Cyber Essentials Birmingham

What certification involves

The five controls are firewalls, secure configuration, security update management, user access control and malware protection. The 2026 rules are stricter, with multi-factor authentication mandatory on cloud services and critical patches applied within 14 days, so the work is usually getting those in order before you submit. You’re guided by a Certification Body that tells you plainly what to change, then certifies you. Most Birmingham organisations with reasonable controls certify in days rather than weeks. When you’re ready for the audited level, we support Cyber Essentials Plus too.

Local, and fast

We’re based nearby in Albrighton, so Birmingham businesses get a local team. We work remotely first, which suits most businesses, with onsite visits across the West Midlands and Shropshire available where they genuinely help. You deal directly with the assessor, not a call centre. If you’re against a client or tender deadline, tell us and we’ll be straight about what’s achievable.

From deciding to certify to holding the certificate

Cyber Essentials is a verified self assessment: you answer a set of questions covering your whole organisation, an assessor reviews the answers, and the certificate is issued if they meet the standard. The part that takes time is almost never the assessment.

Read the clause that triggered this. For a Birmingham professional, legal or financial firm it normally arrives as a client condition or a framework entry criterion, with a date attached; for a manufacturer, as a flow-down clause from a larger customer. Check whether it says Cyber Essentials or Cyber Essentials Plus, and whether it is a step towards Defence Cyber Certification, for which Cyber Essentials is a prerequisite at every level including Level 0.
Agree the scope in writing. The default is the whole organisation: every site, subsidiary, user, cloud service and device that touches organisational data. A narrower scope is allowed, but it is named on the certificate, so the customer who asked will see it.
Gap analysis, if the estate is mixed. The questions are not hard to answer. They are hard to answer honestly when nobody has a current list of what is connected, and finding that out before you submit is cheaper than during assessment.
Remediation. Almost all of the elapsed time lives here, and almost all of it is yours rather than ours.
Submit, assess, certify. Where an answer does not meet the standard you are told which one and why, and you correct it and resubmit.

The certificate lasts twelve months, so treat it as an annual commitment rather than a one-off purchase. We are an appointed IASME Certification Body and licensed for IASME Cyber Assurance Levels 1 and 2, so a later step up does not mean finding a new supplier.

The computer that is bolted to a machine

This is the scoping problem that catches out Birmingham manufacturers more than any other. A press, a CNC machine or a coordinate measuring machine arrives with its own controller PC, configured by the machine tool vendor and often running an operating system that stopped receiving security updates years ago. The vendor will not support it if you patch it, the licence is tied to that hardware, and the machine earns money every day.

Under Cyber Essentials, an unsupported operating system inside the scope is a straightforward fail. No wording makes it pass, so the decision is what to do with the device rather than how to describe it.

Options for a machinery-attached computer on an unsupported operating system
Option	What it involves	What to watch
Upgrade the controller	Ask the supplier whether a supported build exists for your model. On mainstream tooling one often does.	Cost, downtime, and lead times in months on older machines.
Replace the PC, keep the machine	Where the control software runs on a modern operating system, only the computer changes.	Interface cards and drivers, not the software, are the usual blocker.
Segregate it	Put the device behind a firewall or VLAN boundary with no route to or from the internet, outside the assessed scope.	The boundary itself gets assessed, so it has to be real and documented.
Narrow the scope	Certify a described part of the organisation rather than all of it.	It appears on the certificate. Check the clause accepts that.

Segregation is the route most workshops take, and it is a legitimate answer rather than a way round the question. What it is not is a label. If the device still picks up production schedules from the office network, it is not segregated.

What most commonly fails a first submission

Across both halves of the Birmingham estate, first submissions come apart on the same short list rather than anything exotic:

An unsupported operating system still inside the scope, on a machine controller, an old server, or a laptop kept for one piece of software.
Multi-factor authentication missing on a cloud service bought by a department rather than IT, and on the administrator account rather than ordinary users.
No answer to how critical and high severity updates get applied within fourteen days, as opposed to updates broadly getting applied eventually.
Default or shared credentials, on network equipment in the comms cupboard and on shop floor logins a whole shift uses.
Accounts belonging to people who left, which is the half of user access control nobody owns.
A site, subsidiary or trading name left out because including it looked like work.

None of these take long to fix in isolation. They take time to find, which is the argument for a gap analysis where the estate is unmanaged and for going straight to the question set where it is documented. See Cyber Essentials for the wider picture, or penetration testing if a customer has asked for that too.

Ready to buy?

