services/pci-dss-cost/): What PCI DSS compliance costs in the UK: QSA audit, SAQ, ASV scan and pen test cost drivers, plus a free estimator. - [Cyber Essentials prices](https://sovereignsecure.co.uk/cyber-essentials-cost-of-basic-certification/): Cyber Essentials packages from £320 + VAT for every company size. ## Free tools and calculators - [Business continuity plan template](https://sovereignsecure.co.uk/business-continuity-plan-template/): Free business continuity plan template for UK organisations, as a Word download: impact analysis, RTO and RPO, roles and recovery steps, aligned to ISO 22301. - [Cyber security policy template](https://sovereignsecure.co.uk/cyber-security-policy-template/): Free cyber security policy template for UK small businesses: 12 sections mapped to the five Cyber Essentials controls. Download it in Word or PDF and adopt it. - [Incident response plan template](https://sovereignsecure.co.uk/incident-response-plan-template/): Free incident response plan template (Word) for UK organisations, mapped to PCI DSS 12.10 and ISO 27001: roles, severity levels, ICO and acquirer notification. - [ISO 27001 policy templates](https://sovereignsecure.co.uk/iso-27001-policy-templates/): Free ISO 27001 toolkit: editable information security, access control, acceptable use, supplier and cryptography policies (Word) plus five ISMS spreadsheets. - [Statement of Applicability](https://sovereignsecure.co.uk/iso-27001-statement-of-applicability/): Statement of Applicability for ISO 27001:2022: what it must include, how to justify exclusions, a worked example and a free SoA template (.xlsx). - [PCI DSS documentation](https://sovereignsecure.co.uk/pci-dss-documentation/): PCI documentation for PCI DSS v4.0.1: the policies, procedures and records each requirement needs, review cycles and what a QSA tests. Download the free index. - [PCI compliance check](https://sovereignsecure.co.uk/pci-compliance-check/): Free 22-question PCI DSS v4.0.1 readiness self-check with a score, your likely SAQ and a prioritised fix list. - [Penetration testing quote](https://sovereignsecure.co.uk/penetration-testing-quote/): Scope your test types and asset counts and get a fixed-price penetration testing proposal. - [Cyber Essentials readiness check](https://sovereignsecure.co.uk/cyber-essentials-readiness-check/): Free 20-question Cyber Essentials self-check with a score and fix list. - [CE & CE+ scoping questionnaire](https://sovereignsecure.co.uk/cyber-essentials-scoping-questionnaire/): Tell us about your devices and cloud services for a fixed Cyber Essentials or CE+ quote. - [Cyber Essentials questionnaire download](https://sovereignsecure.co.uk/cyber-essentials-questionnaire-free-download/): Download the Cyber Essentials question set in Excel format. ## Cyber security consultancy and frameworks - [Cyber security consultancy](https://sovereignsecure.co.uk/cyber-security-consultancy/): Cyber security consultancy from a PCI QSA, IASME Cyber Essentials body and ISO 27001-certified firm: PCI DSS, CE, ISO and pen testing. Get a fixed quote. - [AI governance](https://sovereignsecure.co.uk/ai-governance/): AI governance explained for UK organisations: what a framework covers, ISO 42001 and NIST AI RMF, EU AI Act dates and the testing evidence you will need. - [CIS Controls](https://sovereignsecure.co.uk/cis-controls/): CIS Controls v8.1 explained: all 18 controls, 153 Safeguards and implementation groups IG1 to IG3, mapped to Cyber Essentials and ISO 27001 to plan your next step. - [Cyber Assessment Framework (CAF)](https://sovereignsecure.co.uk/cyber-assessment-framework/): The NCSC Cyber Assessment Framework explained: the 4 objectives, 14 principles and 41 outcomes of CAF 4.0, who must use it and how it maps to ISO 27001. - [Cyber Governance Code of Practice](https://sovereignsecure.co.uk/cyber-governance-code-of-practice/): The Cyber Governance Code of Practice explained for UK boards: the 5 principles, the 22 director actions and a quarterly question list. Read the guide. - [Cyber Security and Resilience Bill](https://sovereignsecure.co.uk/cyber-security-and-resilience-bill/): The Cyber Security and Resilience Bill explained: status, scope (MSPs, data centres, critical suppliers), 24-hour reporting and how it differs from NIS2. - [Cyber security audit](https://sovereignsecure.co.uk/cyber-security-audit/): What a cyber security audit covers, how auditors test your controls against Cyber Essentials, ISO 27001 or PCI DSS, and how to prepare for a clean result. - [UK cyber security certifications](https://sovereignsecure.co.uk/cyber-security-certifications-uk/): Cyber security certification in the UK compared: Cyber Essentials, CE+, ISO 27001, PCI DSS, SOC 2 and IASME Cyber Assurance, so you start with the right one. - [Cyber security risk assessment](https://sovereignsecure.co.uk/cyber-security-risk-assessment/): How to run a cyber security risk