Finding a company to run a non vendor bias security audit

[robjduk]

Morning,

My governors are worried about ransomware (as am I) so want us to have a third party evaluate our network and report on its health in specific regards to ransomware protection. A company I work a lot with offered to perform a free basic audit last year however that ended up with "well you don't use the product we use for AV so we couldn't tell you" and gave me a red mark. The report they produced had several inaccuracies which made me look bad and had to talk my SLT out of throwing literally thousands at their software because I'm confident what we have in place is working and would protect us. (I'm not against being told we need to change but it was clearly a sales attempt from a Microsoft gold partner who didn't seem to know how Windows Server 2019 handles ransomware and called up on 3 separate occasions to ask the exact same questions).

 

Can anyone recommend a company that has a clear system in place to perform a paid and thorough security audit and not just provide me with a sales pitch for whatever anti-virus they are in bed with at the time of writing?

 

Thank you

[dazza007]

You can get a self assessment certification via the NCSC and get ransomware insurance

https://www.ncsc.gov.uk/

However the only way to secure your data is to have an immutable offsite backup, we have Veeam

[steveg]

Our local authority have recommended secure schools https://secure.school/ - they only do security audits and do not provide other IT services so have no interest in selling. Haven't used them myself yet so can't comment what they are actually like.

[Mark182]

We used these in the summer and they were fantastic. Check their main person out here . We ran a full audit and have actioned quote a few things they found we'd never even thought of.

[robjduk]

Looks to be what I wanted. Thank you.