Your global partner for PCI security
Cyber security services that stand up to auditors, customers and attackers.
A UK cyber security company: PCI QSA, IASME Cyber Essentials certification body and penetration testing.
Our cyber security services cover PCI DSS, PIN and card production audits, Cyber Essentials and CE+, ISO 27001 and penetration testing for banks, payment companies, global brands and UK SMEs, with a fixed quote before work starts.
Approved & accredited
- QSAPCI Qualified Security AssessorPCI Security Standards Council
- QPAPCI Qualified PIN AssessorPCI Security Standards Council
- CPSAPCI Card Production Security AssessorPCI Security Standards Council
- GEARGlobal Executive Assessor Roundtable member (2026 to 2028)PCI Security Standards Council
- CE / CE+Cyber Essentials Certification BodyIASME Consortium
- ISO 27001ISO/IEC 27001 certifiedCertified information security management
Trusted by banks, payment providers and global brands
What we do
Cyber security services under one roof: compliance, certification and testing
One partner for the standards your customers, acquirers and regulators ask for. We consider the laws and regulations that apply to you to cut project time and avoid duplicated effort across frameworks. For advice that spans several standards, see our cyber security consultancy.
QSA · QPA · CPSA
PCI Services
PCI DSS assessments from a PCI QSA company, plus PCI PIN, card production, P2PE and 3DS assessments, each under its own PCI SSC approval. New to the standard? Start with what PCI DSS is.
Explore PCI Services →IASME certification body
Cyber Essentials
Government-backed Cyber Essentials and Cyber Essentials Plus certification, from £320 + VAT, with a pre-assessment check and an assessor support call in every package.
Explore Cyber Essentials →ISO/IEC 27001:2022
ISO Certification
ISO 27001 implementation and certification with our partner certification body, plus ISO 9001, 14001, 45001, 22301 and more.
Explore ISO Certification →Testing & assurance
Penetration Testing
Manual web, API, network, cloud and mobile testing, plus vulnerability scanning and ASV scans through an approved partner, reported to support PCI DSS 11.3 and 11.4, CE+ and ISO 27001.
Explore Penetration Testing →Start here
Popular guides & tools
Straight answers on prices, requirements and scope, plus free tools to check where you stand and get a fixed quote.
- Free toolPCI compliance checkAnswer 22 questions in about 5 minutes for a readiness score, your likely SAQ and a fix list.
- Free toolCyber Essentials readiness checkTest your set-up against the five controls and see where you would fail before you apply.
- Quote toolPenetration testing quoteChoose your test types and asset counts, then request a fixed-price proposal.
- Cost estimatorPCI DSS compliance costWhat QSA audits, SAQ support, pen tests and ASV scans cost, and how your scope drives the price.
- Price guideCyber Essentials Plus costWhat drives the price of a CE+ audit, with published UK price ranges by company size.
- ChecklistCyber Essentials checklistThe five technical controls as checkable items, including MFA and the 14-day patching rule.
- GuidePCI DSS compliance in the UKWho must comply, what your acquirer expects, and when you need an SAQ or a Report on Compliance.
- Price guideISO 27001 certification costAll-in costs: consultancy, Stage 1 and Stage 2 audits, surveillance audits and recertification.
Cyber Essentials
Assessed in as little as 24 hours
As an IASME-licensed certification body we assess and certify you directly. Pick the level of support you want; every package includes a pre-assessment check and a support call with an assessor.
Prices for 0 to 9 employees. Other company sizes
Bronze
£320 + VAT
- Assessed in
3 to 5 working days - Resubmissions
1 - Time to pass
10 working days
Silver
£410 + VAT
- Assessed in
48 hours (2 working days) - Resubmissions
3 - Time to pass
1 month
Gold
£510 + VAT
- Assessed in
24 hours (1 working day) - Resubmissions
Unlimited - Time to pass
3 months
About us
Who is Sovereign Secure? A UK cyber security company founded in 2012
Sovereign Secure Ltd (company no. 08334453, est. 2012, Accrington, Lancashire, UK) is a PCI SSC-approved Qualified Security Assessor (QSA), Qualified PIN Assessor (QPA), Card Production Security Assessor (CPSA), P2PE Assessor (Europe and USA) and 3DS Assessor company, a member of the PCI SSC Global Executive Assessor Roundtable 2026 to 2028, an IASME-licensed certification body for Cyber Essentials, IASME Cyber Assurance and Defence Cyber Certification Levels 0 and 1, and an ISO 27001-certified firm, with offices in Los Angeles, Singapore, Dubai and Dhaka.
Our clients range from banks, payment companies and card manufacturers to retailers, technology companies and UK SMEs taking their first step with Cyber Essentials. Our guide to cyber security by industry shows which standards apply in each sector. ISO certification audits are carried out by our partner certification body, MQA International. See our About page for where to verify each approval.
- Established
- 2012
- Global offices
- 5
- PCI SSC approvals
- 5
- Gold CE assessment
- 24h
How we work
- 1Free consultationTell us what you need and your deadline. We confirm the right standard, scope and route to compliance.
- 2Fixed quoteYou get a clear scope, timeline and fixed price. No day-rate surprises.
