Cyber Essentials Manchester

What certification involves

The five controls are firewalls, secure configuration, security update management, user access control and malware protection. The 2026 rules are stricter, with multi-factor authentication mandatory on cloud services and critical patches applied within 14 days, so the work is usually getting those in order before you submit. You’re guided by a Certification Body that tells you plainly what to change, then certifies you. Most Manchester organisations with reasonable controls certify in days rather than weeks. When you’re ready for the audited level, we support Cyber Essentials Plus too.

Remote, and fast

We are a Shropshire consultancy working with Manchester businesses remotely, which is how almost all of this work is done. Assessment, evidence review and the questions that come up are all handled remotely with no loss of quality, and you deal directly with the assessor throughout. You deal directly with the assessor, not a call centre. If you’re against a client or tender deadline, tell us and we’ll be straight about what’s achievable.

How a remote assessment works, and what we do not pretend about distance

We are a small consultancy based in Albrighton in Shropshire, which is a long way from Manchester, and we are not going to describe that as local. Cyber Essentials is a verified self assessment: the work is answering a question set accurately about your organisation and having an assessor review it, and none of that needs anybody in your building. Remote is how this is normally delivered, for clients ten miles away and a hundred and ten, and it works the same either way.

On-site is therefore not the normal arrangement at this distance, and we would rather say so plainly. You deal with the assessor directly, by call and by email, which is what matters when you are working out whether a particular tool is in scope. At the audited Plus level there are hands-on checks on a sample of devices, and where those need to happen in person it is agreed and planned in advance.

Where the scope really sits in a cloud-first business

A Manchester digital, software or media business often has almost no physical estate: laptops, a couple of managed cloud tenancies and a long list of services somebody signed up for. On paper that should certify quickly, and it usually does, on one condition. Every cloud service has to be genuinely behind your identity provider. In our experience that is commonly not the case, and finding out which ones are missing is the most useful thing you can do before submitting.

The scoping questions that catch people out are almost always these:

The long tail of SaaS. Cloud services are in scope, and multi-factor authentication on them is mandatory under the current requirements. The problem is never the tools IT bought. It is the analytics, design and scheduling tools a team put on a company card and never enrolled into single sign-on. Build the list from the identity provider's application list and the card statements together, because neither alone is complete.
Personal devices. A personally owned laptop or phone used to read work email or reach organisational data is in scope, and its owner is a user. This is the answer people least want, and the one most likely to turn into a conversation about issuing company hardware instead.
Home workers. The broadband router the internet provider left in somebody's hallway is not what gets assessed. The device is, and its own firewall is what has to be configured and switched on.
Contractors and freelancers. Settle whose device they use and whose policies they work under before you submit, not after. A freelancer on your accounts, using a machine you know nothing about, is the case to think hardest about.
Whole organisation. The default scope covers everything, including the subsidiary and the second trading name. A narrower scope is permitted, but it is printed on the certificate the enterprise customer asked to read.

There is a related problem in fast-growing companies that has nothing to do with technology. Starters arrive faster than the joiner process can keep up with, so accounts get created ad hoc, admin rights get handed out to unblock somebody on a Thursday afternoon, and nothing gets taken back. User access control asks you to describe how access is approved, granted and removed, and to mean it. The honest test is whether you can list today who holds administrative access to each cloud service, and why.

What changes at renewal, and what Plus asks of you

The certificate lasts twelve months, so this is an annual commitment. The second year is usually much easier, because the scope, the controls and the answers all exist. Renewal becomes a difference exercise: what did we buy, who joined, who left, what got connected, and what tightened in the requirements. Companies scaling quickly benefit most from keeping that document current through the year rather than rebuilding it every twelve months.

Cyber Essentials and Cyber Essentials Plus, in terms of what you have to do
	Cyber Essentials	Cyber Essentials Plus
What it is	Self assessment, verified by an assessor	Audited, with hands-on checks
Your main effort	Getting controls in place and answering accurately	That, plus making devices and people available
Device list	Has to be accurate	Accurate, and checked against a sample
Order	Stands alone	Follows the basic certificate, does not replace it

If a customer or investor keeps escalating what they want to see, the level above Cyber Essentials is IASME Cyber Assurance, and we are licensed for Levels 1 and 2. That is a different question from penetration testing, which asks whether a specific system can be broken into rather than whether a baseline of controls exists. More on certification is on our Cyber Essentials page.

Ready to buy?

