Secure Innovation

Find out more information about the scheme, and how to apply

Executive Summary

About
Funding and Costs
How to Apply

The UK’s National Protective Security Authority (NPSA) and National Cyber Security Centre (NCSC) have developed the Secure Innovation campaign to help founders and leaders of innovative early-stage tech companies to protect their IP, competitive advantage, and reputation from state threat actors and state backed competitors. The campaign also aims to inform organisations of security risks, particularly those arising from state threats, to helping them to understand how to manage them. It is particularly relevant for spin-outs and start-ups with significant potential to grow. The scheme aims is to connect organisations with KEYSIGMA’s security reviewers and assured Cyber Advisors who can review an organisations current protective security practices and provide high quality guidance and advice developed by the UK’s national technical authorities.

The scheme bears the majority cost of each Review through a £2,500 grant, with a supplement of £500 from each business. To encourage organisations receiving a security review to progress toward achieving Cyber Essentials certification, a £300 voucher code towards Cyber Essentials will be provided to each participating organisation.

There are only 500 places on the scheme for this calendar year, Contact Us to apply now and secure your funding

Scheme Framework

The Security Review scheme is funded through a joint initiative between the Department for Business and Trade (DBT), the Department for Science, Innovation and Technology (DSIT), National Protective Security Authority (NPSA), and the National Cyber Security Centre (NCSC). The review will provide a high-level overview of your overall protective security posture -not limited to cyber security. While cyber security remains a critical element, the review will offer a holistic view of security practices by considering the approach to the controls:

Cyber Essentials

Alongside the Secure Innovation Consulting, you will receive a voucher for Cyber Essentials. Cyber Essentials is an NCSC Certification that provides you with Baseline Protection Against Common Threats; it covers the most common attack vectors — such as phishing, malware, and insecure software — and helps organisations put essential controls in place to stop around 80% of common cyber attacks. For enhanced assurance and a hands-on technical audit, you can also choose to upgrade to Cyber Essentials Plus, which offers a more in-depth assessment of your cyber security defences.

Secure Supply Chain and Partnerships

Protective Security Governance

Risk Management

Cyber Security

Security Culture

Incident Management

The Path to Secure Innovation

The Secure Innovation Process Consists of 6 Stages:

Step 1 - Application

Secure Innovation Security Reviews is a subsidy scheme with participating companies will contributing £500 (Including VAT); whilst HMG will fund the remaining £2500 (Including VAT). Companies that meet the eligibility criteria and successfully pass the application process will be offered access to the partially funded Secure Innovation Security Review.

To be accepted onto the scheme, your application must demonstrate that you are both able and willing to dedicate resources, including where necessary financial resources, to effectively implement your protective security strategy.

Your KEYSIGMA consultant will guide you through the formal application process.

Step 2 - Onboarding

Following approval of your application you will need to:

Formally appoint KEYSIGMA as your security reviewer.
Agree to the scheme’s terms and conditions.
Agree to KEYSIGMA’s terms and conditions.
Pay the £500 contribution towards the assessment.
Arrange the site visit with your Security Reviewer.

Site visits must be scheduled within 6 weeks of being accepted onto the scheme.

Step 3 - Preparatory Work

Before the site visit takes place, you will be asked to complete the following preparatory steps: 1. Appoint Security Leadership – designate a responsible individual to oversee the organisations engagement with the Security Review process. 2. Identify Critical Assets – clearly define the assets that are most vital to your organisation’s operations, reputation and intellectual property. 3. Integrate Security Risks into Your Corporate Risk Register – ensure that relevant security threats are formally recorded and considered within the organisations broader risk management framework. 4. Complete the Foundation layer of the NCSC’s My Cyber Toolkit – this contains the most urgent actions to protect businesses from common cyber threats (specific instructions are provided for any actions not already in place). (N.B. This is a Beta service). Cyber Essentials Voucher To encourage participating organisations to progress towards achieving Cyber Essentials certification after their review has been completed, a £300 voucher code towards Cyber Essentials will be provided to each organisation. This funding also comes from the same HMG Fund. The voucher will be sent by Business West within your offer email. Whilst not mandatory, KEYSIGMA strongly recommends attempting your Cyber Essentials assessment as part of the preparatory phase, as this will allow the KEYSIGMA Security Reviewer to provide tailored advice to the non compliances that your organisation has against the standard as part of the Security Review.

Step 4 - Security Health-Check

The KEYSIGMA security reviewer will visit your site to review your security arrangements against the Secure Innovation framework. The KEYSIGMA reviewer will use the health check questionnaire to support the engagement and will which covers the following themes:

Protective Security Governance.
Security Culture.
Risk Management.
Cyber Security.
Secure Supply Chain and Partnerships.
Incident Management

It is important to note, that the KEYSIGMA security reviewers delivering the scheme are not be experts in all of these areas and have much more expertise in guidance and implementation of controls relating to Cyber Essentials. The KESYIGMA reviewer will provide guidance on their areas of expertise and will provide guidance aligned with resources from the NPSA and the NCSC for areas outside of our core competencies.

Step 5 - Reporting

Following the site visit, the KEYSIGMA Security Reviewer will compile a written report that serves as a tailored action plan for your organisation. This report will:

Summarise the findings from the protective security health check.
Highlight key areas for improvement.
Provide practical recommendations. Where appropriate, the report will signpost NPSA and NCSC resources to support you in addressing the identified risks.

Before your chosen Security Reviewer submits the report, it must be signed by you to confirm you are satisfied with its contents. Alternatively, written confirmation of approval via email must be provided as evidence. Copies of the completed reports will be shared with Business West, Innovate UK, NPSA, the NCSC and the DBT and DSIT project teams for monitoring and evaluation purposes. NPSA and the NCSC may dip check a selection of these reports for consistency and quality monitoring.

Step 6 - Follow-up Call

Follow up Call
Six months after the initial site visit, the KEYSIGMA Security Reviewer will conduct a follow-up call with you to assess progress and identify any ongoing or emerging challenges. During this call, the KEYSIGMA Security Reviewer will complete a second Health Check Questionnaire and produce a 6-Month Follow-Up Report summarising the discussion and any developments since the initial review.

This follow-up is a key component of the overall evaluation of the Secure Innovation Security Reviews scheme. It not only helps measure the impact of the review process but also provides you with a clear understanding of remaining gaps and areas for continued improvement.

Satisfaction Surveys

Following both the site visit and the six-month check-in, you will be contacted to provide feedback on your experience of the Secure Innovation Security Review Scheme. This feedback is a vital part of the programme. By completing the feedback process, you will help us evaluate the scheme’s effectiveness, identify areas for improvement, and assess behavioural change over time.

Step 1 - Application

Apply Now to secure your place