- 3Gap analysis & supportWe show you exactly what is missing and help you close it, with evidence reviewed as you go.
- 4Assessment & certificationIndependent assessment, report and certificate or attestation, then ongoing support to stay compliant.
Client feedback
Don't just take our word for it
The specialist team at Sovereign Secure provided valuable support throughout our EMV certification process. They demonstrated a keen understanding of PCI production requirements and expertly steered the audit to a successful conclusion. We commend them on their innovativeness in conducting the audit of our facility remotely and the proactive nature of their services. We want to make special mention of the Security Assessor, Agnes Ng for her professionalism, efficiency and undisputed industry knowledge. Agnes and her team at Sovereign Secure were a pleasure to work with and an excellent choice for anyone looking for security consultancy and assessment in the PCI Card Production Industry.
Sovereign Secure provided Payment Card Industry Compliance Services to Bamcard for the following standards: PCI CPSA, PCI DSS and PCI PIN. Even with the global COVID-19 pandemic, they managed to provide the best possible, knowledgeable support during the process of auditing and achieving compliance. The Sovereign Secure assessors were so helpful in these challenging times … with years of Payment Card Industry experience. We would happily recommend them to any company in need of the services mentioned.
Engaged Sovereign Secure for Penetration Testing and Cyber Essentials and received a professional and friendly service. The Cyber Security Services were delivered on time and price was competitive. I would highly recommend the team at Sovereign Secure … to any organisation.
Partners and accreditations
Insights
Guides from our assessors
PCI DSSPCI Network Segmentation: How to Design and Test a Compliant NetworkHow PCI network segmentation works under v4.0.1: define the CDE, choose controls that isolate it, avoid VLAN pitfalls and prove it with segmentation tests.
PCI DSSPCI DSS Compliance Roadmap: A Five-Phase TemplateA free PCI DSS compliance roadmap template (Excel) in five phases, from scoping and gap analysis to remediation, assessment and BAU, with owners and timelines.
PCI DSSPCI DSS Business as Usual: How to Stay Compliant All YearWhat PCI DSS business as usual means under v4.0.1, with a year-round compliance calendar, change-control checks and the evidence your QSA will ask for.FAQ
Questions about our cyber security services
Can't find your answer? Call us on +44 161 523 5276 or send us a message.
What are cyber security services?
Cyber security services are the assessments, certifications, consultancy and testing that protect an organisation’s systems and data, and prove it to customers and regulators. Ours cover PCI DSS compliance assessments, Cyber Essentials and Cyber Essentials Plus certification, ISO 27001 consultancy, and penetration testing and vulnerability scanning.
How do you choose a UK cyber security company?
Not all cyber security companies hold the approvals your customers ask for, so check them on the awarding bodies’ own registers: the PCI SSC assessor listings for PCI work and IASME’s directory for Cyber Essentials. Then ask for a written scope and price before work starts, and ask who will do the testing and whether any of it is subcontracted. Our guides on choosing a PCI QSA and choosing a penetration testing company go further.
What does Sovereign Secure do?
We are a cyber security compliance firm. We assess and certify organisations against PCI DSS, PCI PIN, PCI Card Production, Cyber Essentials and Cyber Essentials Plus, help them implement ISO 27001 and other ISO standards, and provide the penetration testing and vulnerability scanning those standards require.
Are you accredited?
Yes. We are approved by the PCI Security Standards Council as a Qualified Security Assessor (QSA), Qualified PIN Assessor (QPA), Card Production Security Assessor (CPSA), P2PE Assessor (Europe and USA) and 3DS Assessor, and we are a member of the PCI SSC Global Executive Assessor Roundtable (GEAR) for 2026 to 2028. We are also an IASME-licensed certification body for Cyber Essentials, IASME Cyber Assurance and Defence Cyber Certification Levels 0 and 1. We are ISO 27001 certified and registered with the ICO. Our About page lists where to verify each one.
How are your services priced?
Cyber Essentials starts at £320 + VAT for organisations with up to 9 employees, depending on company size and the level of support you want; see our Cyber Essentials prices. Cyber Essentials Plus, PCI, ISO and penetration testing work are quoted at a fixed price once we understand your scope.
Do you only work with UK companies?
No. We are headquartered in the UK with offices in the United States, Singapore, Dubai and Bangladesh, and have delivered PCI and ISO projects for clients across Europe, the Middle East, Asia and the Americas. Cyber Essentials is a UK scheme but is open to organisations anywhere.
How quickly can you start?
Cyber Essentials assessments can start as soon as you are ready to submit, and Gold package submissions are assessed within one working day. For PCI, ISO and penetration testing we agree a start date with you when we confirm scope and send the quote.
Free consultation
Your security is our business
We aim to reply within one working day, and send a fixed quote once your scope is confirmed.
- PCI SSC-approved QSA, QPA, CPSA, P2PE and 3DS assessors
- IASME-licensed Cyber Essentials certification body
- Clients across the UK, US, Europe, Middle East and Asia since 2012
“We would happily recommend them to any company in need of the services mentioned.”
Call +44 161 523 5276
Email [email protected]