The short answer
Cyber security by industry depends on the data you handle and who you sell to. Any business taking card payments must comply with PCI DSS, many UK public sector contracts require Cyber Essentials, organisations with access to NHS patient data complete the DSPT, EU financial entities fall under DORA, and SaaS firms are often asked for ISO 27001 or SOC 2.
On this page
Cyber security by industry comes down to two things: the data you handle and who you sell to. Those decide which standards you must meet and prove. Taking card payments brings PCI DSS. Bidding for UK central government contracts often brings Cyber Essentials. Access to NHS patient data brings the Data Security and Protection Toolkit (DSPT). Enterprise and overseas customers often ask for ISO 27001 or a SOC 2 report. The table below maps the common standards by sector and links to a page for each.
Cyber security by industry: which standards apply to yours?
| Sector | Standards you are most likely to meet | Sector page |
|---|---|---|
| Financial services (lenders, insurers, wealth managers and payment firms) | PCI DSS wherever card data is handled, Cyber Essentials or ISO 27001 for partner due diligence, annual penetration testing, UK operational resilience, DORA for EU entities | Cyber security for financial services |
| Banking | PCI DSS, PCI PIN, PCI Card Production for in-house card issuing, UK operational resilience, DORA for EU entities, SWIFT CSP | Cyber security for banks |
| Fintech and payments | PCI DSS as a service provider, PCI PIN, ISO 27001, DORA for EU entities, SOC 2 for US customers | Fintech cybersecurity |
| Card production and personalisation | PCI Card Production and Provisioning (logical and physical security requirements) | PCI card production audits |
| Retail, e-commerce and hospitality | PCI DSS (SAQ or ROC), ASV scans where required, Cyber Essentials | Cyber security for retail |
| Healthcare | NHS DSPT, Cyber Essentials, ISO 27001 | Cyber security in healthcare |
| SaaS and software | ISO 27001, SOC 2, web application and API testing, PCI DSS if you handle card data | SaaS penetration testing |
| Manufacturing | Cyber Essentials and CE+ for supply chains, DEFCON 658 on defence contracts, ISO 27001 | Manufacturing cyber security |
| Schools and colleges | Cyber Essentials, the DfE cyber security standards, PCI DSS for card payments | Cyber Essentials for schools |
| Law firms | Cyber Essentials, ISO 27001, client and insurer security questionnaires | Cyber Essentials for law firms |
| Charities | Cyber Essentials, PCI DSS for card donations | Cyber Essentials for charities |
| Small businesses | Cyber Essentials, PCI DSS SAQs | Cyber security for small business |
How does cyber security differ by industry?
Mostly in the standard you report against, not the controls underneath. Most organisations meet two or three of these standards at once, and the controls overlap: the five Cyber Essentials controls (firewalls, secure configuration, security update management, user access control and malware protection) also appear in ISO 27001 and PCI DSS, and one penetration test can support PCI DSS Requirement 11.4 and ISO 27001 Annex A control 8.8.
What changes from sector to sector is who checks the evidence and how often:
| Standard | Who checks it | How often |
|---|---|---|
| PCI DSS | Your acquirer or the card brands, who receive a QSA’s Report on Compliance or your Self-Assessment Questionnaire | Every year |
| Cyber Essentials | An IASME-licensed certification body | Renewed each year |
| NHS DSPT | Your own self-assessment, submitted online to NHS England | Every year |
| ISO 27001 | An independent certification body | Surveillance audits each year, recertification every three years |
Planning the work together lets one set of evidence serve several standards.
What do we deliver in every sector?
The same four verified service lines, applied to your sector’s rules:
- PCI DSS, PIN and card production assessment and consultancy, as a PCI SSC-approved QSA, QPA and CPSA company.
- Cyber Essentials and Cyber Essentials Plus certification, as an IASME-licensed certification body.
- ISO 27001 and other ISO consultancy, with certification audits by our partner certification body, MQA International.
- Penetration testing and vulnerability scanning, with ASV scans delivered through our PCI SSC Approved Scanning Vendor partner.
Our cyber security consultancy page explains how these fit together.
Which sectors do our clients come from?
| Sector | Clients and testimonials shown on our site |
|---|---|
| Banking | Ahli United Bank, Kuwait Finance House, AYA Bank, Bank of Palestine, First National of Nebraska |
| Payments and fintech | Fiserv, Cashplus, Liquid Pay |
| Card production | Nitecrest, Bamcard, Intelligent Card Production Systems |
| Retail, ticketing and hospitality | JCPenney, Albertsons, Ticketmaster, Accor |
Find your sector in the list below, or tell us what you need through the enquiry form on this page.
In this section
- Financial servicesCyber security for financial services firms in the UK: PCI DSS, PIN and card production, Cyber Essentials Plus, ISO 27001 and penetration testing. Get a quote.
- BankingPCI compliance and cyber security for banks and card issuers: how PCI DSS, PCI PIN and card production apply, plus SWIFT CSP and DORA. Get a fixed quote.
- FintechFintech cybersecurity for payment, e-money and open banking firms: PCI DSS as a service provider, API and app pentests, Cyber Essentials and DORA test evidence.
- Retail and e-commerceCyber security for retail, e-commerce and hospitality: the most common attacks, and the PCI DSS route, Cyber Essentials and testing each channel needs.
- HealthcareCyber security in healthcare for NHS suppliers, clinics and device makers: the main threats, the DSPT, Cyber Essentials Plus, penetration testing and PCI DSS.
- SaaSSaaS penetration testing for B2B software firms: multi-tenant isolation, API and web app scope, release-cycle testing and reports enterprise customers accept.
- ManufacturingManufacturing cyber security: Cyber Essentials Plus scope for factory systems, safe OT and IoT testing, MOD supplier rules and product law. Get a fixed quote.
- Cyber Essentials for schoolsCyber Essentials for schools and trusts: how it fits the DfE standards, what is in scope, free help with cyber security for schools and prices from £320 + VAT.
- Cyber Essentials for law firmsCyber Essentials for law firms: the Legal Aid Agency rule, what Lexcel and the SRA expect, scoping remote fee earners, and CE or CE+. Certify from £320 + VAT.
- Cyber Essentials for charitiesCyber Essentials for charities: what the Charity Commission expects, whether free funding still exists, how volunteers' devices are scoped and what it costs.
- Small business cyber securitySmall business cyber security made practical: the threats UK SMEs face, a step-by-step plan, a checklist, where Cyber Essentials fits and when to add a pentest.
Last reviewed October 2026 by the Sovereign Secure assessment team.
