Most MSPs sell you a helpdesk.
Root.12 delivers a security framework.
Four tiers. One framework. One guarantee: you pass Cyber Essentials first time, or we fix it and resubmit. Free.
We Guarantee You Will Pass.
CE or CE+. First time.
No other managed IT support provider in London makes this guarantee. We do - because we own the outcome from audit to remediation to submission. If you do not pass, we fix it and resubmit at no additional cost.
Four Steps to Managed IT Security
You Can Actually Prove
A structured process from day one - so you always know where you stand, with evidence to back it up.
30 minutes. We talk through your business, your current setup, and what you are trying to achieve. No jargon, no pressure. We tell you honestly whether Root.12 is the right fit.
We assess your technology estate across all 12 Root.12 areas. On-site where needed. You get a plain-English report showing exactly where you stand and where the gaps are.
Based on the audit findings, we recommend the right package for your business. We show you the gaps, the remediation priorities, and what the ongoing service looks like.
Your managed IT and security service goes live, remediation begins, and you are on the path to CE or CE+ certification from day one.
Four tiers. One framework. One outcome you can prove.
All four tiers run on the 12-area Root.12 framework. The difference is the depth of certification and governance evidence you need. Not sure which fits? The discovery call is where we work that out.
Launch
Where Root.12 starts.Your first rung on the 12-area Root.12 framework. A hardened Microsoft 365 tenant, 24/7 detection, and the Root.12 snapshot underneath. The right tier when you're a 2 to 7 person scaling start-up that wants to do this properly from day one. Built for founders who know “we'll sort security later” is the wrong answer.
- Root.12 Snapshot (annual)
- 24/7 Managed Detection and Response
- Microsoft 365 hardening and email backup
- Reactive support, Mon-Fri
- CE-aligned (foundation for future certification)
Available to funded scaling start-ups only. We confirm eligibility on the discovery call.
Foundations
The only Cyber Essentials guarantee in London.No other MSP in London puts CE in a contract. Root.12 Foundations gives you Cyber Essentials guaranteed, a proactive service desk, and security monitoring on the 12-area framework. The right tier when an insurer or a client has asked the question once, and you don't want to be asked twice.
- Root.12 12-area audit
- Unlimited proactive service desk
- Security monitoring & patch management
- Quarterly technology roadmap
- CE certification - guaranteed
Certified
CE+ on the wall. The evidence on the shelf.The only CE+ guarantee in London, with the paperwork to prove it. Root.12 Certified means CE+ guaranteed and a documented evidence pack mapped to the 12 areas, ready for the next insurer renewal or client DDQ. The right tier when you're being asked the question routinely.
- Everything in Foundations
- CE+ certification - guaranteed
- Documented control evidence pack
- Insurer and client DDQ ready
- Ongoing evidence maintenance
Governed
Root.12 as your second line of defence.For firms under FCA, DORA, SRA or investor scrutiny. Root.12 Governed gives you a full policy library, a live risk register, and a control framework mapped to CAF 4.0, FCA SYSC, DORA, SRA, DDQ/ODD, and ISO 27001. The right tier when “are you secure?” lives in a board pack, not a sales objection.
- Everything in Certified
- Full policy library & risk register
- CAF 4.0 aligned control framework
- Maps to FCA SYSC, DORA, SRA, DDQ/ODD
- ISO 27001 technical readiness
- Extended hours support
The foundation of all four packages. Same 12-area audit. Same proactive service. Same methodology. The certification level above it is what differs.
Find out which package fits - book a discovery call
30 minutes. No obligation. We’ll tell you which package we’d recommend and why.
What every managed package delivers.
From Foundations up, every Root.12 package runs on the same spine. What changes between tiers is how deep each area goes, and the certification and governance evidence that sits on top. Launch is a lighter, by-application on-ramp.
Your Microsoft 365 tenant hardened to the Root.12 baseline, monitored for drift, fixed when controls slip.
Unlimited support, response SLAs in writing, on-site when it is faster. No ticket caps.
Real eyes on your alerts around the clock. Identity, endpoint, tenant. Contained before it spreads.
Every endpoint patched, evidenced and signed off. The audit trail builds itself. Vulnerability scanning layers in from Certified.
A scheduled roadmap review. Twice a year on Foundations, quarterly from Certified. You always know what is next and what is at risk.
Every control and change logged against the 12 Root.12 areas. The folder you hand over when asked.
Root.12 vs Standard Managed IT Support
Most MSPs give you a helpdesk. Root.12 gives you a helpdesk plus a security framework, plus certification, plus documented evidence. Here is what that difference looks like.
| What you need | Standard MSP | Root.12 |
|---|---|---|
| Proactive service desk | ✓ | ✓ |
| Security monitoring | Basic | Full |
| Cyber Essentials certification | Usually extra | Guaranteed |
| CE+ with documented evidence | Rarely offered | Certified & above |
| Evidence pack for insurers/clients | ✗ | Included |
| Regulatory compliance mapping (FCA, DORA, SRA) | ✗ | Governed only |
| Outcome guaranteed in contract | ✗ | Yes |
| 12-area technology framework | ✗ | Root.12 |
Not a One-Time Assessment.