assessment: identify assets and threats, score likelihood and impact, then build a risk register and treatment plan that works. - [DORA regulation](https://sovereignsecure.co.uk/dora-regulation/): DORA regulation explained for UK firms: who the Digital Operational Resilience Act covers, its five pillars, testing and supplier rules, plus a checklist. - [EU Cyber Resilience Act](https://sovereignsecure.co.uk/eu-cyber-resilience-act/): The EU Cyber Resilience Act for UK manufacturers: products in scope, key dates, essential requirements, 24-hour reporting and the test evidence you will need. - [NIS2](https://sovereignsecure.co.uk/nis2/): NIS2 explained for UK companies: who the EU directive covers, when UK firms are in scope, the Article 21 security measures, 24-hour reporting and ISO 27001 mapping. - [NIST CSF 2.0](https://sovereignsecure.co.uk/nist-csf/): NIST CSF 2.0 explained for UK organisations: the six functions, tiers and profiles, NIST CSF vs ISO 27001, and a free mapping to ISO 27001 and Cyber Essentials. - [Operational resilience](https://sovereignsecure.co.uk/operational-resilience/): Operational resilience for UK financial firms: PRA SS1/21, FCA PS21/3, impact tolerances, scenario testing and the Critical Third Parties regime explained. - [Ransomware prevention](https://sovereignsecure.co.uk/ransomware-prevention/): How to prevent ransomware: protected backups, fast patching, MFA, remote access and Active Directory hardening, mapped to NCSC guidance. Use the checklist. - [SOC 2 compliance](https://sovereignsecure.co.uk/soc-2-compliance/): SOC 2 compliance for UK companies: what SOC 2 is, SOC 1 vs SOC 2 vs SOC 3, Type 1 vs Type 2, how to prepare and the penetration testing evidence auditors expect. - [Third-party risk management](https://sovereignsecure.co.uk/third-party-risk-management/): Third party risk management explained: the TPRM lifecycle, supplier tiering, contract terms and the DORA, PRA, PCI DSS and ISO 27001 rules behind each step. - [Vendor risk assessment](https://sovereignsecure.co.uk/vendor-risk-assessment/): Vendor risk assessment guide: a supplier security questionnaire template, the evidence to request (AOC, Cyber Essentials, ISO 27001) and how to verify each one. - [Virtual CISO (vCISO)](https://sovereignsecure.co.uk/virtual-ciso/): What a vCISO does, how virtual and fractional CISOs differ, what drives the cost and when one beats a full-time hire. A plain guide for UK businesses. ## Industries - [Industries](https://sovereignsecure.co.uk/industries/): Cyber security by industry: the PCI DSS, Cyber Essentials, ISO 27001, NHS DSPT, DORA and SOC 2 requirements your sector faces, and where to start. Find yours. - [Cyber Essentials for charities](https://sovereignsecure.co.uk/cyber-essentials-for-charities/): Cyber Essentials for charities: what the Charity Commission expects, whether free funding still exists, how volunteers' devices are scoped and what it costs. - [Cyber Essentials for law firms](https://sovereignsecure.co.uk/cyber-essentials-for-law-firms/): Cyber Essentials for law firms: the Legal Aid Agency rule, what Lexcel and the SRA expect, scoping remote fee earners, and CE or CE+. Certify from £320 + VAT. - [Cyber Essentials for schools](https://sovereignsecure.co.uk/cyber-essentials-for-schools/): Cyber Essentials for schools and trusts: how it fits the DfE standards, what is in scope, free help with cyber security for schools and prices from £320 + VAT. - [Small business cyber security](https://sovereignsecure.co.uk/cyber-security-for-small-business/): Small business cyber security made practical: the threats UK SMEs face, a step-by-step plan, a checklist, where Cyber Essentials fits and when to add a pentest. - [Banking](https://sovereignsecure.co.uk/industries/banking/): PCI compliance and cyber security for banks and card issuers: how PCI DSS, PCI PIN and card production apply, plus SWIFT CSP and DORA. Get a fixed quote. - [Financial services](https://sovereignsecure.co.uk/industries/financial-services/): Cyber security for financial services firms in the UK: PCI DSS, PIN and card production, Cyber Essentials Plus, ISO 27001 and penetration testing. Get a quote. - [Fintech](https://sovereignsecure.co.uk/industries/fintech/): Fintech cybersecurity for payment, e-money and open banking firms: PCI DSS as a service provider, API and app pentests, Cyber Essentials and DORA test evidence. - [Healthcare](https://sovereignsecure.co.uk/industries/healthcare/): Cyber security in healthcare for NHS suppliers, clinics and device makers: the main threats, the DSPT, Cyber Essentials Plus, penetration testing and PCI DSS. - [Manufacturing](https://sovereignsecure.co.uk/industries/manufacturing/): Manufacturing cyber security: Cyber Essentials Plus scope for factory systems, safe OT and IoT testing, MOD supplier rules and product law. Get a fixed quote. - [Retail and