Stop turning down UK defence work.
Productise Cyber Essentials Plus and DCPP.
Stella turns Microsoft 365 into your UK compliance service line. Same operations layer that runs CMMC L2 in the US, with jurisdiction-aware modules for Cyber Essentials Plus, DCPP, UK GDPR, NIS, and DSPT shipping in cohorts through 2026–27. Built for 5–30 tenant UK MSPs without a dedicated security person.
UK compliance is more demanding than US — but the tools UK MSPs have are worse.
Built by an MSP operator. The four problems we kept hitting — none of which a generic scanner solved.
“Same M365 settings, audited again every year. We re-screenshot, re-export policies, re-format evidence packs every renewal. The actual work is pre-pack and post-pack admin — not the assessment itself.”
“Defence primes want a supplier that ships continuous evidence. We can do the technical work but the manual evidence pipeline kills our margin. The bigger consultancies eat the contract.”
“72-hour ICO notification window and we're still reconstructing what changed in M365 the week before. By the time we've got the evidence together we're already past the deadline.”
“Every CE+ engagement is a one-off. Every DSPT renewal is bespoke. We'd love to productise it but there's no UK-aware tool that lets us.”
One operations layer. UK framework modules that snap in like Lego.
Each framework is a self-contained module: control catalogue, M365 mapping, auto-remediation engine, evidence schema, certification report templates. Add the ones your client base needs; the underlying console + agent + reports stay the same.
Triage → Remediate → Comply → Report → Sell.
Same workflow as the US build. UK framework modules slot into step 3 as they ship.
Default Microsoft 365 isn't secure. Every tenant should run at least Base Hardening.
Microsoft's shared-responsibility model puts the configuration on you. M365, Entra ID, Intune, and Azure all ship with permissive defaults across 1,800+ settings — and Microsoft Secure Score tells you about a small slice of them. Whether you're an MSP, a single-tenant business, a non-profit, or a 5-person law firm: if your data lives in Microsoft's cloud, this is the security floor.
Universal regardless of region — your tenant is judged against the same M365 defaults wherever you are.
Base Hardening costs a fraction of the average breach — and the second tenant onward is cheaper still. Contact us for pricing. There is no realistic ROI calculation in which not running this loses.
Land at Base Hardening. Upgrade when compliance bites.
Three tiers, one upgrade path. Run every tenant on Base Hardening — promote individual tenants to MSP or MSP Pro the day a regulated, defence, or government client signs. Contact us for pricing.
Run on every M365 client tenant. Land here. Upgrade when compliance bites.
Upgrade the day a defence, government, or regulated client signs.
Flagship clients, audit-imminent tenants, concierge onboarding.
Start every client on Base Hardening, promote them to MSP or MSP Pro the day a defense / government / regulated client signs. Contact us for pricing details.
UK MSP cohort · pre-launch waitlist
Join the waitlist to: (1) get the first UK module (Cyber Essentials Plus) at launch pricing, (2) influence which framework ships next, and (3) get a free M365 baseline on one client tenant today using the existing cross-jurisdictional control set.