What is ISO 9001?

ISO 9001 is a framework for how organisations plan, deliver, and continuously improve their services — with documented processes, clear accountability, and independent auditing to verify that the standard is being maintained. It isn’t a one-off achievement. Certification requires ongoing commitment and regular external review, which is the point.

What we’ve done

Achieving certification meant taking a structured look at how we deliver our services from end to end – how projects are scoped and planned, how work is carried out and reviewed, and how we handle issues when they arise. In many respects it built on how we already worked. But there is a meaningful difference between doing things consistently and having documented, auditable processes that prove it. This exercise made that distinction clear in places, and we’re better for it.

What an ISO 9001 certified IT company means for customers

The practical outcome is consistency. As an ISO 9001 certified IT company, the same documented standards apply across every engagement – whether that’s a cloud migration, cyber security certification, or ongoing managed IT support. You’re not relying on institutional knowledge that sits with one person, or hoping the right engineer picks up your call. The processes are defined, followed, and independently audited.

• Consistent delivery across every project and service
• Documented procedures that mean nothing falls through the gaps
• Clear accountability at every stage
• A quality management system that is independently maintained and reviewed

Final thought

ISO 9001 certification isn’t a destination – it’s a framework for continuous improvement. We’re proud to have achieved it, and more importantly, we’re committed to what maintaining it requires. If you’d like to know more about how Base3 works, or want to discuss a project, get in touch.

Base3 is ISO 9001:2015 certified across all services. Click here for ISO 9001:2015 certificate.

The post Base3 is ISO 9001:2015 Certified. Here’s What That Actually Means. appeared first on Base3 Solutions Ltd.

Here’s a plain-language breakdown of what each one is, what it involves, and how to know which is right for your organisation.

What is Cyber Essentials?

Cyber Essentials is a UK Government-backed certification scheme designed to help businesses protect themselves against the most common cyber threats. It focuses on five core technical controls that, when properly implemented, significantly reduce your exposure to the vast majority of internet-based attacks.

The certification is annually renewable and is recognised across the public and private sector as a credible baseline of cyber security.

Cyber Essentials is a mandatory requirement for any organisation bidding for UK Government contracts that involve handling personal data or providing certain technical products and services. If you’re looking to work with the public sector, you’ll need it. Find out more at NCSC.gov.uk.

What does it cover?

The five technical controls are:

1. Firewalls and internet gateways
2. Secure configuration
3. User access control
4. Malware protection
5. Security update management

How does it work?

Cyber Essentials is a verified self-assessment. You complete an online questionnaire answering questions about how your organisation has implemented each of the five controls. The answers are reviewed by a certification body – and if they meet the required standard, you receive your certificate.

It’s straightforward, fixed-price, and achievable for businesses of any size.

What is Cyber Essentials Plus UK?

Cyber Essentials Plus covers exactly the same five controls – but instead of a self-assessment, it includes an independent technical audit carried out by a qualified assessor. Your systems are actually tested, not just described.

This means you’re not only telling someone your controls are in place – you’re proving it.

Cyber Essentials Plus includes internal and external vulnerability scanning, on-site or remote device assessment, and malware protection testing. It’s the same framework as Cyber Essentials, but independently verified – which provides a significantly higher level of assurance to customers, partners, and supply chain stakeholders.

What does the audit involve?

A Cyber Essentials Plus assessment typically includes:

• Internal vulnerability scanning across your devices and network
• External vulnerability testing of your internet-facing systems
• Verification of user accounts and access privileges
• Testing of malware protection across endpoints
• Remote or on-site device assessment depending on your setup

Important: you must hold a valid Cyber Essentials certificate before you can achieve Cyber Essentials Plus.

What’s the difference in cost?

Cyber Essentials is fixed-price, set by IASME:

Cyber Essentials Plus is not fixed-price. The cost depends on the number of users, devices, sites, and the complexity of your network. Contact us for a tailored quote.

Which one do you need?

For most small businesses with no specific contractual requirements, Cyber Essentials provides a solid, credible baseline that demonstrates you take cyber security seriously.