Proactive Control, All Year.
Most businesses get a CE assessment done once a year and hope nothing changes. Root.12 works differently. We continuously monitor and maintain your controls so that you could pass CE or CE+ at any point during the year - not just on the day you submit.
Get certified once. Hope your controls hold. Scramble when the renewal comes around. Find gaps. Fix them under pressure. Submit and hope.
Continuously monitored across your Microsoft 365 environment and wider estate. Controls maintained and documented throughout the year. When a client asks for your evidence pack or an insurer asks at renewal - it’s already done.
30 minutes. We assess where you sit across the 12 Root.12 areas and recommend the right package.
Fixed-price proposal within 48 hours. No surprises. If it does not work for you, we part as friends.
Your managed IT service goes live immediately. The full 12-area audit runs in parallel - approximately 10 working days.
Controls are maintained continuously. Quarterly roadmap reviews. Annual audit refresh. You could pass CE or CE+ any day of the year - not just at renewal.
Why Root.12 Costs What It Costs
Root.12 is not cheap IT support. It is structured, managed, evidence-based IT and security delivered as a single outcome-guaranteed service. Here is what you are paying for.
We guarantee CE or CE+ certification first time. That means we absorb the risk. The price reflects that we own the outcome, not just the effort.
You are not paying for a one-time audit. Root.12 continuously monitors, patches, documents, and updates your controls so your evidence is always current.
Most IT support covers your helpdesk and patches. Root.12 manages 12 defined areas of your technology estate. That breadth of coverage is reflected in the price.
Root.12 has a minimum contract value of £750/month. This reflects the resource required to deliver the framework properly. If that is not the right fit right now, we will tell you.
See the full Root.12 methodology - explore the framework behind every package.
At Support Tree, we’re proud to deliver secure, dependable, and proactive IT services to London’s leading businesses.
These verified Google Reviews reflect the trust our clients place in us to keep their systems running smoothly, their data protected, and their teams productive.
Who Root.12 Is Not For
We would rather tell you this now than waste your time on a call.
Businesses who just want cheap IT support.
Root.12 is not the cheapest option. If your primary criterion is lowest monthly cost, we are not the right fit.
Businesses who do not care about compliance.
If GDPR, client DDQs, cyber insurance, or regulatory obligations are not on your radar - Root.12 is not for you.
Businesses who cannot commit to the minimum spend.
Our minimum contract is £750/month. If that is not viable right now, Root.12 is not the right fit yet.
Businesses who want IT support without a framework.
Root.12 is structured and methodical. If you prefer an ad-hoc relationship, that is fine - but it is not what we do.
Everything you need to know before booking a discovery call.
The discovery call is where we work that out together. As a starting point: Launch is for funded scaling start-ups of 2 to 7 people who want to do this properly from day one. Foundations is for businesses that need Cyber Essentials in place. Certified is for businesses that need CE+ and the paper trail to prove it. Governed is for firms under FCA, DORA, SRA or investor scrutiny who need full policy and control mapping.
It is real. No other MSP in London puts CE or CE+ in a contract. We do. We only submit when your controls are ready. If something prevents certification after submission, we fix it and resubmit at no additional cost. The guarantee runs under Foundations, Certified, and Governed.
Yes. You can move from Foundations to Certified, or Certified to Governed, at any renewal point. We reassess your controls and update your certification accordingly. Most clients start on Foundations and move to Certified within 12 months as their compliance requirements grow.
Root.12 is built for UK businesses in compliance-sensitive sectors. Financial services, legal, accountancy, professional services. Typically 10 to 150 users. If your clients, insurers, or regulators are asking questions about your cybersecurity posture and risk management processes, Root.12 is built for your sector.
Probably not, and we will tell you that on the discovery call. Root.12 is an ongoing managed framework, not a one-time audit you file away. If you need a quick Cyber Essentials pass and want to move on, there are faster and cheaper ways to do that. Root.12 is for businesses that want to own their security posture, maintain the evidence, and improve year on year. If that sounds like more than you need right now, we would rather say so upfront than sign a contract that does not suit you.
Most MSPs sell you a helpdesk. Root.12 delivers a security framework. You get the helpdesk too, but it runs on top of a 12-area assessment, continuous control monitoring, documented evidence, and a certification guarantee. The outcome is in your contract. With most managed service providers, security is an add-on. With Root.12, security is the framework.
Ready to See Which Package Fits Your Business?
Book a 30-minute discovery call. We will show you exactly where your IT estate sits across the 12 Root.12 areas – and tell you honestly which package we would recommend and what it will cost.
Want to understand the framework first? See the full Root.12 framework.