e-commerce](https://sovereignsecure.co.uk/industries/retail-ecommerce/): Cyber security for retail, e-commerce and hospitality: the most common attacks, and the PCI DSS route, Cyber Essentials and testing each channel needs. - [SaaS](https://sovereignsecure.co.uk/industries/saas/): SaaS penetration testing for B2B software firms: multi-tenant isolation, API and web app scope, release-cycle testing and reports enterprise customers accept. ## Locations - [Cyber Essentials London](https://sovereignsecure.co.uk/cyber-essentials-london/): Cyber Essentials London: CE and CE+ certification from an IASME-licensed body, assessed online, remote CE+ audits and on-site on request. From £320 + VAT. - [Cyber security Lancashire](https://sovereignsecure.co.uk/cyber-security-lancashire/): Cyber security in Lancashire from our Accrington head office: PCI QSA, IASME Cyber Essentials body, ISO 27001 and pen testing, on site or remote. Talk to us. - [Cyber security Manchester](https://sovereignsecure.co.uk/cyber-security-manchester/): Cyber security in Manchester and the North West from an Accrington-based PCI QSA and Cyber Essentials body: pen testing, CE+, PCI DSS and ISO 27001. Get a quote. ## Glossary - [Glossary](https://sovereignsecure.co.uk/glossary/): Cyber security glossary from a PCI QSA: plain-English A to Z definitions of over 100 security terms, plus PCI DSS, Cyber Essentials, ISO 27001 and pen testing. - [Breach and attack simulation (BAS)](https://sovereignsecure.co.uk/glossary/breach-and-attack-simulation/): Breach and attack simulation (BAS) explained: how automated attack tools test your controls and how BAS differs from penetration testing and red teaming. - [Business email compromise (BEC)](https://sovereignsecure.co.uk/glossary/business-email-compromise/): Business email compromise explained: how BEC invoice and CEO fraud work, the payment checks and Microsoft 365 settings that stop them, and how to report it. - [Card-not-present fraud](https://sovereignsecure.co.uk/glossary/card-not-present-fraud/): Card not present fraud explained: what a CNP transaction is, how the fraud works online and by phone, who pays, and the PCI DSS and 3-D Secure controls that help. - [CIA triad](https://sovereignsecure.co.uk/glossary/cia-triad/): The CIA triad means confidentiality, integrity and availability. See what each means, breach examples and how ISO 27001, PCI DSS and UK GDPR use it. - [Cross-site scripting (XSS)](https://sovereignsecure.co.uk/glossary/cross-site-scripting/): Cross site scripting (XSS) explained: stored, reflected and DOM-based XSS, the risk to payment pages and the fixes that work. Find and close XSS in your apps. - [CTEM](https://sovereignsecure.co.uk/glossary/ctem/): CTEM (continuous threat exposure management) explained: the five stages, how it differs from vulnerability management, and where penetration testing fits in. - [CVSS](https://sovereignsecure.co.uk/glossary/cvss/): CVSS explained: how the Common Vulnerability Scoring System rates severity from 0 to 10, what changed in CVSS 4.0 and how scores set patching deadlines. - [DAST](https://sovereignsecure.co.uk/glossary/dast/): DAST (dynamic application security testing) explained: how a DAST scan tests a running app, SAST vs DAST, the main tool types and where each fits in a release. - [EPSS](https://sovereignsecure.co.uk/glossary/epss/): EPSS score explained: what the Exploit Prediction Scoring System measures, how it differs from CVSS and how to use it to order patching inside fixed deadlines. - [IDOR](https://sovereignsecure.co.uk/glossary/idor/): IDOR explained: how changing an ID in a URL or API call exposes other users' data, why scanners miss it, how to prevent it and how penetration testers find it. - [OWASP ASVS](https://sovereignsecure.co.uk/glossary/owasp-asvs/): OWASP ASVS explained: what the Application Security Verification Standard covers, the three levels, what version 5.0 changed and how to scope a test with it. - [OWASP LLM Top 10](https://sovereignsecure.co.uk/glossary/owasp-llm-top-10/): OWASP LLM Top 10 explained: the ten 2026 risks in LLM apps, from prompt injection to improper output handling, what changed from 2025 and how testers use it. - [OWASP Top 10](https://sovereignsecure.co.uk/glossary/owasp-top-10/): OWASP Top 10 explained: the ten 2025 web application risk categories in plain English, what changed from 2021, how often it updates and how testers use it. - [PCI MPoC](https://sovereignsecure.co.uk/glossary/pci-mpoc/): PCI MPoC explained: the PCI SSC standard behind SoftPOS, tap to pay and PIN on glass on phones and tablets, how it replaces SPoC and CPoC and what merchants check. - [PCI PTS](https://sovereignsecure.co.uk/glossary/pci-pts/): PCI PTS explained: what PTS POI v7.0 and HSM approval mean, how to check a device on the PCI SSC list, what happens at expiry and how PTS links to PCI PIN and P2PE. - [Phishing](https://sovereignsecure.co.uk/glossary/phishing/): What is a