Cirro

Cyber Security - External Vulnerability (Penetration) Testing

Identify and address vulnerabilities in your ICT or OT infrastructure to protect your organisation, its customers and its reputation. Ensure ongoing compliance with key standards such as Cyber Essentials, ISO27001.
Identify your weak spots before others do.
Best practice recommends periodically changing Pentest providers so why not come to us?

Features

• Port-scanning on your public IP addresses
• Automated Penetration Test (Pen Test) against known exploits
• Manual penetration testing to breach network
• Ethical hack for advanced exploits and configuration issues
• Simulated phishing attacks - Social Engineering
• Highly experience security staff
• Detailed prioritised reporting, review & analysis
• Support with implementation & continual improvement
• Physical infrastructure, cloud infrastrcture, SaaS platforms
• External vulnerability testing helps identify weaknesses in cyber security defenses

Benefits

• Reduce risk, data protection and integrity
• Cyber security best practise for NIS and ISO
• Gain insight on OT cyber security real world risk
• Cyber Security strategy and planning, internal & 3rd party systems
• Quickest wins to reduce risk and focus on critical issues
• Service delivered in most efficient way
• End to end external security service, ensures compliance
• Mitigation of security breach and financial or operational loss
• Protect sensitive customer data from being compromised by malicious attackers
• Prevent costly downtime caused by security breaches and attacks

£500 to £2,500 a unit

• Education pricing available

Service documents

• Pricing document

  PDF

• Skills Framework for the Information Age rate card

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at michaelo@cirro-solutions.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 14

Service ID

335816960230988

Contact

Michael Owen
020 3418 0412
michaelo@cirro-solutions.co.uk

Planning

• Planning service: Yes
• How the planning service works: When planning for Penetration testing, we typically consider the following processes:; 1 - Port scan to identify open ports and protocols and external vulnerabilities at the IP level; 2 - Automated Pen Test, this scans your environment for thousands of known vulnerabilities and checks security patches and fixes have been applied; 3 - Manual pen test / ethical hack looks to see if we can get into your network how far we can get in and what we can see and do, we record the hacker screen and log all events; 4 - Simple Simulated Phishing Attack where we send basic automated email hooks or SMS messages to see if staff respond; 5 - Advanced Phishing Attack, we register a similar domain or create similar user accounts and try to trick, spoof and phish users; ; These potential cyber security and penetration tests form part of a larger security strategic plan and can be spread over multiple quarters or years for continual improvement
• Planning service works with specific services: Yes
• Hosting or software services the planning service works with:
  • IT Cyber Security
  • OT Cyber Security
  • Penetration testing (Pen Test)
  • Cyber Security Strategy, Planning & Compliance

Training

• Training service provided: No

Setup and migration

• Setup or migration service available: No

Quality assurance and performance testing

• Quality assurance and performance testing service: Yes
• How the quality assurance and performance testing works: This forms part of the cyber security, cyber essentials plus, ISO and NIS security framework and focuses on continual improvement and risk reduction for networked equipment, cloud services, SaaS and internal users.

Security testing

• Security services: Yes
• Security services type:
  • Security strategy
  • Security risk management
  • Security design
  • Cyber security consultancy
  • Security testing
  • Security incident management
  • Security audit services
  • Other
• Other security services:
  • OT Cyber Security (Operational Technology)
  • Industrial Security
  • Network Security
  • Cloud Security
  • SaaS Web Application Security
  • Simulated Phishing
• Certified security testers: Yes
• Security testing certifications:
  • GBEST
  • CHECK
  • CREST
  • Tigerscheme
  • Cyber Scheme
  • Other
• Other security testing certifications:
  • NERC CIP (North American Electric Reliability Corporation Critical Infrastructure Protection)
  • UK NCSC CAF
  • Cybersecurity Capability Maturity Model (C2M2) - Department of Energy
  • CIS - Critical Security Controls
  • ISA99/IEC 62443 - Cybersecurity for operational technology
  • NEI - Compliance for Nuclear Power Operators
  • NIST Cybersecurity Framework
  • NIS - EU Security of Networks and Information Systems

Ongoing support

• Ongoing support service: Yes
• Types of service supported:
  • Buyer hosting or software
  • Hosting or software provided by your organisation
  • Hosting or software provided by a third-party organisation
• How the support service works: Our Cyber Security support focuses on period testing, reporting and compliance. Cirro also offer DPO as a Service and can support ISO and Cyber Security Essentials Plus compliance

Service scope

• Service constraints: The Industrial Defender OT Cyber Security solution generally includes additional onsite hardware which needs to be networked.; ; Service pre-requisites and constraints will be reviewed in detail during the research and discovery phase.