Cyber Essentials Plus is worth considering if:

• You work with government departments or public sector bodies
• Your contract specifically requires it
• You handle sensitive or confidential client information
• You are part of a defence or government supply chain
• You want independently verified confirmation of your security controls

Cyber Essentials Plus is increasingly being specified as a requirement in defence supply chain contracts – particularly as the Ministry of Defence rolls out its Defence Cyber Certification (DCC) scheme. DCC Level 2 and above require Cyber Essentials Plus as a prerequisite. You can read more about DCC on our Defence Cyber Certification page.

Not sure which applies to you?

If you’re unsure which level is right for your organisation – or whether you’re ready to start the process – Base3 can help. As an approved certification body for Cyber Essentials Plus in the UK, we support businesses through the entire process, from initial readiness through to certification.

Get in touch and we’ll point you in the right direction.

The post Cyber Essentials vs Cyber Essentials Plus: What’s the Difference? appeared first on Base3 Solutions Ltd.

That’s where the 7 Rs framework comes in. Originally developed by Gartner and later adopted by AWS, the 7 Rs give you a structured way to think about how each application or workload in your environment should be handled during a migration.

1. Retire

Some applications simply don’t need to move. If a system is rarely used, no longer fit for purpose, or has been replaced by another tool, the right answer is often to decommission it entirely. Migration is a good opportunity to audit what you actually use – and cut the dead weight.

2. Retain

Not everything should move to the cloud right now. Some workloads have regulatory constraints, hardware dependencies, or simply aren’t ready. Retaining them on-premise – at least temporarily – is a legitimate strategy, not a failure. A good migration plan acknowledges this rather than forcing everything across at once.

3. Rehost

Often called “lift and shift,” rehosting means moving an application to the cloud with minimal changes. It’s fast, relatively low risk, and can deliver quick wins – particularly useful when you’re under time pressure or working to a tight budget. The trade-off is that you’re not taking full advantage of cloud-native features.

A lift and shift migration can significantly reduce infrastructure costs in the first year, simply by moving away from on-premise hardware refresh cycles to a pay-as-you-go model. However, without right-sizing your instances at the point of migration, you can end up paying for more compute capacity than you actually need. AWS Compute Optimizer can analyse your usage and recommend the right instance types before you go live.

4. Relocate

Similar to rehosting but specific to moving workloads between cloud environments – for example, migrating from one hypervisor platform to AWS without changing the operating system or application layer. It’s a fast path that preserves your existing setup while changing where it runs.

5. Repurchase

This means moving from a current application to a different product – typically replacing a legacy on-premise system with a SaaS equivalent. A common example is moving from an on-premise CRM to Salesforce, or from a local email server to Microsoft 365. It requires change management but often delivers significant long-term benefits.

6. Replatform

Sometimes called “lift, tinker, and shift,” replatforming involves making a small number of optimisations during migration without changing the core architecture. For example, moving a database to a managed cloud database service to reduce administration overhead, without rewriting the application itself. You get some of the cloud benefit without the cost of a full rebuild.

Moving a self-managed database to a service like Amazon RDS or Aurora can eliminate the majority of routine database administration work – patching, backups, failover, and replication are all handled automatically. For small and medium businesses without a dedicated DBA, this is often one of the highest-value changes in a migration, and it requires far less rearchitecting than most people expect.

7. Refactor / Re-architect

This is the most ambitious option – redesigning an application from the ground up to take full advantage of cloud-native features. It typically delivers the best long-term performance, scalability, and cost efficiency, but it requires the most time, skill, and investment. It’s the right choice when an application is genuinely strategically important and the existing architecture is holding you back.

Applications rebuilt as microservices and deployed using containers – such as via Amazon ECS or EKS – can be scaled at the individual component level rather than as a whole. This means a spike in one part of your application, such as a checkout process during a busy period, doesn’t require you to scale your entire infrastructure. Done well, this can significantly reduce both cost and response time under load.

Which Cloud Migration Strategies are right for you?