phishing attack? A plain-English definition, the main types from spear phishing to quishing, the defences that work and how to report it in the UK. - [Prompt injection](https://sovereignsecure.co.uk/glossary/prompt-injection/): Prompt injection explained: how direct and indirect attacks hijack LLM apps and AI agents, four worked examples, and the defences that limit the harm. - [Quishing](https://sovereignsecure.co.uk/glossary/quishing/): What is quishing? How QR code phishing works, the common lures, why email filters miss QR codes and the checks that help staff spot a malicious code. - [Smishing](https://sovereignsecure.co.uk/glossary/smishing/): Smishing (SMS phishing) explained: how scam texts work, the UK lures to watch for, the risk to business accounts and how to report a text to 7726. - [Spear phishing](https://sovereignsecure.co.uk/glossary/spear-phishing/): What is spear phishing? A plain-English definition, how it differs from phishing and whaling, finance, HR and supplier examples, and the defences that stop it. - [Threat modelling](https://sovereignsecure.co.uk/glossary/threat-modelling/): Threat modelling explained: the five-step process, STRIDE with a worked example, attack trees, free tools, when to do it and what a useful threat model contains. - [Two-factor vs two-step verification](https://sovereignsecure.co.uk/glossary/two-factor-vs-two-step-verification/): What is two-factor vs two-step verification? 2FA needs two different types of factor, 2SV only two steps. See examples, passkeys and what counts as MFA. - [Vishing](https://sovereignsecure.co.uk/glossary/vishing/): Vishing is voice phishing: scam calls posing as banks, IT help desks or executives. See common scripts, the deepfake voice risk and how to test your staff. - [Vulnerability management](https://sovereignsecure.co.uk/glossary/vulnerability-management/): Vulnerability management explained: the lifecycle from discovery to verified fix, prioritising with CVSS and EPSS, and the PCI DSS and Cyber Essentials deadlines. - [White hat hacker](https://sovereignsecure.co.uk/glossary/white-hat-hacker/): What is a white hat hacker? White, black and grey hat hackers compared, how ethical hackers work legally and what the Computer Misuse Act 1990 says in the UK. ## Company - [About Sovereign Secure](https://sovereignsecure.co.uk/about-us/): PCI SSC-approved assessor and IASME Cyber Essentials certification body, established 2012. - [Certified clients](https://sovereignsecure.co.uk/certified-clients/): Sovereign Secure certificate verification: check a Cyber Essentials or CE+ certificate we issued, confirm a PCI AOC, and add our badge to your website. - [Clients & testimonials](https://sovereignsecure.co.uk/our-clients/): Banks, payment processors and card manufacturers that trust Sovereign Secure. - [Contact us](https://sovereignsecure.co.uk/contact-us/): Free consultation on PCI, Cyber Essentials, ISO 27001 or penetration testing. ## Guides - [Cyber Essentials Changes 2026: The Danzell (v3.3) Update Explained](https://sovereignsecure.co.uk/the-strategic-guide-to-cyber-essentials-certification-in-2026/): Cyber Essentials changes 2026 explained: the Danzell question set, v3.3 requirements, new automatic-fail questions, scope rules and stricter CE+ retests. - [Cyber Essentials vs Cyber Essentials Plus: What's the Difference?](https://sovereignsecure.co.uk/cyber-essentials-plus-certification-a-strategic-comparison-and-implementation-guide-for-2026/): Cyber Essentials vs Cyber Essentials Plus compared by a certification body: how each is assessed, typical UK prices, timescales and which one you need. - [The 5 Cyber Essentials Controls: What Each One Involves](https://sovereignsecure.co.uk/the-5-cyber-essentials-controls-a-strategic-framework-for-2026/): Cyber Essentials controls explained by a certification body: the five technical controls of the Cyber Essentials framework, what each needs and where firms fail. - [What Happens in a Cyber Essentials Assessment? An Assessor's View](https://sovereignsecure.co.uk/how-to-conduct-a-cyber-essentials-assessment-a-strategic-guide-for-2026/): What happens in a Cyber Essentials assessment, explained by an assessor: each step, how answers are marked, the automatic fails and the answers that often fail. - [GDPR Compliance Audits: A Practical Guide for UK Organisations](https://sovereignsecure.co.uk/a-professional-guide-to-gdpr-compliance-audits-strategic-implementation-in-2026/): How to plan and run a UK GDPR compliance audit: what it covers, a step-by-step method, internal or independent review, and reusing ISO 27001 and PCI DSS work. - [How to Choose an ISO 27001 Consultant in the UK](https://sovereignsecure.co.uk/iso-27001-consultancy-a-strategic-guide-to-bespoke-information-security/): How to choose an ISO 27001 consultant in the UK: what to look for, red flags, consultant vs certification body, published day rates and