Cyber Essentials, handled from gap assessment to certificate.
Five technical controls and a long questionnaire. The controls are the easy part when your IT is already run properly. The questionnaire is where most businesses stall. We do both.
- Certification
- Cyber Essentials and Plus
- Lead time
- From 3 weeks
- Plus
- 6 to 10 weeks
- Validity
- 12 months
- Your time
- Review and sign
It stopped being a badge and became a requirement.
Contracts ask for it
Government contracts handling personal or sensitive data require it, and the expectation has spread down supply chains into private-sector tenders.
Insurers ask about it
Cyber policies are increasingly priced on evidence of controls. Certification often helps with premiums, and more importantly with claims.
The controls genuinely work
The five controls target how most attacks actually succeed. Do them properly and you remove a large share of real risk, certificate or not.
Clients ask about it
Due-diligence questionnaires now routinely ask whether you are certified. A yes ends a lot of follow-up questions.
The five controls, and where businesses fail them.
Nothing exotic. The hard part is that it applies to every device in scope, including home machines and personal phones used for work, and the assessor wants evidence rather than reassurance.
| Control | What it requires | Where businesses usually fail |
|---|---|---|
| Firewalls | Boundary and device firewalls configured, default passwords changed, unused rules removed | Old rules nobody dares delete, remote access left open |
| Secure configuration | Default accounts removed, unused software disabled, screen locks enforced | Shared logins and machines set up ad hoc over the years |
| Security update management | Supported software only, high-risk updates applied within 14 days | One unsupported operating system somewhere, router firmware never updated |
| User access control | Named accounts, least privilege, separate admin accounts, leavers removed, multi-factor on cloud services | Everyone is a local admin, dormant accounts still active, MFA gaps |
| Malware protection | Protection on every in-scope device, kept current | Personal or home devices in scope but unprotected |
Missing multi-factor sign-in on a cloud service is now an automatic fail.
We hold Cyber Essentials ourselves. View our certificate on the official registry.
You review and sign. We do the rest.
The questionnaire is long and unforgiving. A wrong answer either fails you or, worse, certifies you against something untrue. We complete it from the real state of your estate, which we already document.
Scope and gap assessment
We define what is in scope and test it against the five controls. You get a plain list of what would fail today.
Week 1Fix the gaps
Multi-factor gaps, admin rights, unsupported software, firewall rules and patch backlog.
Weeks 2 to 4Submit
We complete the questionnaire and gather the evidence. A director reviews and signs.
Weeks 4 to 5Stay certified
The controls remain part of the managed service, so renewal is a review, not a rebuild.
Every year
Illustration of a typical first assessment.
Cyber Essentials or Cyber Essentials Plus?
Same five controls. The difference is who checks. Plus adds hands-on testing by an independent assessor, and contracts that specify Plus won’t accept the basic certificate.
| Cyber Essentials | Cyber Essentials Plus | |
|---|---|---|
| Assessment | Verified self-assessment questionnaire | Questionnaire plus independent technical audit |
| Typical lead time | 3 to 6 weeks from a standing start | 6 to 10 weeks from a standing start |
| Validity | 12 months | 12 months |
| Prerequisite | None | Cyber Essentials, held within the last three months |
| Best for | Most tenders, insurance, first certification | Government work and larger supply chains |
Questions we get asked
What is Cyber Essentials?
Cyber Essentials is the UK government-backed certification scheme, delivered by IASME on behalf of the National Cyber Security Centre, that shows an organisation has five basic technical controls in place: firewalls, secure configuration, security update management, user access control and malware protection.
How much does certification cost?
There are two parts: the certification body’s fee, which scales with headcount, and our work on assessment, remediation and submission. On our compliance plan the preparation is included. We quote both separately so you can see where the money goes.
Can we fail?
Yes, and it is better to find out in the gap assessment than at submission. The usual blockers are unsupported operating systems, missing multi-factor sign-in and devices nobody realised were in scope. All fixable, given time.
Are home and personal devices in scope?
If they are used to access company data, generally yes, which surprises people. Personal laptops and phones used for work email are firmly in scope.
How long does it last?
Twelve months. Because the controls are part of our managed service, renewal is a review of what changed rather than starting again.
We are not on a managed contract. Can you still help?
Yes. We do standalone certification work. We will be honest though: if the estate isn’t maintained afterwards, it can drift out of compliance within months.
Related services
Certified by a date, not eventually.
Tell us the deadline: a tender, a renewal, an insurer’s question. We will tell you honestly whether it is achievable.