The honest answer is that most migration projects use several of them. A well-planned migration maps each workload to the most appropriate strategy – retiring what’s redundant, rehosting what’s time-sensitive, and refactoring what matters most to the business.

In our experience, the biggest risk isn’t choosing the wrong R – it’s not having a clear strategy at all. Migrations that start without a workload-by-workload plan tend to run over time, over budget, and with more disruption than necessary.

If you’re starting to think about cloud migration and aren’t sure where to begin, Base3 can help you map your environment and define a cloud migration strategy that’s practical, phased, and built around your business. Get in touch to start the conversation.

The post Cloud Migration Strategies: The 7 Rs Explained appeared first on Base3 Solutions Ltd.

AWS has a lot of partners. Not all of them are the same.

Amazon Web Services operates one of the largest partner networks in the world. Thousands of companies globally carry some form of AWS partner status – from global system integrators with tens of thousands of staff, to smaller specialist firms working with SMEs.

The AWS Partner Network (APN) has different tiers and specialisations, and the requirements to achieve and maintain them are not trivial. Partners are assessed on technical capability, certified staff, and – critically – customer outcomes. It isn’t a badge you buy. It’s a status you earn and maintain.

So what does it mean in practice for your business?

Working with an AWS Partner rather than a generalist IT provider means a few specific things:

Verified technical expertise. AWS Partners are required to maintain a minimum number of certified engineers. Those certifications aren’t easy to obtain – they require deep, demonstrable knowledge of AWS services, architecture, and best practice.

AWS currently offers over 12 specialisations within its Partner Network, covering areas including DevOps, security, data and analytics, and migration. Achieving a specialisation requires partners to demonstrate not just certified staff, but validated customer success stories reviewed by AWS – meaning the specialisation reflects real delivery experience, not just theoretical knowledge. You can explore the full AWS Partner Network and verify partner status directly at aws.amazon.com/partners.

Access to AWS resources. Partners have direct relationships with AWS, including access to technical support, architectural guidance, and in some cases, funding programmes that can offset the cost of migration or proof-of-concept work for eligible customers.

Accountability. AWS monitors partner performance and customer satisfaction. A partner that consistently delivers poor outcomes risks losing their status. That accountability doesn’t exist with an uncertified provider.

Up-to-date knowledge. AWS releases hundreds of new features and services every year. Certified partners are required to keep their knowledge current – which matters when you’re making decisions about how to architect your cloud environment.

The difference between knowing AWS and working in AWS

This is something we talk about openly at Base3. The AWS certification path is rigorous and valuable – it gives engineers a thorough grounding in how AWS services work and how they’re designed to be used together.

But certifications teach you what the services are called and what they do. Real environments teach you what trade-offs actually matter.

Many of the issues we encounter in AWS environments aren’t caused by a lack of knowledge. They’re caused by things like over-engineering, unclear ownership, and security decisions that were deferred until later and then never revisited. AWS gives you enormous flexibility and a huge number of tools – but good architecture is often about restraint. Choosing the simplest thing that works, and being clear about responsibility and security from day one.

That perspective only comes from experience. It’s what separates a partner that can pass an exam from one that can genuinely help your business make good decisions.

What to look for when choosing an AWS Partner

Not every AWS Partner will be the right fit for your business. When evaluating options, it’s worth asking:

• Do they have experience with businesses of a similar size and complexity to yours?
• Can they explain their approach in plain language, without hiding behind jargon?
• Do they take time to understand your business before recommending a solution?
• Are they transparent about cost, timeline, and risk?
• Do they have references or case studies from comparable organisations?

A good AWS Partner should feel like an extension of your team – not a vendor trying to sell you the most complex solution possible.

Base3 is an AWS Partner in the UK

As an AWS Partner in the UK, Base3 has completed the full certification path and brings real-world experience to every cloud project we work on – whether that’s a first migration, an architecture review, or ongoing cloud management.

But more than the certifications, we bring real-world experience of what works in practice for UK businesses. If you’re considering AWS and want to talk through your options without any obligation, we’d be happy to help.

