All products

Compliance programme

Secured and proven

We find the gaps an Irish small business gets caught on, fix them, and prove it. A second scan shows the fixes from outside, the rest is proven with dated evidence, and you get a score against CyFun Basic and an evidence pack for insurers and customers.

What you hold at the end. An evidence pack, dated and built from the record: every check before and after, each job with what closed it, and the CyFun Basic score with how much of it rests on what we saw.

How you get it. Start with the free compliance check. The programme is quoted for your business, and Run keeps it proven every month after.

Take the free compliance checkTalk to us about this

Price

On enquiry

The portal's evidence scan of tullyvane.example, a made-up business, recorded 28 Sept 2026 at 06:30 and seen from Dublin: 4 checks failed, 15 passed, and the record is hashed and chained to the one before it.
The first look: four of the nineteen checks failed, recorded and dated. The portal's evidence scan; the business and its results are sample data.
The second scan of tullyvane.example, recorded 30 Sept 2026 at 16:05: none failed and 19 passed. Under it, the four checks that had failed are listed as now passing: tracking cookies set before any choice, tracking requests sent before any choice, reject as easy as accept, and the DMARC policy.
The second scan, after the fixes: none of the nineteen failed. Sample data.

How it works

  1. Step 01

    We look from outside

    Your website and mail domain, checked as a customer, an insurer or the regulator would see them. The look is recorded and dated, and it is the before picture.

  2. Step 02

    We fix what it finds, and the six basics

    The six basics are covered whatever the scan saw: email authentication, cookie consent, the privacy notice, two-step sign-in, a tested restore and an incident plan with a practice run. Anything else the scan finds is fixed too, apart from accessibility, which is offered on its own.

  3. Step 03

    Each fix is proven

    A fix the scan can see is closed only by a later scan that passes. Two-step sign-in, the restore and the incident plan close on a dated document, checked by FourWinds.

  4. Step 04

    You get the score and the pack

    A score against CyFun Basic that shows how much rests on what we saw and how much on what you told us, and an evidence pack built from the record and dated, for insurers and customers' questionnaires.

Run keeps it proven

  • A slip comes back to us

    Your website and mail domain are scanned again every week. A check that passed and then fails reopens its job, and it shows on your record as ours again.

  • Each scan kept as it was

    Every scan is recorded with its date and chained to the one before it, so the before and after can still be read.

  • The pack, issued again

    On request, with current dates. Every pack issued is kept as it was sent, so a pack sent to an insurer can be read later exactly as it went.

What is included

  • An outside look at your website and mail domain, recorded and dated
  • Email authentication: SPF and an enforced DMARC policy
  • Cookie consent: nothing tracks a visitor before they choose
  • A privacy notice that names every tracker and service the scan saw
  • Two-step sign-in on every staff account
  • Backups kept apart, with a restore tried and dated
  • An incident plan, rehearsed once with the people in it
  • The scan's other findings fixed: website encryption, encrypted mail delivery, security headers, domain renewal and admin sign-in pages
  • A second scan, and dated evidence for what a scan cannot see
  • A score against CyFun Basic
  • An evidence pack for insurers and for customers' security questionnaires

Questions

What does the free check show?
What the law asks of your business in plain words, what we saw on your website and email from outside, and three jobs to start with. Keep it and it becomes your compliance record, free, with the one-month clock on access requests and the 72-hour clock on breaches.
Is the score an official CyFun result?
No. It is FourWinds' measure of the evidence held against the CyberFundamentals 2025 Basic requirements, not a CyFun self-assessment, verification or label. It shows how much rests on what we saw and how much on what you told us.
What can a scan not see?
Most of CyFun Basic is about what happens inside the business. Two-step sign-in, the restore and the incident plan are proven with a dated document, checked by FourWinds, and the pack says which proof is which.
Is accessibility included?
The scan runs an automated accessibility check on your homepage. Fixing what it finds is offered on its own, because a service business with fewer than ten people and turnover or balance sheet of €2 million or less is outside the European Accessibility Act.
What does it cost?
It is quoted for your business. The free check and the compliance record cost nothing.
Where is it all kept?
On your compliance record in the portal, which is free. The jobs, the scans and the pack sit there beside your record of processing, your AI register and any DPIA.
What if you find something serious?
We tell you straight away, and say whether it carries a notification deadline.

Talk to us

Tell us what the work looks like now. We will say whether this is the right line for you, and what it would cost.

Send us the detail

Everything else we sell

All products →