SME preparing for Cyber Essentials Plus
A UK SME needs documented secure configuration evidence for a Cyber Essentials Plus assessment; hardening evidence and drift-check history are provided as supporting documentation.
Server Hardening & Compliance in the UK
CyberSecurity · United Kingdom
Server hardening and compliance in the UK from 4hosting applies CIS benchmarks to every server and container we manage, checks for configuration drift on an ongoing basis, and documents the evidence you need for Cyber Essentials Plus, ISO 27001 or a customer's security questionnaire. Dedicated servers carry a published 99.99% SLA, and backups follow a 3-2-1 immutable pattern against ransomware.
- CIS benchmark hardening on servers and containers
- Ongoing configuration drift detection, not a one-off scan
- 99.99% SLA on dedicated servers
- 99.99% on dedicated serversSLA
- GDPR, DPA (Art. 28), SCC, ISO 27001 alignmentCompliance
- 3-2-1 immutable, against ransomwareBackups
- EUR, with UK VAT (20%) itemised on the invoiceBilling
01
What hardening actually covers
We apply CIS benchmarks to the operating system, web server and container runtime: disabling unused services, enforcing least-privilege access, rotating credentials and closing default configurations that ship open. This isn't a one-off checklist run before launch — we scan for configuration drift on an ongoing basis, because a server hardened at deployment can quietly drift out of that state as packages update and access gets added over time.
- CIS benchmarks applied to OS, web server and container runtime
- Least-privilege access and credential rotation
- Ongoing drift detection with OpenSCAP/Lynis-class tooling
02
Why AI makes patch SLAs matter more
Automated scanners now sweep large IP ranges for known-vulnerable, unpatched software within hours of a CVE going public, which means a patch delay that used to be low-risk now carries real exposure. We treat patching against a defined SLA rather than a best-effort queue, and pair that with automated compliance scanning so an unpatched system is flagged before an external scanner finds it.
03
Compliance alignment, stated honestly
We align infrastructure to GDPR requirements, operate under a data processing agreement (Article 28) with Standard Contractual Clauses for any transfers, and configure servers in line with ISO 27001 controls. We describe this as alignment, not certification: we don't hold formal third-party attestations, only configuration and practices consistent with recognised infrastructure security frameworks' technical requirements. This distinction matters on a customer security questionnaire, where overstating a status you don't hold is worse than stating clearly what you actually have in place.
- GDPR-aligned infrastructure and a DPA under Article 28
- ISO 27001-aligned configuration, not a claimed certification
- Evidence documentation for Cyber Essentials Plus questionnaires
04
Where the included hours go
Hardening and compliance work draws on the CyberSecurity hours included in your plan: 1–8 hours a month on VPS, 5–10 on dedicated servers depending on the plan, 10 on GPU servers, from Advanced upward on cPanel. You request a hardening review, a fresh drift check, or evidence for an upcoming assessment from the client panel, propose a deadline, and we deliver against it. Hours do not roll over into the following month, so it pays to plan larger reviews ahead of an audit rather than leaving them until the last week; anything beyond the monthly quota is still accepted, billed separately.
How we work
Request from the panel
Open a request under Services describing which servers need hardening and any compliance framework you're preparing for.
Baseline against CIS
We audit current configuration against CIS benchmarks and confirm scope and the included hours the work will use.
Harden and document
We apply the hardening changes, test that the application still functions correctly, and document every change made.
Monitor for drift
We add the server to ongoing drift detection, so a configuration change that weakens the baseline gets flagged automatically.
Use cases
SaaS vendor answering a customer security questionnaire
A SaaS company fielding an enterprise customer's security questionnaire needs to demonstrate ISO 27001-aligned server configuration without holding a formal certification.
Agency managing multiple client servers
A digital agency running several client VPS instances gets consistent CIS-benchmark hardening applied across all of them, with drift detection catching configuration changes introduced by client-side developers.
Technology stack
- CIS Benchmarks
- OpenSCAP
- Lynis
- Ansible
- SPF/DKIM/DMARC
- fail2ban
- UFW/nftables
Every subscription includes monthly DevOps, CyberSecurity and Programming hours: 1 h from the cPanel Advanced plan up, 1–8 h on VPS, 5–10 h on dedicated servers depending on the plan, and 10 h on GPU servers. Hours are requested from your client panel, don't roll over to the next month, and anything above the quota is accepted and billed separately.
Frequently asked questions
What is server hardening, in practical terms?
It's the process of reducing a server's attack surface: disabling services you don't use, enforcing least-privilege access, closing default configurations that ship insecure, and applying vendor-recommended benchmarks like CIS. The goal is fewer things an attacker can exploit even before considering application-level vulnerabilities.
Is 4hosting formally certified for ISO 27001?
No — we describe our configuration and practices as aligned to ISO 27001, not certified. If a customer questionnaire requires a formal certification, we're transparent that it's alignment, and we provide the technical evidence that supports it.
Does hardening happen once or on an ongoing basis?
Both matter: an initial hardening pass sets the baseline, but we also run ongoing configuration drift detection, because packages update and access gets added over time. Drift detection flags when a server has moved away from its hardened baseline so it can be corrected before it becomes exploitable.
Does Cyber Essentials Plus require server hardening evidence?
Cyber Essentials Plus includes a technical verification of secure configuration on in-scope systems, so documented hardening evidence — what benchmarks were applied and when — is exactly the kind of supporting material an assessor typically expects.
What SLA applies to dedicated servers?
Dedicated servers carry a published 99.99% SLA, backed by AMD Ryzen/EPYC and Intel Core/Xeon hardware with paired NVMe disks in our Frankfurt data centre. VPS and cPanel plans don't carry that specific published figure, but the same hardening benchmarks, drift detection and immutable backup practices apply across every plan type regardless of tier.
How do backups protect against ransomware specifically?
Backups follow a 3-2-1 immutable pattern: three copies, on two different media, one offsite, with immutability meaning a compromised system cannot overwrite or delete the backup copies. That immutability is what makes the backup useful against ransomware that specifically targets backup systems.
Need hardened, audit-ready infrastructure?
Tell us which compliance framework you're preparing for and we'll harden your servers using your included CyberSecurity hours.