Transparent, fixed pricing based on your organisation size. By default we give you access to the IASME portal to complete your Cyber Essentials assessment yourself, and once you submit it we aim to assess within one business day. You can preview the Cyber Essentials self-assessment questions to see where you stand first. There is no call or consultation as standard; we simply send you the questionnaire to complete. Your submission is reviewed by a qualified, certified assessor, never fed into AI. Need it faster? Add urgent turnaround below. Want us to review your setup against the controls before you apply? That is a gap analysis, quoted separately: ask for one using the contact button under the form.

An appointed IASME Certification Body: your certificate comes directly from us. Verify our credentials on the BlockMark registry, and find us listed on the IASME website.

Business name

Business size

Telephone

Optional add-on

Tick it if you need it.

Urgent turnaroundMoved to the front of the queue and assessed same day where your submission arrives before midday. +£100

Total: select your size + VAT

Want a gap analysis, a different way to pay, or a question answered first?

Gap analysis. We review your setup against the controls you will be assessed on before you apply and tell you exactly what needs fixing, so nothing is a surprise when you submit. It is quoted against your setup rather than sold as a fixed add-on, so ask us and we will price it.

Anything else. Paying by card here is the quickest route, not the only one. Tell us how you would rather pay and we will sort it. Same if you want a question answered before you buy, or a quote for on-site Cyber Essentials or IASME Cyber Assurance Level 1.

Common questions

Do Manchester businesses really need Cyber Essentials?

If a client, insurer or tender has asked for it, effectively yes, because not holding it usually means losing the work. Even where it’s optional, it blocks the most common attacks and reassures the people you do business with.

How quickly can we get certified?

Often within days if your controls are already in reasonable shape; if not, we tell you exactly what to fix first. For a hard deadline, see our urgent certification support.

Do you come to us in Manchester?

Not normally. We are based in Shropshire, so Manchester is not a short trip, and Cyber Essentials does not need one. The assessment runs remotely. If your situation genuinely needs somebody on site, ask and we will quote the travel honestly rather than absorb it. Much of the work is done remotely with no loss of quality.

Our developers and designers use their own laptops. Are those in scope?

If a personally owned device is used to access organisational data or services, it is in scope and the person using it is a user. That means it needs the same treatment as company hardware: supported operating system, security updates applied within the required window, a configured firewall and no shared account. In practice this is the point at which a lot of fast-growing companies decide it is simpler to issue managed laptops than to bring personal machines up to standard and keep them there.

We use a lot of SaaS and only some of it is behind single sign-on. Does that matter?

It matters more than anything else on a cloud-first certification. All cloud services in use are in scope, and multi-factor authentication on them is mandatory under the current requirements, so a tool that a team bought on a card and never enrolled is a gap whether or not anyone remembers it exists. Build the list from your identity provider and your card statements together before you start answering the question set.

Do contractors and freelancers count as users?

It depends on whose device they use and whose policies they work under, which is exactly why it is worth settling in the scoping conversation rather than mid assessment. A freelancer using your systems on a machine you have no visibility of is the case that needs a decision, and the decision needs writing down. We would rather have that conversation before submission than have it surface as a question afterwards.

We are hiring quickly. What does that do to our chances of passing?

It does not stop you certifying, but it does mean the user access control answers need to reflect a process that actually runs rather than one that existed when the company was ten people. The two things that go wrong are accounts created outside any joiner process and administrative rights granted temporarily and never removed. If you can list who holds admin on each cloud service and why, you are in good shape.

Is the second year easier than the first?

Usually a lot easier. The first year is mostly discovery and remediation, and once the scope, the device list and the controls are documented, renewal becomes a matter of tracking what changed: new services, new starters and leavers, new hardware, and any tightening in the requirements. The certificate runs for twelve months, so it is worth keeping that documentation current through the year rather than rebuilding it each time.

Cyber Essentials for Manchester organisations

Manchester is the largest digital, software and professional services concentration outside London, alongside substantial manufacturing and logistics. In practice we mostly meet cloud-first with small physical footprints, which should be fast, except that developer and designer machines are routinely excluded from the managed estate. The requirement usually arrives via enterprise client security questionnaires, and investor or acquirer due diligence.

That shapes how a Manchester certification should be sequenced. Where the estate is unmanaged or mixed, the gap analysis is worth more than the urgent turnaround, because the delay will come from remediation rather than from assessment. Where it is already managed and documented, go straight to the questionnaire. Manchester engagements usually run remotely, with an on-site day only where the estate needs it.

We are an appointed IASME Certification Body, so the assessment and the certificate both come from us. Assessment is within one business day of submission as standard, or the same day with the urgent option where you submit before midday. See how fast Cyber Essentials really is if you are working to a date.