Your questions about working with Cyvra.

We offer four core service areas:

Cybersecurity: risk assessments, penetration testing, security frameworks, identity and access management, incident response, and security awareness training.

IT Management: IT strategy, cloud infrastructure (Azure, Microsoft 365), service desk, vendor management, cost optimisation, and backup and disaster recovery.

Artificial Intelligence: AI strategy and readiness assessments, AI process automation, Microsoft Copilot deployment, AI use case discovery, and AI governance.

Audits & Compliance: ISO 27001 certification, GDPR, PCI DSS, NIS2, DORA, internal audits, and ongoing compliance monitoring.

Both. Depending on your needs, we provide strategic advisory (assessments, gap analysis, and roadmaps) and hands-on implementation support. We are a consultancy, not a managed service provider: we work with your in-house team and your existing IT provider rather than replacing them. We do not push clients into retainers they do not need. We scope what is right for your situation.

Yes. Our cybersecurity team can support active incident response, including containment, forensic analysis, and recovery. We also help organisations build incident response playbooks and run tabletop exercises in advance, so your team knows exactly what to do when something happens.

If you are dealing with an active incident right now, contact us immediately and we will prioritise your request.

Yes. We cover the full ISO 27001 journey: gap analysis, risk assessment, control design and implementation, documentation, policy development, internal audit, and certification body preparation. We stay involved throughout the process. We do not hand off a folder of documents and wish you luck.

We also help organisations maintain their certification long-term, because compliance that drifts after the initial audit is compliance that fails at the next one.

NIS2 is the EU's updated Network and Information Security directive, which came into effect in October 2024. It significantly expands the scope of the original NIS directive, covering a broader range of sectors including healthcare, financial services, digital infrastructure, managed services, and more.

Under NIS2, organisations face stricter requirements around risk management, incident reporting, supply chain security, and executive accountability. Penalties for non-compliance can be substantial. If you are unsure whether NIS2 applies to your business, get in touch and we can help you assess your obligations quickly.

Our GDPR work covers lawful basis mapping, Records of Processing Activities (RoPA), Data Protection Impact Assessments (DPIAs), breach notification procedures, data subject rights processes, and DPO advisory support. We treat compliance as something that has to be embedded into how the business operates. It is not a one-time box-ticking exercise.

Yes. We provide audit readiness reviews that replicate what auditors will look for: evidence walkthroughs, stakeholder interview preparation, documentation reviews, and gap remediation. According to Swimlane's 2025 GRC research, 71% of organisations could fail a compliance audit. The majority of those failures come down to documentation and process gaps rather than any malicious action. That is exactly the territory we work in.

Our engagements are scoped to a defined deliverable, but we do not disappear the moment the work is done. If follow-up questions come up, a finding surfaces six months later, or your auditor raises something unexpected, you can come back to us. We will scope any additional work needed honestly and without unnecessary upselling.

For ongoing needs such as monitoring, periodic reviews, or continued support through a certification cycle, we can also structure longer-term arrangements. We do not push clients into retainers they do not need, but the option is there if it makes sense for your situation.

We work on fixed-price engagements with clear timelines and costs. You know exactly what you are getting and what it will cost before work begins. No surprises, no scope creep billed at day rates, no hidden fees.

We do not lock clients into ongoing retainers they do not need. If you need a one-time assessment, that is what we scope. If you need ongoing support, we can structure that too, on your terms and not as a default condition.

It depends on scope. A focused assessment (such as a security audit, compliance gap analysis, or AI readiness review) typically runs two to four weeks. A full ISO 27001 implementation, cloud migration, or AI deployment project can take three to six months.

We give you a realistic timeline as part of your proposal, including key milestones. We do not pad timelines or drag engagements out unnecessarily.

We work with businesses of all sizes. From startups finding their feet to large enterprises running complex operations, we adapt our approach to fit your scale, sector, and objectives. If you have a problem we can help with, the size of your organisation is not a barrier.

You send us a message describing your situation, and we respond within 1 business day. We then have a 30 to 45 minute introductory call to understand your needs, your environment, and your goals.

From there, we put together a clear proposal covering scope, timeline, and cost in plain language. No jargon, no padding, no pressure. If we are not the right fit, we will tell you and point you in the right direction.

You work directly with senior consultants throughout the engagement. We do not use account managers as a buffer or rotate helpdesk staff onto your project. The people you speak to at the start are the people doing the work, and they stay involved until it is done.

A specialist across cybersecurity, compliance, AI, and IT management is expensive to hire full-time, and nearly impossible to find in one person. With Cyvra, you get a team of specialists across all four disciplines for the duration you need them, with no recruitment cost, no onboarding time, and no ongoing salary commitment when the work is done.

We are also vendor-neutral. We recommend what is right for your situation, not what we have a commercial incentive to sell. That independence matters when you are making decisions about your infrastructure and security posture.