Transparent, fixed pricing based on your organisation size. By default we give you access to the IASME portal to complete your Cyber Essentials assessment yourself, and once you submit it we aim to assess within one business day. You can preview the Cyber Essentials self-assessment questions to see where you stand first. There is no call or consultation as standard; we simply send you the questionnaire to complete. Your submission is reviewed by a qualified, certified assessor, never fed into AI. Need it faster? Add urgent turnaround below. Want us to review your setup against the controls before you apply? That is a gap analysis, quoted separately: ask for one using the contact button under the form.

An appointed IASME Certification Body: your certificate comes directly from us. Verify our credentials on the BlockMark registry, and find us listed on the IASME website.

Business name

Business size

Telephone

Optional add-on

Tick it if you need it.

Urgent turnaroundMoved to the front of the queue and assessed same day where your submission arrives before midday. +£100

Total: select your size + VAT

Want a gap analysis, a different way to pay, or a question answered first?

Gap analysis. We review your setup against the controls you will be assessed on before you apply and tell you exactly what needs fixing, so nothing is a surprise when you submit. It is quoted against your setup rather than sold as a fixed add-on, so ask us and we will price it.

Anything else. Paying by card here is the quickest route, not the only one. Tell us how you would rather pay and we will sort it. Same if you want a question answered before you buy, or a quote for on-site Cyber Essentials or IASME Cyber Assurance Level 1.

Common questions

Do Birmingham businesses really need Cyber Essentials?

If a client, insurer or tender has asked for it, effectively yes, because not holding it usually means losing the work. Even where it’s optional, it blocks the most common attacks and reassures the people you do business with.

How quickly can we get certified?

Often within days if your controls are already in reasonable shape; if not, we tell you exactly what to fix first. For a hard deadline, see our urgent certification support.

Do you come to us in Birmingham?

We work remotely first, which suits most of this work, and can arrange onsite visits where they genuinely help. Much of the work is done remotely with no loss of quality, so certification is quick either way.

One of our machines runs an operating system that is no longer supported. Can we still certify?

Yes, but not by leaving it as it is inside the scope, because an unsupported operating system in scope is a fail. The realistic options are an upgraded controller from the machine supplier, a replacement PC where the control software allows it, or genuine segregation behind a firewall or VLAN boundary so the device sits outside the assessed scope. Segregation has to be real rather than described, so we look at how job files and remote access actually reach the machine before we agree it counts.

Our customer has asked for Cyber Essentials Plus rather than Cyber Essentials. What is the difference to us?

Cyber Essentials is a self assessment that we verify, so the work you do is getting the controls in order and answering the question set accurately. Plus is the audited level, which adds hands-on checks on a sample of your devices, so you also need an accurate device list, the machines themselves available and somebody able to sit with the assessor. Plus follows the basic certificate rather than replacing it, which is why it is worth reading the clause carefully at the start rather than after you have certified.

We have a second site and a small subsidiary. Do they have to be included?

The default is whole organisation, which means every site, subsidiary, user, device and cloud service. You can certify a narrower scope instead, but the scope is written on the certificate, so the customer who asked for it will see what was left out. For a flow-down clause from a larger manufacturer, a whole organisation certificate is usually what is expected.

Does Cyber Essentials help us with Defence Cyber Certification?

It is a prerequisite for it, at every level including Level 0, so it is the first step rather than an alternative route. If a defence customer has mentioned Defence Cyber Certification in the same conversation as Cyber Essentials, plan for both from the start rather than treating them as separate projects.

How long does the certificate last, and what happens after that?

Twelve months, so it is an annual commitment rather than a one-off. The second year is usually easier because the scope is already written down and the controls already exist, and the work becomes checking what has changed: new starters and leavers, new cloud services, new hardware, and any tightening of the requirements since you last answered them.

Cyber Essentials for Birmingham organisations

Birmingham is a city centre dominated by professional, legal and financial services sitting on top of a metals, castings and component manufacturing base spread across the wider conurbation. In practice we mostly meet two very different estate types in the same postcode area: laptop-and-cloud professional firms, and workshops where the most important computer is bolted to a machine. The requirement usually arrives via a client or framework requirement, for the professional firms, and a flow-down clause from a larger customer for the manufacturers.

That shapes how a Birmingham certification should be sequenced. Where the estate is unmanaged or mixed, the gap analysis is worth more than the urgent turnaround, because the delay will come from remediation rather than from assessment. Where it is already managed and documented, go straight to the questionnaire. Birmingham is forty minutes from our office, so on-site work here is routine rather than a special arrangement.

We are an appointed IASME Certification Body, so the assessment and the certificate both come from us. Assessment is within one business day of submission as standard, or the same day with the urgent option where you submit before midday. See how fast Cyber Essentials really is if you are working to a date.