United Kingdom · for small businesses
Your answers make claims. Your website keeps the record.
grc-scan is free cyber security and compliance for UK small businesses, in plain English. Answer the Cyber Essentials, UK GDPR, cyber-insurance or public-contract questions, name your website, and we check what we can against what the internet actually sees.
Every line is labelled — verified by a scan, taken from your answer, or something no outside scan can see — and every gap comes with the fix. Priced out of a consultant, not out of knowing where you stand.
free · no sign-up · nothing of yours stored
Passive scanYour website still accepts TLS 1.0/1.1 — encryption versions browsers dropped years ago.
Passive scanCertificate trusted, and HSTS is set.
Your answerMFA on every account, email and cloud included — you said yes. We can't see it from outside, so it stays your word.
Your answerAutomatic updates turned on everywhere — you said unsure, which counts as a gap to close.
—Anti-malware lives on your devices; no outside scan can see it.
UK compliance
FreeWould you pass the UK government-backed baseline today? The five controls, plain English, the exact gaps to fix.
The data-protection areas the ICO actually looks at, with your website's security checked against Article 32.
Could you get UK cover — and would a claim pay out? The insurer knock-outs, checked.
Bidding for public work? The Procurement Act grounds, the disqualified-directors register, and the Cyber Essentials condition.
Every control and question explained, and what the scheme means for your industry.
Scan your domain
FreeGrade your domain's public security A–F: headers, TLS, email anti-spoofing, DNS, reputation.
Which of your services answer to the open internet — seen the way an attacker sees them.
Can criminals send email as you? The usual start of UK invoice fraud. An SPF/DMARC traffic light.
Paste a suspicious link instead of clicking it — a plain-English verdict.
Full nmap + nuclei scan of a website you prove is yours. Deleted after about three days.
Self-checks & reading
The practices only you can see, against the NIST CSF 2.0 functions.
Raising? The investor due-diligence gaps — IP assignment, MFA, SOC 2 — before the data room opens.
Who the ICO penalised, why, and the cheap lesson for your business. Every Wednesday.
The vulnerabilities attackers are exploiting right now, from CISA's list. Every Monday.
The week's stories that matter to a small business, and what to do. Every Friday.
Has your address appeared in a known breach? Via Have I Been Pwned.
Who uses this
The owner
A café, a shop, a trade, a small agency. You want to know where you stand without paying a consultant to tell you.
Start with a posture scan→Whoever looks after your IT
An IT provider, or the one person who does the computers. Check as many domains as you like and hand the client a PDF in plain English.
Check a client's email→A supplier bidding for contracts
Cyber Essentials is a condition on many public and larger private contracts. See whether you'd pass, and what else could exclude you.
Check contract eligibility→Founders and investors
Founders: the technical gaps a fund's due diligence will find. Investors: an outside-in read of a company's domain — the posture and email checks read only what it already publishes; the exposure and in-depth scans need the company's say-so.
Tech-DD readiness→
Latest briefings
ICO fines & breaches
Neither story this week is about a clever attack: one is about organisations unable to see what their suppliers were doing, the other about data being treated as fair game because it was already public. - List every supplier that can reach your customer data, and ask each in writing how fast they would tell you about an incident. - Never scrape or buy a marketing list — "it was public" is not a lawful basis, and the PECR liability lands on you. - Get a named out-of-hours contact from your IT provider and keep it somewhere you could read it offline.
What to patch now
This week's fixes sit mostly in software a business chooses and installs itself — a media server, a self-hosted office suite, a firewall module — rather than the big-name network-edge boxes of recent weeks. - Run Plex Media Server, even just at home on a device that touches your work network? Update it now — four flaws chain together. - Self-host Nextcloud with the built-in Collabora editor, or a web-server WAF module? Check the vendor's fix and apply it today. - Run multi-site SD-WAN (Arista) or Siemens industrial software? Ask your network or OT provider whether this week's patches are on.
Cybersecurity news
Every flaw actually being exploited this week — in a shop module, a firewall, a compression library and PHP itself — was reachable from the internet by someone with no login at all. - Patch anything facing the internet within days, not at the next convenient window, and restart the service afterwards. - Audit the third-party scripts and browser extensions you have quietly accumulated, and delete whatever nobody can explain. - After a supplier's breach, rotate your own credentials: a key or scheduled task left behind survives an update.
These are free readiness and gap reports to help you prepare — not a certification, not an ICO assessment, and not legal advice. We are not an IASME Certification Body. Findings reflect what we could observe at the time of the check. How we test, and why you can trust it →