We already have a web developer/hosting provider. Do we still need this?
Yes. Your developer builds your site and your host keeps it online. Neither is responsible for incident response planning, tested backup restoration, or what happens when a breach exposes customer data. We focus on the security gap between “the site is live” and “we know what to do when something goes wrong.”
We use Shopify — isn’t that already secure?
Shopify handles infrastructure security on their end. But your account security, your staff access controls, your third-party app integrations, and your response when something goes wrong are all your responsibility. The Assessment covers all of these.
How do you help with PCI DSS compliance?
The Assessment reviews your payment data handling practices and identifies gaps in your PCI DSS posture. We don’t provide PCI certification, but we ensure your incident response plan covers payment data breach scenarios and that your team knows the specific obligations around payment card compromise.
What should we do before peak season specifically?
We recommend completing an Assessment at least 6 weeks before your peak trading period. This gives you time to act on the findings, test your backup restoration process, and brief your team on the Incident Response Playbook. Several of our e-commerce clients run a pre-peak workshop annually.
We had the M&S and Co-op attacks on our mind. Is this the right response?
Those attacks are exactly the kind of incident CyberReady prepares you for. The attackers used supplier credentials, deployed ransomware during a critical trading period, and exploited gaps in incident response preparedness. The Assessment, Workshop, and Playbook address all of these vectors.
