Cyber Essentials and Cyber Essentials Plus readiness
Cyber Essentials is the UK government-backed scheme that shows your business has the basic protections against the most common cyber attacks, and many public-sector and larger clients now require it before they sign a contract. We check your setup against the requirements, fix the gaps with you and prepare the evidence, so your assessment goes smoothly the first time.
Who needs Cyber Essentials
- A client, tender or framework requires Cyber Essentials.
- You hold Cyber Essentials and need to step up to Cyber Essentials Plus.
- Your renewal is due and your setup has changed since the last one.
- You want a clear baseline of security before going further, such as ISO 27001.
The five controls we prepare you for
Firewalls
Boundary firewalls and the firewalls on each device configured so only the connections you need are allowed in.
Secure configuration
Default passwords changed, unnecessary software and accounts removed, and auto-run features switched off.
Security update management
Supported software only, with critical and high-risk updates applied within 14 days of release.
User access control
Accounts only for the people who need them, separate admin accounts, and multi-factor authentication on cloud services.
Malware protection
Anti-malware or application allow-listing on every device in scope, kept up to date.
How we get you ready
- 01
Scope and gap assessment
We agree which devices, cloud services and users are in scope, then review each against the requirements and list what would fail.
- 02
Fix the gaps
We work through the list with you: enabling multi-factor authentication, replacing unsupported software, tightening settings and admin rights.
- 03
Prepare the evidence
We help you answer the question set accurately and gather what an assessor will ask to see.
- 04
Assessment and renewal
You submit to a licensed certification body, who issues the certificate. For Plus, we prepare devices for the hands-on technical audit. We can keep you ready for each annual renewal.
What you receive
- A scoped gap assessment against the current requirements
- A prioritised list of fixes, and hands-on help to make them
- Support completing the question set accurately
- Device preparation for the Cyber Essentials Plus audit
- A plan for staying compliant through the year, not just at renewal
Cyber Essentials: common questions
What is the difference between Cyber Essentials and Cyber Essentials Plus?
Cyber Essentials is a verified self-assessment of your controls. Cyber Essentials Plus covers the same controls but adds a hands-on technical audit, where an assessor tests a sample of your devices and accounts.
Do you issue the certificate?
No. Certificates are issued by certification bodies licensed under the scheme. We prepare you so your assessment with them goes smoothly.
What usually causes a business to fail?
The most common gaps are unsupported operating systems or software, missing multi-factor authentication on cloud services, updates applied too slowly, and staff using admin accounts for everyday work.
Are home-working and personal devices in scope?
Devices that access your organisation's data or services are generally in scope, including home-working laptops and, in many cases, personal phones. We help you decide the scope and the simplest way to meet it.
How long is a certificate valid?
Certification needs renewing every year, and your setup has to keep meeting the requirements in between, which is why we plan for the whole year rather than one assessment.