Your cyber insurance is up for renewal
Insurers ask about MFA, backups and admin accounts. See the evidence behind each answer before you sign the form.
Review evidence for your renewalINDEPENDENT CYBER ASSURANCE FOR SMALL BUSINESSES
You can outsource your IT. Security is still your responsibility.
CyberProva helps you see the evidence behind your security: selected Microsoft 365 settings, evidence from your IT provider and clear priorities for what needs attention. Know what has been checked, what is missing and what to ask next.
Microsoft work account required · No card needed
Start with 3 free core assessments, saved findings and an on-screen summary.
✓ Read-only access to Microsoft 365
✓ Hosted in the UK
CyberProva
Sample data
A finding you can act on
Waiting for evidence- What is being checked
- MFA enabled for administrators
- Why it matters
- Administrator accounts can change important settings. You need evidence that they have stronger sign-in protection.
- What to ask your IT provider
- Please share a dated report showing MFA coverage for administrator accounts, including any exceptions.
FROM CLAIMS TO EVIDENCE
Ask for evidence. See what it supports.
When your IT provider says a control is in place, collect the supporting evidence against that check. Keep the result, evidence source and review date together for questions from customers, insurers or your board.
“How do you know those controls are actually in place?”
Automated checks verify selected Microsoft 365 settings. Other controls are supported by evidence reviewed by your organisation. CyberProva records that evidence and its review status; it does not independently verify the underlying facts.
43% of UK businesses reported a cyber security breach or attack in the preceding 12 months in the government's 2025/2026 survey. Read the UK government survey.
- They say "MFA is switched on for everyone."
- CyberProva checksIt reads your Microsoft 365 configuration and asks your provider for proof of what it can't see.
- You can show itEvery control has a status, its evidence and a date, ready when someone asks.✓ Evidence provided✓ Evidence attached✓ Last checked date recorded
HOW IT WORKS
From assumption to evidence in five steps
01
Connect
Connect Microsoft 365 for automated checks, or start with an evidence-based assessment.
02
Request evidence
For anything that can't be checked automatically, send your IT provider a secure link. They upload proof without creating an account.
03
Review
Review each piece of evidence against the control it supports, and accept or reject it.
04
Fix
Prioritised findings show what needs attention, why it matters and who owns the fix.
05
Report
Share a clear report with your board, insurer or customers, and keep the history for next time.
YOUR IT PROVIDER STAYS IN THE LOOP
Your IT provider doesn't need another portal.
CyberProva emails your provider a secure link with the check and suggested evidence. They upload the file — no login or new system to learn.
IT providers: CyberProva is a simple way to show clients the work you already do. Point them here, and answer their questions once, with evidence.
CyberProva
ID-01.01
MFA enabled for administrators
“Please provide evidence of MFA enforcement for administrator accounts (ID-01.01): enabled Conditional Access policies or Security Defaults, administrator coverage, policy scope and exclusions, plus dated sign-in records showing the authentication requirements applied. A settings screenshot alone does not establish enforcement.”
Suggested evidence✓ Enabled MFA policies, scope and exclusions✓ Dated sign-in verification
Secure link valid for 14 days · up to 10 files · PDF, images, Word, Excel, CSV or text
EVIDENCE, NOT JUST A SCORE
Not just a score. The evidence behind it.
See each control's status, evidence source and review date. Unchecked controls stay unverified.
CyberProva
Sample data
| Control | Check | Status | Source |
|---|---|---|---|
| ID-01.01 | MFA enabled for administrators | Evidence provided · IT provider | IT provider |
| M365-01.01 | Microsoft Secure Score is reviewed | Verified · automated check | Microsoft 365 |
| ID-01.03 | Legacy authentication disabled | Action required | IT provider |
| ID-02.01 | Separate administrator accounts used | Waiting for evidence | IT provider |
| BC-01.04 | Restore testing has been completed recently | Waiting for evidence | IT provider |
| BEC-01.01 | Bank detail changes are verified by callback to a known number | Evidence provided | Business |
INSIDE CYBERPROVA
See the controls. Share the evidence.