questions to ask first. - [Information Security Management Systems (ISMS): A Practical Guide](https://sovereignsecure.co.uk/the-strategic-guide-to-information-security-management-systems-isms-in-2026/): ISMS meaning explained: what an information security management system is, what ISO 27001:2022 requires of one, and how to build, audit and certify it. - [The Benefits of ISO 27001: Commercial, Operational and Regulatory](https://sovereignsecure.co.uk/the-strategic-benefits-of-iso-27001-a-guide-for-sovereign-entities/): The benefits of ISO 27001 for UK organisations: winning contracts, fewer security questionnaires, better risk decisions, and whether it is worth the cost. - [Common PCI Audit Failures: 12 Findings and How to Avoid Them](https://sovereignsecure.co.uk/common-pci-dss-audit-failures-strategic-insights-for-2026-compliance/): PCI audit failures that assessors find again and again under PCI DSS v4.0.1, from scope and MFA to scans and scripts, and how to fix each before fieldwork. - [Contact Centre PCI Compliance: Requirements for UK Call Centres (v4.0.1)](https://sovereignsecure.co.uk/pci-compliance-for-call-centres-in-the-uk-the-2026-qsa-guide-to-dss-v4-0/): Contact centre PCI compliance in the UK under PCI DSS v4.0.1: what is in scope, the requirements that matter, home agents, outsourced centres and assessment prep. - [How to Choose the Best PCI QSA Company in the UK (and Verify One)](https://sovereignsecure.co.uk/pci-dss-qsa-compliance-audit-uk-the-definitive-professional-buying-guide/): How to choose the best PCI QSA company in the UK: verify an assessor on the PCI SSC list, compare firms, check independence and ask these questions first. - [How to Fill Out a PCI SAQ Without the Common Mistakes](https://sovereignsecure.co.uk/common-mistakes-filling-out-pci-saq-a-strategic-guide-to-avoiding-compliance-pitfalls/): How to fill out a PCI SAQ step by step, with a completion checklist and the eight mistakes a QSA sees most often, from the wrong SAQ type to bad N/A answers. - [How to Pass a PCI Compliance Scan: The ASV Scan Guide (Requirement 11.3.2)](https://sovereignsecure.co.uk/the-professional-guide-to-pci-vulnerability-scanning-in-2026/): How to pass a PCI compliance scan (ASV) first time: what Requirement 11.3.2 asks for, why scans fail, how to fix or dispute findings and plan each quarter. - [How to Prepare for a PCI Audit: A Step-by-Step Plan for PCI DSS](https://sovereignsecure.co.uk/how-to-prepare-for-a-pci-dss-audit-a-strategic-executive-guide-for-2026/): How to prepare for a PCI audit under PCI DSS v4.0.1: confirm ROC or SAQ, fix scope, close gaps, finish scans and tests, organise evidence and handle fieldwork. - [PCI 3DS Explained: The 3DS Core Security Standard and Who Needs It](https://sovereignsecure.co.uk/pci-3ds-security-assessments-a-strategic-guide-to-3-d-secure-compliance/): What PCI 3DS is, who must comply with the 3DS Core Security Standard, how Part 1 and Part 2 work, how it differs from PCI DSS and how to prepare for it. - [PCI Compliance for SaaS Companies: Scope, Cloud and Customer Evidence](https://sovereignsecure.co.uk/pci-compliance-for-saas-companies-a-strategic-guide-to-v4-0-excellence/): PCI compliance for SaaS explained: when a SaaS company is a merchant or a PCI DSS service provider, how to keep cloud scope small and what customers will ask for. - [PCI Compliance for Small Businesses: What You Need to Do](https://sovereignsecure.co.uk/the-cost-of-pci-compliance-for-small-business-a-strategic-2026-budgeting-guide/): PCI compliance for small businesses explained: what PCI Level 4 means, which SAQ you need, what you must submit each year and how to cut your scope. - [PCI Compliance Requirements: The 12 PCI DSS Requirements Explained (v4.0.1)](https://sovereignsecure.co.uk/what-is-the-pci-dss-a-definitive-guide-for-professional-entities/): PCI compliance requirements explained: the 12 PCI DSS v4.0.1 requirements in plain English, the six goals behind them and the evidence a QSA will want. - [PCI Compliance Scope: How to Define and Reduce Your Cardholder Data Environment](https://sovereignsecure.co.uk/pci-dss-scoping-guide-a-strategic-framework-for-v4-0-compliance/): PCI compliance scope under v4.0.1: what the cardholder data environment is, which systems are in scope, how often to confirm scope and how to reduce it. - [PCI DSS 4.0.1: What Changed, Key Dates & Future-Dated Requirements](https://sovereignsecure.co.uk/pci-dss-4-0-changes-checklist-a-strategic-guide-for-2026-compliance/): PCI compliance 4.0 explained: what PCI DSS 4.0 changed from v3.2.1, what v4.0.1 corrected, the key dates and a tracker of the future-dated requirements. - [PCI DSS Business as Usual: How to Stay Compliant All Year](https://sovereignsecure.co.uk/maintaining-pci-dss-compliance-year-round-a-strategic-guide-to-continuous-security/): What PCI DSS business as usual means under v4.0.1, with a year-round compliance