User support

• Email or online ticketing support: Email or online ticketing
• Support response times: Usually within 30 mins
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: None or don’t know
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Support levels: As this is typically a periodic service, support is provided to customers whenever needed and against a customised Support Agreement or SoW

Resellers

• Supplier type: Reseller providing extra features and support
• Organisation whose services are being resold: Industrial Defender

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Up to Security Clearance (SC)

Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: IQS
• ISO/IEC 27001 accreditation date: 17/7/2023
• What the ISO/IEC 27001 doesn’t cover: 3rd party services
• ISO 28000:2007 certification: No
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Cyber essentials plus: No
• Other security certifications: Yes
• Any other security certifications:
  • ISO 22301 - Business Continuity
  • ISO 9001 - Quality

Social Value

• Social Value:

  Social Value

  • Fighting climate change
  • Equal opportunity
  • Wellbeing

  Fighting climate change

  Commitment to Reduce Carbon Footprint and Climate-Related Initiatives In alignment with our commitment to reducing our ecological impact, we are dedicated to collaborating with our customers and suppliers to contribute to environmentally sustainable initiatives that improve ecosystems and reduce ecological impact. Our primary objective is to minimise the environmental impact of our operations. Focus on Environmental Impact Reduction Our main focus is to engage in discussions with our customers to explore collaborative approaches for reducing the environmental impact, particularly by minimising non-essential travel, to reduce energy usage and wastage of time and materials, all of which have an impact on operational consumption. As we transition back to regular operations, we are focused on reducing our physical impact, including initiatives such as flexible working, minimising printing, and enhancing recycling efforts. We are committed to optimising our physical office requirements to ensure efficient resource utilisation. Future-Focused Solutions and Efficiency We are dedicated to designing future-oriented solutions that embed efficiency into our design and delivery processes. Leveraging the momentum generated by the pandemic, we aim to build on successful new working methods. At Cirro, we are continually looking to identify potential improvements in the way we work to improve our operational efficiencies which directly impact energy usage, travel or ecological impact. By championing these initiatives, we are steadfast in our commitment to not only reduce our own ecological impact but also to actively engage with our stakeholders to foster environmental sustainability and support initiatives that have a positive impact on our world.

  Equal opportunity

  Delivering Social Value Theme 4 and PPN 06/20 Model Award Criteria In the following section, we elaborate on our approach to fulfilling Social Value Theme 4 and the relevant PPN 06/20 Model Award Criteria Our strategy, aligned with WSP’s 2022-24 Inclusion & Diversity Strategy, encompasses the following initiatives: Skill Development for Underrepresented Groups We are committed to supporting the development of new skills that lead to recognised qualifications for underrepresented groups. Addressing Inequality in Employment, Skills, and Pay We will demonstrate a clear commitment to identifying and addressing inequality in employment, skills, and pay within the contract workforce. This includes implementing time-bound action plans to monitor the inclusion and progression of full-time equivalent (FTE) employees from underrepresented groups. Supporting In-Work Progression Our approach includes support for in-work progression, aiming to assist individuals from disadvantaged or minority groups in transitioning into higher-paid roles by developing new skills relevant to the contract. Real-World Equal Opportunity When recruiting, Cirro has a policy to ensure that all names, ages, race or gender details are removed from CVs, so we focus on interviewing and employing the most suitable person for the role.

  Wellbeing

  Wellbeing Initiatives In our commitment to prioritising the well-being of our teams, we are dedicated to supporting the health and well-being of our employees, contractors, suppliers and customers. Flexible Working Support We offer flexible working conditions to our staff. They have a clearly defined job description, they know what needs to be done and they have the flexibility they need to be able to do that whilst balancing home life, physical and mental health. Internal Support Cirro’s works typically in virtual teams, it’s important that we have ‘virtual’ tea breaks and have regular discussions. Cirro also keeps an eye on the level of output expectations and workloads of employees to ensure the right resourcing levels and workloads. During periods of high-intensity working, such as working on tenders, delivering projects or whatever it might be, Cirro ensure employees take time out once this is more practically possible to ensure employees can refresh and relax.

Pricing

• Price: £500 to £2,500 a unit
• Discount for educational organisations: Yes

Service documents

• Pricing document

  PDF

• Skills Framework for the Information Age rate card

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at michaelo@cirro-solutions.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.