Compliance programme
Protect
We find the compliance gaps that catch out Irish small businesses, fix them, and prove it. A second scan shows the fixes from outside, and dated documents prove the rest. You get a score against a published set of basic cyber security requirements (CyFun Basic) and an evidence pack to show insurers and customers.
What you get at the end. An evidence pack, dated and built from your record. It shows every check before and after, and each fix with the proof that closed it. It also gives your CyFun Basic score, and how much of it rests on what we saw.
How you get it. Start with a 20-minute call, or with the free compliance check on your own domain. Afterwards, Support keeps it proven every month.
Price
From €2,950
Who it is for
Irish businesses with 5 to 50 staff, at the point somebody asks for proof:
- Your insurer asks at renewal about two-step sign-in, backups and email protection.
- A customer sends a security questionnaire, or a tender asks for evidence.
- You hold customers' personal data and want each gap closed and the closing recorded.
What is included
- A check of your website and email from outside, recorded and dated
- Email protection that tells inboxes to reject fake emails sent in your name, or mark them as spam (SPF, and DMARC set to enforce)
- Cookie consent: nothing tracks a visitor before they choose
- A privacy notice that names every tracker and service the scan saw
- Two-step sign-in on every staff account
- Backups kept separately, with a test restore done and dated
- A plan for when something goes wrong (an incident plan), practised once with the people it names
- A record of how you use personal data (the record of processing), reviewed with you and dated
- Written steps for when somebody asks for their data and for a data breach, with the one-month and 72-hour deadlines counted on your compliance record
- The scan's other findings fixed too: website encryption, encrypted email delivery, the security settings your site sends to browsers, domain renewal, and admin sign-in pages kept off the open internet
- A second scan, and dated evidence for what a scan cannot see
- A score against CyFun Basic
- An evidence pack for insurers and for customers' security questionnaires
The price
Up to 10 staff
€2,950
The whole programme: the scan, every fix, the second scan, the score and the evidence pack.
11 to 25 staff
€4,950
The same programme, for more accounts, devices and people to train.
26 to 50 staff
€7,500
The same programme, for a larger business. Over 50 staff, we quote.
The GDPR pack is also sold on its own, €650 once. What you paid comes off Protect if you take it within three months. Each price is fixed and agreed in writing before we start.
How it works
Step 01
We look from outside
We check your website and email from outside, the way a customer, an insurer or the regulator would see them. We record and date what we find, and that is your before picture.
Step 02
We fix what it finds, plus the basics
We cover the six basics an insurer asks about, whatever the scan saw: email protection, cookie consent, the privacy notice, two-step sign-in, a tested backup restore and an incident plan with a practice run. We also write two GDPR documents with you: your record of processing, and the steps for a data request and for a breach. We fix anything else the scan finds too, apart from accessibility, which is offered separately.
Step 03
We prove each fix
If a scan can see the fix, it only counts as done once a later scan passes. Two-step sign-in is read from your Google Workspace if you use it, or closed with a dated document. The restore, the incident plan and the two GDPR documents are each closed with a dated document, which FourWinds checks.
Step 04
You get the score and the pack
A score against CyFun Basic, showing how much of it rests on what we saw and how much on what you told us. You also get a dated evidence pack built from your record, for insurers and for customers' security questionnaires.
Support keeps it proven
If something slips, it comes back to us
We scan your website and email again every week. If a check that passed starts to fail, its job reopens and shows on your record as ours to fix.
Each scan kept as it was
Every scan is saved with its date and linked to the one before it, so you can always compare before and after.
A fresh pack when you ask
We issue it again with current dates whenever you ask. Every pack is kept exactly as it was sent, so you can always see what an insurer received.
Questions
- What does the free check show?
- It shows what the law asks of your business, in plain words. It also shows what we saw on your website and email from outside, and three jobs to start with. Keep it and it becomes your free compliance record. It counts down two legal deadlines: one month to answer a person who asks for their data, and 72 hours to report a data breach.
- Is the score an official CyFun result?
- No. It is FourWinds' measure of the evidence held against the CyberFundamentals 2025 Basic requirements. It is not a CyFun self-assessment, verification or label. It shows how much rests on what we saw and how much on what you told us.
- What can a scan not see?
- Most of CyFun Basic is about what happens inside your business. If you use Google Workspace, two-step sign-in, admin accounts and unused accounts are read from it directly, each reading dated. Otherwise two-step sign-in is proven with a dated document that FourWinds checks, as are the restore, the incident plan, the record of processing and the steps for a data request and for a breach. The pack says which proof is which.
- Is accessibility included?
- The scan runs an automatic accessibility check on your homepage. Fixing what it finds is offered separately. That is because a service business with fewer than ten people and a turnover or balance sheet of €2 million or less is outside the European Accessibility Act.
- What does it cost?
- €2,950 up to 10 staff, €4,950 for 11 to 25 and €7,500 for 26 to 50. Over 50 staff, we quote. The free check and the compliance record cost nothing.
- Where is it all kept?
- On your free compliance record in the portal. The jobs, scans and pack sit there too, beside your record of how you use personal data, your register of AI tools and any data protection impact assessment (DPIA).
- What if you find something serious?
- We tell you straight away, and say whether you have a deadline to report it.
Every duty in the compliance record comes from the published text of the law, is checked twice and is watched every day. How we check the law.
What you can check first
The same scan, free
The free compliance check looks at your website and email from outside, the same look the programme starts with.
Take the free checkOur own software
The evidence scan, the score and the pack are produced by our client portal, shown in the screens on this page.
Scored against CyFun Basic
A published set of basic cyber security requirements, from a scheme Ireland co-owns.
Guides on this
- Cyber security
Cyber security for a small Irish business: the six measures, and the proof
- Cyber security
A ransomware attack: what to do in the first hour, and who to tell
- Microsoft 365
Two-step sign-in for every Microsoft 365 user: the admin screens, in order
- Research
Email security in five Irish sectors: 4,101 domains, read on 29 October 2026
- Microsoft 365
Microsoft Authenticator for a small team: set-up, sign-in and new phones
Book a 20-minute call
Tell us how the work is done today. We tell you what to change first, and which price applies.
Book a 20-minute call