calendar, change-control checks and the evidence your QSA will ask for. - [PCI DSS Compensating Controls Explained (With Worked Examples)](https://sovereignsecure.co.uk/pci-dss-compensating-controls-explained-a-strategic-guide-for-2026/): What PCI DSS compensating controls are, when they are allowed, the four criteria, how to fill in the worksheet and how they differ from the customised approach. - [PCI DSS Compliance Roadmap: A Five-Phase Template](https://sovereignsecure.co.uk/a-strategic-pci-dss-compliance-roadmap-template-for-2026/): A free PCI DSS compliance roadmap template (Excel) in five phases, from scoping and gap analysis to remediation, assessment and BAU, with owners and timelines. - [PCI DSS for E-commerce: Payment Page Scripts (6.4.3 & 11.6.1)](https://sovereignsecure.co.uk/pci-dss-for-ecommerce-businesses-a-strategic-guide-to-v4-0-compliance/): What PCI DSS 6.4.3 and 11.6.1 require for payment page scripts, how they counter Magecart skimming, who they apply to after the SAQ A change and how to comply. - [PCI DSS Gap Analysis: What It Covers, How It Works and What You Get](https://sovereignsecure.co.uk/pci-dss-gap-analysis-services-a-strategic-roadmap-to-v4-0-compliance/): What a PCI DSS gap analysis covers under v4.0.1, how it works step by step, how long it takes, what you get and how it differs from a readiness review. - [PCI DSS Risk Assessment: Targeted Risk Analysis Template and Worked Examples](https://sovereignsecure.co.uk/the-professional-guide-to-a-pci-dss-risk-assessment-template-for-v4-0-compliance/): Looking for a PCI DSS risk assessment template? v4.0.1 replaced it with targeted risk analyses. Download a free TRA template, with examples and what QSAs check. - [PCI Firewall Requirements: PCI DSS Requirement 1 and Network Security Controls](https://sovereignsecure.co.uk/the-definitive-guide-to-firewall-configurations-for-pci-dss-v4-0-compliance/): PCI firewall rules explained: do you need a firewall for PCI compliance, what Requirement 1 asks of network security controls and how six-monthly reviews work. - [PCI Network Segmentation: How to Design and Test a Compliant Network](https://sovereignsecure.co.uk/how-to-build-a-pci-compliant-network-a-strategic-architectural-guide-for-2026/): How PCI network segmentation works under v4.0.1: define the CDE, choose controls that isolate it, avoid VLAN pitfalls and prove it with segmentation tests. - [PCI PIN Assessment in Dubai: A Qualified PIN Assessor (QPA) Guide for UAE Firms](https://sovereignsecure.co.uk/qualified-pin-assessor-qpa-services-in-dubai-a-strategic-compliance-guide/): PCI PIN assessment in Dubai and the UAE: which banks, processors and key injection facilities need one, how it fits UAE regulation and how to choose a QPA. - [PCI PIN Security Requirements: What PCI PIN Compliance Means and Who Needs It](https://sovereignsecure.co.uk/pci-pin-security-assessments-a-strategic-guide-to-cryptographic-compliance/): The PCI PIN Security Requirements explained: who must comply, the seven control objectives, how PIN security differs from PCI DSS and what a QPA checks. - [PCI ROC vs AOC (Attestation of Compliance) vs SAQ Explained](https://sovereignsecure.co.uk/the-pci-dss-report-on-compliance-roc-an-executive-guide-to-validation/): What a PCI Attestation of Compliance (AOC), Report on Compliance (ROC) and SAQ are, who needs which, who signs them and how long an AOC stays valid. - [PCI SAQ A vs SAQ A-EP: Which Applies to Your Website After January 2025?](https://sovereignsecure.co.uk/saq-a-vs-saq-a-ep-a-strategic-guide-to-pci-dss-v4-0-compliance/): PCI SAQ A explained: the January 2025 script-attack eligibility criterion, how your checkout decides between SAQ A and SAQ A-EP, and how to move to SAQ A. - [What Is P2PE? Point-to-Point Encryption, Validated Solutions & SAQ P2PE](https://sovereignsecure.co.uk/understanding-pci-p2pe-security-assessments-a-comprehensive-guide/): What is P2PE? How PCI point-to-point encryption works, P2PE vs E2EE, how to check a solution is PCI-listed and what SAQ P2PE still asks of merchants. - [Which PCI SAQ Do I Need? All SAQ Types Explained (v4.0.1)](https://sovereignsecure.co.uk/which-pci-saq-is-right-for-me-a-strategic-guide-to-compliance-in-2026/): Which PCI SAQ do you need? Compare every PCI DSS v4.0.1 SAQ, check eligibility for SAQ B, B-IP, C and C-VT, find yours in a few questions and avoid common mistakes. - [Active Directory Penetration Testing: Common Attack Paths and How to Close Them](https://sovereignsecure.co.uk/internal-penetration-testing-the-strategic-guide-to-defending-the-modern-corporate-network-2026/): Active Directory penetration testing explained: the common attack paths from a standard user to Domain Admin, how testers chain them, and the fixes that work. - [API Security Checklist: 20 Checks Mapped to the OWASP API Top 10](https://sovereignsecure.co.uk/bespoke-api-penetration-testing-services-for-enterprise-security/): A