Cyber Essentials Certification

When a contract or grant asks “are you Cyber Essentials certified?”

More and more tenders, grant applications and insurance forms now include one line that can stop you dead: do you hold Cyber Essentials certification? Tick “no” and you’re often out of the running before your bid is read. The scheme is a UK government-backed standard, and public-sector buyers, funders and insurers increasingly treat it as the minimum bar for taking your business seriously.

The problem is that certification looks simpler than it is. The questionnaire asks plain questions, but each one maps to a technical control you have to actually implement and prove. Answer honestly and fail; answer optimistically and you risk a false declaration. We take that whole process off your hands — assess where you stand, fix what’s missing, and get you certified without the guesswork.

What we set up and prepare

• A full gap assessment against the five Cyber Essentials controls, so you know exactly where you stand before you spend anything
• Remediation — we close the gaps: enforce multi-factor authentication, patch and update devices, remove unsupported software, tighten user accounts and lock down firewalls
• The self-assessment questionnaire completed accurately with you, in plain English, with evidence to back every answer
• Cyber Essentials Plus audit preparation — we ready your devices and accounts for the hands-on external test and sit with you through it
• An evidence pack — device inventory, configuration screenshots and policy notes — so your answers are defensible, not guessed
• Annual renewal tracking so the certificate never lapses and quietly costs you a contract

The five controls, in plain terms

Certification rests on five technical controls: firewalls at the boundary of your network, secure configuration of devices, user access control so people only reach what they need, malware protection on every machine, and security update management so nothing runs on out-of-date, unpatched software. Most failures come down to two of these — missing MFA and devices running software that’s past its support date. We check all five, but we spend the time where it actually moves the needle.

Who it’s for

Small and mid-sized businesses across Streatham, South London, Croydon and Surrey that need the certificate to win or keep work — agencies bidding for public-sector contracts, charities and social enterprises applying for grant funding, healthcare and professional-services firms whose clients demand proof, and any company whose cyber insurer now asks for it. It suits home-workers and hybrid teams too: if your staff work from laptops at home, those devices are in scope, and we make sure they meet the standard rather than quietly failing the assessment.

How it works

1. Scoping call — we agree what’s in scope: which devices, accounts, cloud services and people the certification needs to cover
2. Gap assessment — we measure your current setup against all five controls and give you a plain list of what passes and what doesn’t
3. Remediation — we fix the gaps, from MFA rollout to retiring unsupported machines, and confirm each control is genuinely in place
4. Submission — we complete the self-assessment questionnaire with you, attach the evidence, and submit it to the certification body
5. Plus audit (if required) — for Cyber Essentials Plus, we prepare your sample devices and support you through the external technical test
6. Renewal — twelve months on, we re-check what’s drifted and take you through re-certification before the deadline

Problems we commonly fix

• Failed or stalled self-assessments where the answers didn’t match the technical reality
• Multi-factor authentication missing on email and cloud accounts — the single most common reason for a fail
• Laptops and servers running unsupported Windows or macOS versions that put you out of scope
• Home-worker devices that were never brought up to standard and would fail a Plus audit
• No evidence to back the questionnaire, leaving your submission impossible to defend
• Certificates left to lapse, forcing a rushed re-application under contract deadline pressure
• Confusion over whether you need self-assessment or the full Plus audit for a specific client or funder

Cyber Essentials sits alongside our broader cyber security work and day-to-day managed IT support — the same controls that pass the audit are the ones that keep you protected the rest of the year. Where remediation needs monitored, tested backups, we build those in too. Not sure where you stand? Get in touch and we’ll start with the gap assessment.