Demonstration workspace · sample data
SEE IT IN ACTION
Watch the demo
See what is supported by evidence, what remains open and who owns the next action.
WHEN YOU NEED IT
When someone asks "are you secure?", have the answer ready.
A customer sends a security questionnaire
Draft replies from your assessment findings and supporting evidence. See what has been checked and where evidence is still missing.
Business plan and above
See the evidence behind your answersThe board or an investor wants assurance
Turn technical findings into a one-page summary of checks, supporting evidence and outstanding actions.
Prepare your board security reportYou are planning a review with your IT provider
Bring the evidence and outstanding requests to your next service review, and agree priorities together.
See what to ask your IT provider forYou're preparing for Cyber Essentials
Prepare for Cyber Essentials, a UK certification scheme, with checks mapped to its five technical control areas. Certification is carried out by an accredited Certification Body.
Explore evidence for UK Cyber EssentialsSecurity evidence for your sector
Start with the client information, access changes and provider questions relevant to your practice or agency.
See which applications are connected to your Microsoft 365
Search connected applications by name or ID. Review their enabled status, recorded owners and Microsoft Graph application permissions, with a dated inventory saved alongside your assessment.
Application inventory is included in Business and Professional advanced assessments.
Covers Microsoft Graph app-only permissions. Delegated user consent, permissions to other APIs and last-used dates are not included.
See what the application review coversPRICING
Start free. Upgrade when you need more.
The Free plan includes three assessments and three website scans, so you can see where you stand before you pay anything.
Free: 3 lifetime core assessments, on-screen findings and summary, plus evidence requests. No credit card required.
Business: add report exports, remediation management, questionnaires and advanced assessments.
Professional: add scheduled assessments and change monitoring.
Free
See where you stand, at no cost.
Free
No card required
- 3 lifetime core assessments
- 3 lifetime website/DNS scans across 1 selected hostname
- Full saved findings and on-screen board summary
- Evidence review and basic action list
- Optional Microsoft 365 connection
FOR EVIDENCE & REPORTING
Business
Turn your findings into evidence you can share.
£59 /month
£59 per month, cancel any time
- Unlimited on-demand assessments and scans
- 5 hostnames, advanced Zero Trust checks and searchable application inventory
- Remediation ownership, deadlines and risk acceptance
- Export reports and quarterly board packs
- In-app configuration-change alerts
Professional
Keep your security checks running automatically.
£129 /month
£129 per month, cancel any time
- Everything in Business
- Email alerts when something changes or regresses
- Scheduled assessments: daily, weekly or monthly
- Scheduled Zero Trust and website monitoring
- Read-only integration API
Need support for a larger organisation? Contact us.
Free needs no card. Paid plans start billing at checkout and exclude VAT where applicable. Prices are shown and charged in GBP.
A hostname is a website address, such as www.example.com. DNS checks assess domain and email settings. Zero Trust checks review identities, access and devices rather than assuming they are trusted.
Questions businesses ask before they start
What access does CyberProva need?
Read-only access to your Microsoft 365 security settings, granted by one of your administrators. It can't change anything in your tenant, read your emails or open your files. The full list of permissions is on our Security page.
Where is my data stored?
In Microsoft Azure data centres in the UK. Evidence files are stored privately and are only available to people in your workspace.
Will my IT provider mind?
CyberProva gives you and your provider a shared record of findings and supporting evidence. Providers receive a secure upload link and need no CyberProva account to respond.
Do I need technical knowledge?
No. Findings are written in plain English, with why each one matters and what to ask your provider to do.
Is this a Cyber Essentials certification?
No. CyberProva helps you understand and evidence your controls. Certification is carried out by an accredited Certification Body.
Can I cancel?
Yes. Monthly plans can be cancelled at any time from your billing page, and your saved results stay readable on the Free plan.
Build a clear picture of your security together.
See automated Microsoft 365 findings, collect supporting evidence and agree the next actions with your IT team or provider. Start free.
Start your free assessment
Microsoft work account required · No card needed