free 20-point API security checklist mapped to the OWASP API Security Top 10: authorisation, authentication, data exposure, rate limits and what a pen test adds. - [Does AWS Allow Penetration Testing? AWS, Azure and Google Cloud Rules](https://sovereignsecure.co.uk/cloud-security-penetration-testing-a-strategic-guide-for-uk-enterprises/): Does AWS allow penetration testing? Yes, for listed services without pre-approval. See the AWS, Azure and Google Cloud rules, what is banned and how to scope. - [How Often Should Penetration Testing Be Done? PCI DSS, ISO 27001 and Insurance Rules](https://sovereignsecure.co.uk/how-often-should-you-perform-a-penetration-test-a-strategic-guide-for-2026/): How often should penetration testing be done? Yearly and after significant change. See which standards require it, from PCI DSS to UK GDPR, and what insurers ask. - [How to Prepare for a Penetration Test: A Checklist for Your Team](https://sovereignsecure.co.uk/preparing-your-team-for-a-pen-test-a-strategic-checklist-for-2026/): How to prepare for a penetration test: set objectives, agree scope and rules of engagement, brief your people and get systems and accounts ready for day one. - [Internal vs External Penetration Testing: Differences and When You Need Each](https://sovereignsecure.co.uk/external-penetration-testing-a-strategic-guide-to-securing-the-corporate-perimeter-in-2026/): Internal vs external penetration testing compared: what each simulates and finds, what PCI DSS requires, how cost differs and which test to run first. - [Mobile App Security Testing Checklist for iOS and Android (OWASP MASVS)](https://sovereignsecure.co.uk/the-definitive-mobile-application-security-testing-checklist-for-2026/): A mobile app security testing checklist for iOS and Android, built on the OWASP MASVS: storage, crypto, auth, network, platform, code, resilience and privacy. - [Penetration Test Remediation: What to Do When the Report Arrives](https://sovereignsecure.co.uk/remediating-vulnerabilities-after-a-penetration-test-a-strategic-guide-for-2026/): Penetration test remediation step by step: triage the report, prioritise vulnerability remediation by real risk, fix or mitigate, meet PCI DSS deadlines and retest. - [Penetration Test Report: What It Contains and How to Read It](https://sovereignsecure.co.uk/how-to-read-a-penetration-test-report-a-strategic-guide-for-executives/): What a penetration test report contains, with a report template and an example finding: how to read the scope, summary and risk ratings, then turn them into fixes. - [Penetration Testing Companies in the UK: How to Choose (2026 Shortlist)](https://sovereignsecure.co.uk/how-to-choose-a-penetration-testing-company-a-strategic-guide-for-2026/): Penetration testing companies in the UK compared: how to shortlist pen testing firms, verify accreditations, judge scoping and spot a relabelled scan. - [Penetration Testing vs Vulnerability Scanning: What's the Difference?](https://sovereignsecure.co.uk/professional-vulnerability-scanning-services-a-strategic-guide-for-2026/): Penetration testing vs vulnerability scanning: how they differ in depth, frequency and cost, automated vs manual testing, what PCI DSS requires and which you need. - [Wireless Security Audit Checklist: 10 Checks for Your Wi-Fi Networks](https://sovereignsecure.co.uk/the-strategic-wireless-network-security-audit-checklist-for-2026/): A 10-point wireless security audit checklist (free Excel download) covering WPA3, 802.1X, rogue access points, guest isolation and what PCI DSS 11.2 requires. - [13 Types of Social Engineering Attacks and How to Test Your Defences](https://sovereignsecure.co.uk/social-engineering-assessments-fortifying-the-human-element-of-modern-defence/): Types of social engineering attacks explained: phishing, vishing, pretexting, tailgating and nine more, with examples, defences and how to test them. - [Cyber Security Awareness Training: How to Build a Programme That Works](https://sovereignsecure.co.uk/cyber-security-awareness-training-a-strategic-guide-for-sovereign-entities-in-2026/): How to build cyber security awareness training for employees: free courses, what to cover, how often to train, how to measure it and what PCI DSS and ISO 27001 need. - [What Is a Phishing Simulation? Examples and How to Run One Fairly](https://sovereignsecure.co.uk/simulated-phishing-attack-service-a-strategic-guide-to-human-risk-management/): What is a phishing simulation? A plain-English definition, seven phishing simulation examples from easy to hard, the metrics that matter and how to run one fairly. ## Free templates and tools - [PCI compliance check](https://sovereignsecure.co.uk/pci-compliance-check/): Free 22-question PCI DSS v4.0.1 readiness self-check with a score, your likely SAQ and a prioritised fix list. - [Cyber Essentials readiness check](https://sovereignsecure.co.uk/cyber-essentials-readiness-check/): Free 