The post What It Means to Work With an AWS Partner in the UK appeared first on Base3 Solutions Ltd.

That’s a problem. Because cyber threats don’t take a January break. In fact, the start of a new year is one of the most common times for businesses to discover that the security decisions they deferred throughout the previous year have quietly become serious risks.

So before you finalise your plans for 2026, it’s worth asking honestly: is your business technology actually fit for purpose – and is it secure?

Start with an honest audit

You don’t need a specialist to begin. A simple review of the following questions will tell you a lot:

• When did you last update your software, operating systems, and firmware across all devices?
• Do your staff use strong, unique passwords – and is multi-factor authentication enabled on critical systems?
• Who has access to what in your business – and is that access still appropriate?
• When did you last review your backup process, and have you ever tested a restore?
• Do you have a plan for what to do if you suffer a cyber incident?

If any of those questions made you uncomfortable, you’re not alone. Most small and medium businesses have at least one of these gaps – and often several.

Getting cyber security for small business right doesn’t have to be complicated – but it does need to be deliberate.

The threats that matter most to SMEs in 2026

Cyber criminals don’t only target large organisations. SMEs are frequently targeted precisely because they are perceived as easier to breach than larger enterprises – and because they often hold valuable data, financial information, or access to larger supply chains.

The most common threats facing UK SMEs right now are:

Phishing: deceptive emails designed to steal credentials or trick staff into transferring money or data. These have become significantly more convincing with the use of AI-generated content.

Ransomware: malicious software that encrypts your files and demands payment for their return. A single successful attack can bring a business to a standstill for days or weeks.

Credential theft: reused or weak passwords remain one of the most common entry points for attackers. Once inside one system, criminals move laterally to access others.

Supply chain attacks: attackers increasingly target smaller suppliers as a route into larger organisations. If you work with government, defence, or large enterprises, your cyber security posture affects theirs.

The UK Government’s Cyber Security Breaches Survey found that 50% of UK businesses reported a cyber attack or breach in the past 12 months. For medium-sized businesses, that figure rises significantly. Yet many of the most common attacks are preventable with basic controls – the kind covered by Cyber Essentials, the UK Government-backed certification scheme. You can read more about the survey findings at gov.uk.

What good cyber security for small business looks like

You don’t need an enterprise-grade security operation to protect your business effectively. What you do need is a clear baseline – consistent controls applied across your entire environment.

The five areas that make the biggest difference are:

Firewalls and secure configuration: ensuring your devices and networks are set up securely from the outset, not left on default settings.

Access control: making sure only the right people have access to the right systems, and that access is removed promptly when staff leave.

Malware protection: keeping endpoint protection up to date across all devices, including mobile.

Patch management: applying security updates promptly. The majority of successful attacks exploit known vulnerabilities that already have patches available.

Multi-factor authentication: adding a second layer of verification to critical accounts, making stolen passwords significantly less useful to an attacker.

These five controls form the basis of Cyber Essentials – the UK Government-backed certification that provides independent verification that your business has the fundamentals in place.

Is your IT infrastructure keeping up?

Cyber security doesn’t exist in isolation. It’s directly connected to the state of your IT infrastructure. Outdated hardware, unsupported operating systems, and poorly managed cloud environments all create vulnerabilities that attackers can exploit.

If your IT setup hasn’t had a structured review in the last 12 months, the start of a new year is the right time to do it. Not just to identify risks – but to make sure your technology is actually supporting your business rather than holding it back.

Making 2026 the year you get this right

The businesses that handle cyber incidents best aren’t necessarily the ones with the biggest budgets. They’re the ones that took the time to get the basics right – clear ownership, up to date systems, and a plan for when things go wrong.

If you’re not sure where your business stands, Base3 can help. We specialise in cyber security for small business across Cheltenham, Gloucester, Tewkesbury, Herefordshire, and the wider region.

Get in touch to start the conversation.

The post New Year, New IT Strategy: Is Your Cyber Security Fit for 2026? appeared first on Base3 Solutions Ltd.