Do you issue Cyber Essentials certificates?

No. Certificates are issued by IASME-licensed certification bodies. We prepare your systems, help you complete the questionnaire and support you through any Cyber Essentials Plus audit. You pay the certification body’s fee directly.

Are personal phones and home laptops in scope?

If they are used to access company data or services, such as email, they are usually in scope. There are practical ways to handle this, for example managed work profiles on phones or keeping company data in managed cloud apps. We will help you decide what fits your team.

Are Microsoft 365 and other cloud services included?

Yes. Cloud services you use are in scope, and multi-factor authentication is expected for user accounts on them. We review your Microsoft 365 or Google Workspace settings as part of the readiness check.

What if we still run older software we cannot replace?

Unsupported software generally has to be removed or separated from the scope, for example on an isolated network segment. We will look at the options with you, including whether the system can be upgraded or replaced.

How long does a certificate last?

Cyber Essentials is renewed every year. Customers and contracts that require it usually expect a current certificate, so we plan the renewal date into your support calendar.

Compliance · Cyber Essentials

Cyber Essentials, ready first time

We check your devices, accounts and network against the five Cyber Essentials controls, fix what would fail and support you through the assessment for Cyber Essentials and Cyber Essentials Plus.

Book a free IT & security review CE or CE Plus?

What it is

The UK’s baseline for everyday cyber security

Cyber Essentials is a UK government-backed scheme, run with the National Cyber Security Centre (NCSC), that sets out five technical controls to protect organisations against the most common internet-based attacks.

IASME is the NCSC’s Cyber Essentials partner and licenses the certification bodies that carry out assessments. Certification is renewed every year, and the requirements are updated periodically, so we always prepare you against the version current at the time of your assessment.

Asked for in many public-sector contracts and a growing number of private ones
Covers your devices, servers, network and cloud services in scope
Two levels: Cyber Essentials and Cyber Essentials Plus

Talk to an engineer

Woman looking at her smartphone while holding an open laptop

The five controls

What an assessor will check

Every device, account and cloud service in scope has to meet all five. These are the areas we review and fix.

Firewalls
Boundary firewalls and the software firewalls on devices are configured so only the services you need are reachable from the internet, with default admin passwords changed.
Secure configuration
Unnecessary accounts and software removed, default passwords changed, auto-run disabled and devices set to lock, so systems are not left in their insecure factory state.
Security update management
Operating systems and applications are licensed, supported by the vendor and patched promptly. High-risk and critical updates must be applied within 14 days of release.
User access control
Everyone has their own account with only the access they need, admin rights are used only for admin tasks, and multi-factor authentication protects cloud services.
Malware protection
Anti-malware software or application allow-listing stops malicious code running on your devices, and is kept up to date.

Two levels

Cyber Essentials or Cyber Essentials Plus?

Both levels cover the same five controls. The difference is how they are verified. Many businesses start with Cyber Essentials and move to Plus when a customer or contract asks for it.

Comparison of Cyber Essentials and Cyber Essentials Plus
Compared	Cyber Essentials	Cyber Essentials Plus
How it is assessed	Self-assessment questionnaire	Questionnaire plus a hands-on technical audit
Who verifies it	An IASME-licensed certification body	An IASME-licensed certification body
Technical testing of your devices	Not included	Included
When it can be taken	At any time	Shortly after achieving Cyber Essentials
Renewal	Every year	Every year
How we help	Readiness check, fixes and questionnaire support	Pre-audit testing, fixes and support on the day

Cyber Essentials
How it is assessed
Self-assessment questionnaire
Who verifies it
An IASME-licensed certification body
Technical testing of your devices
Not included
When it can be taken
At any time
Renewal
Every year
How we help
Readiness check, fixes and questionnaire support
Cyber Essentials Plus
How it is assessed
Questionnaire plus a hands-on technical audit
Who verifies it
An IASME-licensed certification body
Technical testing of your devices
Included
When it can be taken
Shortly after achieving Cyber Essentials
Renewal
Every year
How we help
Pre-audit testing, fixes and support on the day

The Plus audit must follow a current Cyber Essentials certification within the window set by the scheme. Your certification body will confirm the exact timings and fees, which are paid to them directly.

How we prepare you

From first call to certificate

You choose the certification body; we make sure there are no surprises when you get there.

Step 1: Scope and readiness check
We agree what is in scope, including laptops, phones, servers, cloud services and any personal devices that reach company data, then check each against the controls.
Step 2: Fix the gaps
We replace or isolate unsupported software, switch on multi-factor authentication, tighten firewall rules, remove unneeded admin rights and bring patching up to date.
Step 3: Questionnaire
We help you complete the self-assessment accurately, with the technical answers drafted for you to review and submit.
Step 4: CE Plus audit
For Plus, we run our own checks first, fix anything they find and are on hand while the assessor tests a sample of your devices.
Step 5: Stay compliant
Patching, device management and access reviews continue month to month, so next year’s renewal is a formality rather than a project.

Common gaps

What usually needs fixing first

Most small businesses are closer than they think. The same handful of issues comes up again and again in readiness checks, and most can be fixed without disrupting your team.

Laptops or servers running an operating system that no longer gets security updates
Cloud accounts, such as Microsoft 365, without multi-factor authentication for every user
Staff using accounts with admin rights for everyday work
Routers and firewalls with default passwords or old, open rules
Updates applied irregularly rather than within the 14-day window
Personal phones reaching company email with no basic controls

Book a readiness check

Woman leaning over to help a seated colleague with his laptop at a desk by a window

Cyber security services
Managed endpoint protection, email security and monitoring that keep the controls in place all year.
Cyber security
ISO 27001 readiness
The Cyber Essentials controls cover much of the technical side of ISO 27001’s Annex A.
ISO 27001 readiness
Supply-chain requirements
How Cyber Essentials fits into the security questionnaires larger customers send.
NIS2 & supply chain

FAQ

Cyber Essentials questions

This page is general information, not legal advice. Requirements change, so we always work from the current published version of a scheme or regulation, and alongside your legal adviser or data protection lead where the law is involved.

Free IT & security review

Find out where your IT is exposed — in 30 minutes

A senior engineer reviews your setup, security and backups, then gives you a plain-English action list. No obligation, no hard sell.

Book your free review Call us instead

Or call 07575600958

Cyber Essentials, ready first time

The UK’s baseline for everyday cyber security

What an assessor will check

Firewalls

Secure configuration

Security update management

User access control

Malware protection

Cyber Essentials or Cyber Essentials Plus?