Cyber Essentials Certification Support
Practical, honest help with Cyber Essentials Certification, scoped to what you actually need.
Cyber Essentials is a UK government-backed certification that gives your organisation a recognised cybersecurity baseline. On paper it’s five controls, a self-assessment, and a certificate. In practice it’s scoping the boundaries accurately, getting the controls genuinely in place, and answering the questionnaire honestly. How much help you need from us depends on where you’re starting from. Around 80% of our clients self-certify using the CyberSmart platform we provide and handle it internally with their IT support. Others want our time to scope, work through the questions, fix the gaps, and prepare for CE+. That hands-on work is billed hourly because the right amount is different for every business.
The worlds best Cyber protection, 24 hours a day
Giving peace of mind to business owners around the world
All provided through affordable monthly agreements
Practical Cyber Essentials Help for UK Businesses
The scheme is run by the National Cyber Security Centre and delivered through IASME-accredited certification bodies. It’s a security scheme aimed at helping organisations protect themselves against the everyday cyber attacks SMEs face. We work with CyberSmart, an accredited Cyber Essentials certification body who provide the platform and the formal assessor relationship. That gives you a single point of contact for the whole engagement, with the formal accreditation handled in the background.
Most businesses we work with do not need full consulting; they usually need platform access and the occasional question answered. Sometimes additional help is needed, particularly when the environment is not yet secure enough to pass the Cyber Essentials assessment. This support can take the form of advice, assistance with controls or actual infrastructure fixes. We will establish which is suitable for you when you speak to one of our Cyber Essentials Specialists.
What’s Included in Our Cyber Essentials Service
Our service comes in two parts: the CyberSmart package we provide, and any ad-hoc help you ask for on top.
What you always get
- Access to the CyberSmart platform
- Built-in guidance through the Self Assessment Questionnaire (SAQ)
- Submission to the assessor
- Your certificate on pass
- Annual renewal handling
What’s available on top
- Scoping help if the boundary is ambiguous
- Self Assessment Questionnaire (SAQ) walk-through on the tricky questions
- Hands-on remediation when controls need fixing
- CE+ audit preparation
- Specific technical advice as it comes up
CyberSmart offers different package levels (Certification Only, Core, others) — we’ll recommend the one that fits when we scope the engagement. The additional services over and above the packages are billed on an ad-hoc hourly basis at our current rates.
The Five Cyber Essentials Technical Controls
Cyber Essentials defines the five key security controls SMEs need to protect against common cyber threats and demonstrate your commitment to data security. These five essential controls cover the common internet-based attack types most SMEs face: phishing, credential reuse, unpatched systems, exposed services, and untargeted malware. The detail of what each control requires is in the NCSC Cyber Essentials Requirements for IT Infrastructure document, currently at v3.3. Below is a working summary of what each one means and where SMEs typically struggle in real-world deployments.
Firewalls
Every in-scope device needs a firewall between it and the internet. For most businesses, that’s a boundary device on the office network plus the host-based protection built into each laptop and desktop. Default admin passwords must be changed, unused services disabled, and inbound rules documented and justified. For businesses with site-to-site VPNs, multiple offices, or unusual network topologies, just documenting and justifying the inbound rules can be substantial work.
Secure Configuration
Devices and software need to be configured to reduce attack surface. That means removing default user accounts, disabling unused features, requiring secure passwords or MFA on every login, and getting rid of pre-installed software you don’t need. It sounds basic, and it is. But the assessor will ask what’s actually configured on the user devices in scope, and the answer needs to match.
Security Update Management
Operating systems, applications, and firmware need to be updated within 14 days for critical and high-severity fixes. This is a hard SLA. There’s no risk-acceptance process or change-board exception that gets you past it. That includes everything from Windows updates to the browser plugins running on a sales laptop. Many SMEs assume Windows Update covers them; it doesn’t. Third-party software, Office add-ins, and end-of-life devices are where the vulnerability findings tend to land.
User Access Control
Users need the access they need for their role and nothing more. Admin accounts must be separate from day-to-day user access. MFA is required on cloud services for all users (not just admins) and on remote access. Leavers need to be removed promptly. The control most often missed is the separate admin account rule: if your finance manager is also a local admin on their laptop, that’s an automatic finding.
Malware Protection
Every in-scope device needs malware protection, and it needs to be active. For Windows machines, Microsoft Defender is acceptable if it’s properly configured and reporting in. For other platforms, an equivalent product. Application allowlisting is permitted as an alternative on locked-down devices, but it has to be genuinely enforced. Saying “we have antivirus” is not the same as protection that meets the standard.
How the Cyber Essentials Process Works
01
Setting Up on the Platform
Once a CyberSmart package is in place, you get portal access and the self-assessment questionnaire workflow. CyberSmart provides built-in guidance through every question; the platform also stores evidence and handles submission to the assessor.
02
Defining Your Scope
Before the cyber essentials questionnaire can be answered, the boundary of scope needs to be defined. That means deciding which devices, users, cloud services, and networks fall inside your Cyber Essentials assessment, and how hybrid working, BYOD, and remote setups affect that boundary. The size and complexity of your network usually dictates how long this takes. Get the boundary wrong and the assessment can fail on a technicality, even if the underlying security is solid. The platform’s guidance helps frame it; if scoping looks ambiguous, ask us.
03
Assessing Against the Five Controls
With scope clear, the next step is checking what’s actually in place against what each of the five controls requires. The dedicated controls section below covers what each control means in practice. The honest assessment matters more than the Self Assessment Questionnaire (SAQ) wording. If the answers in the SAQ don’t reflect the reality, CE+ will catch it later.
