Cyber Essentials Certification

What Cyber Essentials covers

Five technical control areas that between them stop the overwhelming majority of commodity attacks: firewalls, secure configuration, security update management, user access control, and malware protection. It is deliberately a baseline rather than a comprehensive standard — the point is that it addresses the attacks that actually happen to ordinary organisations.

Why organisations get certified

• Contracts. Central government contracts involving personal data or technical services require it. Increasingly, so do local authorities, NHS trusts, universities and large private-sector buyers pushing requirements down their supply chain.
• Insurance. Many cyber insurance policies price on it, and some UK insurers include automatic cover for small organisations that hold it.
• Client assurance. A certificate answers a security questionnaire far more efficiently than forty pages of prose.
• It genuinely helps. Even setting the certificate aside, the five controls are the right five things for a small organisation to get right first.

How we work

Plenty of providers will sell you the assessment and leave you to complete it. That works if you already meet the controls. If you do not, you fail, and you find out after you have paid.

Gap review first

We go through the question set with you and identify honestly where you currently stand. Most organisations have three or four genuine gaps — commonly unsupported software still in use, multi-factor authentication missing on cloud services, local administrator rights on user accounts, and mobile devices outside any management.

Remediation you can actually do

Specific, practical guidance for your environment rather than a restatement of the requirement. If you run Microsoft 365 and Intune, we will tell you which settings to change. If your IT is outsourced, we will write the instructions in a form your provider can action without a further round of translation.

Submission and certification

We help you complete the assessment accurately, review your answers before submission, and support any clarifications. Because we are a certified assessor, we know what marking actually looks for — which is not always what the question appears to ask.

Scoping honestly

Scope is where most difficulty arises. Certification can cover the whole organisation or a defined subset, and the temptation is to draw a boundary that excludes the awkward parts. Be careful: a scope that excludes most of your estate produces a certificate that a sophisticated buyer will read and discount, and it may not satisfy the contract you are certifying for in the first place. We will tell you if we think a proposed scope will not stand up.

What comes after

Certification lasts twelve months and the question set is revised periodically, so what passed last year may not pass this year. Cyber Essentials Plus adds hands-on technical verification by a licensed Plus certification body — we do not carry out the Plus audit ourselves, but we prepare you for it. IASME Cyber Assurance is the natural next step for organisations needing something broader.

Common questions