20-question Cyber Essentials self-check with a score and a fix list. - [Penetration testing quote builder](https://sovereignsecure.co.uk/penetration-testing-quote/): Choose your test types and sizes online and we will send you a proposal. - [PCI compliance cost estimator](https://sovereignsecure.co.uk/pci-services/pci-dss-cost/): What PCI DSS compliance costs in the UK: QSA audit, SAQ, ASV scan and pen test cost drivers, plus a free estimator. - [ISO 27001 checklist (Excel)](https://sovereignsecure.co.uk/files/sovereign-secure-iso-27001-checklist.xlsx): Clause 4 to 10 checklist, Annex A theme check, Stage 1 and Stage 2 audit checklist and the mandatory documents list, with a progress summary. Free download, no sign-up. Guide: https://sovereignsecure.co.uk/iso-27001-checklist/ - [ISO 27001 Statement of Applicability template (Excel)](https://sovereignsecure.co.uk/files/sovereign-secure-iso-27001-statement-of-applicability.xlsx): All 93 Annex A controls with applicability and status drop-downs and a worked example. Free download, no sign-up. Guide: https://sovereignsecure.co.uk/iso-27001-statement-of-applicability/ - [ISO 27001 risk register template (Excel)](https://sovereignsecure.co.uk/files/sovereign-secure-iso-27001-risk-register.xlsx): Risk register with threat, vulnerability, scoring, treatment actions and due dates, plus worked examples. Free download, no sign-up. Guide: https://sovereignsecure.co.uk/iso-27001-risk-assessment/ - [Information security policy template (Word)](https://sovereignsecure.co.uk/files/sovereign-secure-information-security-policy-template.docx): A copy-ready information security policy, an outline for topic-specific policies and the policy topics mapped to Annex A. Free download, no sign-up. Guide: https://sovereignsecure.co.uk/iso-27001-policy-templates/ - [PCI DSS document index (Excel)](https://sovereignsecure.co.uk/files/sovereign-secure-pci-dss-document-index.xlsx): Every document for PCI DSS Requirements 1 to 12, with owner, status and review-date columns. Free download, no sign-up. Guide: https://sovereignsecure.co.uk/pci-dss-documentation/ - [Business continuity plan template (Word)](https://sovereignsecure.co.uk/files/sovereign-secure-business-continuity-plan-template.docx): Ten plan sections, a business impact analysis worksheet with RTO and RPO, and decision and exercise logs, mapped to ISO 22301 and ISO 27001. Free download, no sign-up. Guide: https://sovereignsecure.co.uk/business-continuity-plan-template/ - [Incident response plan template (Word)](https://sovereignsecure.co.uk/files/sovereign-secure-incident-response-plan-template.docx): Ten plan sections mapped to PCI DSS 12.10 and ISO 27001 A.5.24 to A.5.28, UK notification deadlines, an incident log and a testing record. Free download, no sign-up. Guide: https://sovereignsecure.co.uk/incident-response-plan-template/ - [CIS Controls mapping (Excel)](https://sovereignsecure.co.uk/files/sovereign-secure-cis-controls-mapping.xlsx): The 18 CIS Controls v8.1 mapped to ISO 27001 Annex A and Cyber Essentials, with status, evidence and owner columns and a summary. Free download, no sign-up. Guide: https://sovereignsecure.co.uk/cis-controls/ - [ISO 22301 self-assessment checklist (Excel)](https://sovereignsecure.co.uk/files/sovereign-secure-iso-22301-checklist.xlsx): Clauses 4 to 10 of ISO 22301:2019 scored 0 to 3, with evidence, owner and target date columns and a readiness summary by clause. Free download, no sign-up. Guide: https://sovereignsecure.co.uk/iso-22301-certification/ - [NIST CSF 2.0 to ISO 27001 and Cyber Essentials mapping (Excel)](https://sovereignsecure.co.uk/files/sovereign-secure-nist-csf-2-iso-27001-cyber-essentials-mapping.xlsx): All 22 NIST CSF 2.0 categories mapped to ISO/IEC 27001:2022 clauses and Annex A controls and to Cyber Essentials, with Current and Target Profile columns. Free download, no sign-up. Guide: https://sovereignsecure.co.uk/nist-csf/ - [NIST AI RMF to ISO 42001 crosswalk (Excel)](https://sovereignsecure.co.uk/files/sovereign-secure-nist-ai-rmf-iso-42001-crosswalk.xlsx): All 19 NIST AI RMF categories mapped to ISO/IEC 42001:2023 clauses and Annex A controls, with typical evidence and status columns. Free download, no sign-up. Guide: https://sovereignsecure.co.uk/nist-ai-rmf/ ## Full text by section - [Cornerstone pages: services, prices, hubs and company facts](https://sovereignsecure.co.uk/llms-full.txt) - [PCI services, every page](https://sovereignsecure.co.uk/llms-pci.txt) - [Cyber Essentials, every page](https://sovereignsecure.co.uk/llms-cyber-essentials.txt) - [ISO certification, every page](https://sovereignsecure.co.uk/llms-iso.txt) - [Penetration testing, every page](https://sovereignsecure.co.uk/llms-penetration-testing.txt) - [Glossary, every term](https://sovereignsecure.co.uk/llms-glossary.txt) - [Guides (blog posts), every post](https://sovereignsecure.co.uk/llms-guides.txt)