inology.support

What It Is

Secure State is an IT security framework designed by Inology for small businesses in the UK. It is embedded into Inology’s managed IT services rather than sold as a standalone scanning tool or one-off audit. It classifies a company’s status as Met/Compliant or Not Met/Not Compliant, with a review every 90 days. Its goal is not “tick-box compliance,” but to bring security, IT investment, growth support, and regulatory obligations into continuous management.

Core Areas

The framework covers four areas: Cyber Security, IT Strategy, Growth Readiness, and Compliance. On the security side, it includes device security, access control, threat detection, and incident preparedness. On the compliance side, it addresses UK GDPR, ICO obligations, audit readiness, and policy documentation. It references CIS Controls v8 and the CIS Microsoft 365 Benchmark, with particular emphasis on Microsoft 365 configuration risks commonly faced by small businesses. In terms of management, the Inology team reviews the framework together with the client; any gaps are added to a 90-day IT roadmap and turned into policies, control checklists, and evidence packs.

Pricing and Certification

The main content does not disclose pricing. Secure State is described as a built-in standard across all Inology managed IT engagements, not something purchased separately or booked as a one-off service. Gap remediation is included in normal service delivery, and the text states there are no separate projects or additional costs. It is important to note that Secure State is not Cyber Essentials, ISO 27001, or a government/third-party certification. Although the page displays badges such as ISO 9001, ISO 27001, Cyber Essentials, and Microsoft Partner, it does not state that Secure State itself is equivalent to these certifications.

Pros and Cons

Its strengths are continuity and practicality: a 90-day review cycle is closer to day-to-day risk than an annual audit, and the outputs are clear, with Not Met items converted into concrete remediation plans. Its coverage is also broader than a single security check, as it includes IT strategy and growth readiness. The limitations are that it has less external recognition than formal certifications and is only available to Inology managed IT clients. Pricing is not transparent, and the page does not disclose integration capabilities such as APIs, SIEM, EDR, or alerting platforms.

Best Fit and China Access

Secure State is best suited to local UK small businesses, especially organizations with 1–50+ employees that rely on Microsoft 365 and need to demonstrate security governance to insurers or enterprise customers. For Chinese companies focused on MLPS, data export requirements, or local regulatory obligations, there is insufficient information to assess fit; local managed security services, MLPS consulting, or cloud security services would likely be more relevant. The page does not provide information on network access from China, cross-border payments, or local delivery, so china_access can only be assessed as unknown.