Cyber Essentials CertificationCyber Essentials, done properly, in weeks not months.
Cyber Essentials is the UK government-backed standard that insurers, public-sector buyers and larger customers increasingly ask for. The questionnaire is not hard; being able to answer it honestly is. We fix the settings, answer the questions and get you the certificate.
Who this is for
Businesses that have been asked for Cyber Essentials by a customer, a tender, an insurer or a regulator, and businesses that simply want a recognised baseline. Charities, healthcare providers, professional services firms and anyone in a public-sector or defence supply chain are the usual candidates.
What is included
Gap check to certificate. Two to six weeks.
How long it takes depends on step two. Everything else is paperwork we have done many times.
1. Gap check
Week 1
Devices, accounts, firewall and Microsoft 365 or Google Workspace against the five controls. You get a list of what would fail today.
2. The fixes
Weeks 1 to 4
MFA, patching, encryption, admin accounts separated, firewall rules, unsupported software gone. Managed IT clients mostly skip this.
Where most fail: unsupported software, admin accounts used for everyday work, missing MFA, home devices in scope
3. Questionnaire
About a week
The self-assessment completed with you, in language the assessor accepts, submitted through an IASME-licensed certification body.
4. Certificate
Weeks 2 to 6 overall
Certificate, scope statement and a short summary for insurers and tenders.
5. Renewal
Every 12 months
Diarised, controls re-checked, resubmitted, so it never lapses in the middle of a tender.
Five controls. Pass all five.
Cyber Essentials tests the same five things for every business, whatever its size. This is what each one asks and what we put in place.
1 of 5
Firewalls
The assessor asks
Is every device and the office boundary behind a firewall with the defaults changed?
We put in place
Router and Windows firewall rules checked, admin passwords changed, nothing open to the internet that need not be.
2 of 5
Secure configuration
The assessor asks
Are unused accounts, software and features removed, and are devices locked when idle?
We put in place
Intune baselines: auto-lock, no guest accounts, bloatware gone, Bluetooth and autorun off where not needed.
3 of 5
User access control
The assessor asks
Does everyone have only the access they need, with MFA on every cloud account?
We put in place
Separate admin accounts, MFA enforced in Entra, starters and leavers handled the same day.
4 of 5
Malware protection
The assessor asks
Is every device protected, kept current and set to block known bad software?
We put in place
Microsoft Defender on every device, managed centrally, with reports we can show the assessor.
5 of 5
Security update management
The assessor asks
Are critical and high updates installed within 14 days, and is unsupported software gone?
We put in place
RMM patching on a schedule, out-of-support software replaced or removed before you submit.
All five in place? You get the certificate.
We answer the questionnaire with you and submit it through an IASME-licensed body. Cyber Essentials Plus adds an independent audit of a sample of your devices against the same five controls. Both last twelve months.
Gap assessment
We check your devices, accounts, firewall and Microsoft 365 against the five Cyber Essentials controls and tell you exactly what would fail today.
The fixes
Multi-factor authentication, patching, device encryption, admin account separation, firewall rules, unsupported software removed. For managed IT clients most of this is already in place; for others it is the bulk of the work.
The questionnaire, answered
We complete the self-assessment with you, in language the assessor accepts, and submit it through an IASME-licensed certification body.
Cyber Essentials Plus
Where you need Plus, we arrange the independent audit, prepare the devices it will test, and sit in on the assessment.
Evidence for insurers and tenders
The certificate, the scope statement and a short summary you can attach to insurance renewals and bids.
Renewal
Certification lasts twelve months. We diarise it, re-check the controls and resubmit, so it never lapses in the middle of a tender.
What is not included, and why
- The certification body's fee. Charged at cost by the body, based on the size of the organisation, and shown on the quotation.
- Replacing unsupported equipment. If a device or piece of software has to go because it is out of support, we tell you before starting and quote replacements separately.
What it costs
A fixed price for the assessment, fixes and submission, plus the certification body's fee at cost. Cyber Essentials Plus is quoted on top, based on the number of devices to be tested. Managed IT clients usually need only the submission, at a lower fixed price. Prices are available on request: get in touch or book a call.
How it starts
- 1Free IT Health CheckA short online check that benchmarks your security and business risk and tells you where you stand.
- 2Discovery callAn engineer, not a salesperson. What you have, what is broken, what it would cost to fix, in writing.
- 3OnboardingEverything moves across on a plan, with no gap in cover and nothing lost.
Free, no sales call needed
Two free checks. Know where you stand.
Domain email check
Can someone send email pretending to be you? Is your real email landing in junk? Type your domain and find out in under a minute.
IT Health Check
A short set of questions that scores your security and business risk, and tells you what to fix first. 15 to 20 minutes on your own.
Questions people ask before signing
What is the difference between Cyber Essentials and Cyber Essentials Plus?
Cyber Essentials is a self-assessment verified by a certification body. Plus adds an independent technical audit where an assessor tests a sample of your devices and your email and browser protections. Tenders and some insurers specify Plus; most only require the basic level.
How long does it take?
Two to six weeks, depending on how much needs fixing first. Managed IT clients are usually at the short end because the controls are already in place.
Does it cover working from home?
Yes, and that is where most businesses fail. Any device that accesses company data is in scope, including personal laptops and phones. We either bring them under management or design the scope so they are excluded properly.
Will it satisfy our cyber insurer?
Most UK cyber insurers now either require Cyber Essentials or discount for it. Certifying the whole organisation also includes free cyber liability insurance for eligible smaller organisations, subject to the scheme's current terms.
We failed last time. Can you help?
Yes. The usual causes are unsupported software, admin accounts used for everyday work, missing MFA and devices that were never updated. All are fixable within the fortnight; we look at the failure report and tell you exactly what happened.
Is it the same as being secure?
No. It is a baseline that stops the common, untargeted attacks, which is most of them. Security monitoring on our cyber security page, up to the Barracuda 24/7 SOC, is the next layer, for businesses whose data is worth a targeted attempt.