04
Fixing the Gaps
Where the current setup falls short, the gaps need to be addressed before the Self Assessment Questionnaire (SAQ) can be answered honestly. The work involved varies enormously, anywhere from a few configuration changes through to several months of broader cleanup across your estate. Most clients handle this with their own team or IT provider; we can be pulled in for specific technical input on an ad-hoc basis.
05
Completing and Submitting the Self Assessment Questionnaire (SAQ)
The SAQ is completed on the CyberSmart platform with their built-in guidance. Most clients fill it in themselves. Once submitted, the assessor reviews and the certificate is typically issued within 24 hours.
06
Cyber Essentials Plus Audit (Optional)
For higher assurance, CE+ adds an independent technical audit on top of the basic certification. The dedicated cyber essentials plus assessment section below covers what the audit tests and the rules for pass and fail.
07
Annual Renewal
Both Cyber Essentials and Cyber Essentials Plus certifications are valid for 12 months. CyberSmart prompts renewal in good time; renewing earlier means there’s no period where the certificate has lapsed.
Cyber Essentials vs Cyber Essentials Plus
The Cyber Essentials scheme has two levels. The basic certification is completed on the CyberSmart platform, where the assessor reviews your answers and issues the certificate if satisfied. For full coverage you can achieve Cyber Essentials and Cyber Essentials Plus together, which gives independently verified evidence of the same controls.
Cyber Essentials Basic
For most SMEs starting out, Cyber Essentials basic certification is the right entry point. It satisfies most procurement requirements, qualifies you for cyber insurance discounts, supports compliance with insurer and customer requirements, and demonstrates a baseline of cybersecurity to your customers and partners.
Cyber Essentials Plus
CE+ covers the same five controls, but a qualified assessor verifies them through hands-on testing rather than reviewing your answers. It adds independent verification, which matters more when you’re bidding for government-backed contracts or working with clients who require stronger assurance.
| Cyber Essentials | Cyber Essentials Plus | |
|---|---|---|
| Assessment type | Self-assessment questionnaire (SAQ) | Independent technical audit |
| Evidence | Your answers, reviewed by an assessor | Hands-on testing on a sample of user devices |
| External vulnerability scan | Not required | Included |
| Time once submitted | ~24 hours to certificate via CyberSmart | ~2 weeks if controls match the SAQ |
| Cost level | Lower | Higher |
| Best for | First-time certification, most SMEs | Government suppliers, regulated sectors, higher-assurance use cases |
Cyber Essentials Plus (CE+) Support
What CE+ Tests
For CE+, an independent assessor verifies the Self Assessment Questionnaire (SAQ) answers through hands-on testing. The work includes an external vulnerability scan against your perimeter, an authenticated scan on a representative sample of user devices, and tests on email and web browsers to confirm protection actually blocks what it should. The assessor checks patching against the 14-day rule, account separation, and MFA enforcement across every cloud service that supports it. MFA verification now covers both administrative and standard user accounts, not just admins. CE+ isn’t a full penetration test, but it does verify that controls are doing what the SAQ said they were and that no obvious vulnerability has been left exposed.
Pass and Fail Rules
If the assessor is satisfied that the controls are in place as claimed, you receive your certificate. Missing MFA on a cloud service that supports it is an immediate fail at the question, with no opportunity to fix during the assessment. A patch missing for more than 14 days is also an automatic fail, regardless of the reason for the delay. Other findings get a remediation window: 30 days for patching across all in-scope devices, 15 days for other vulnerability findings. The assessor then re-tests both the original sample and additional devices selected randomly. If the same issue surfaces again on the re-test, the CE+ result is failed and the basic CE certification is withdrawn at the same time.
Preparation for CE+
Effective readiness work mirrors what the assessor will do: sampling your devices and running the same checks, verifying MFA enforcement across cloud services, and confirming patching cadence against the 14-day rule. Anything that would fail at the assessment needs to be identified and addressed before the assessor visits. We support most of our CE+ clients through this stage and they pass on the first attempt because the awkward findings are already resolved.
Why CE+ Matters
CE+ gives you independent verification that the controls are actually working, not just documented. That carries weight for stakeholders, opens doors on tenders that require it, and reassures clients in a way that the basic version alone can’t. For some sectors, including defence supply chain, parts of healthcare, and central government framework agreements, CE+ is the minimum entry requirement. It also strengthens your wider cyber resilience by holding the controls to an external test rather than a self-reported answer.
Who Should Get Certified?
Cyber Essentials suits most UK businesses that handle customer data, work with public sector clients, or want a structured baseline for their cyber security. The clients we work best with use the certification as a starting point rather than the finish line. Common reasons they pursue it:
Businesses Asked for Cyber Essentials by Clients or Insurers
You have been asked for it by a customer, a tender, or an insurer.
Organisations Looking for a Practical Cyber Security Baseline
You need a structured way to improve your information security without committing to a full ISO 27001 programme.
Government Suppliers and Public Sector Contractors
You are a supplier to government and need to meet the requirements for central government contracts.
Why Choose Security Everywhere
We work with SMEs and growing businesses across the UK, and we’ve put a lot of clients through both certifications. A few things we hear consistently:
Plain-English Cyber Essentials Advice:
The advice is plain English. If we have to explain a control, we explain it once and properly.
Flexible Support That Fits Your Team:
We can do the work or hand you the platform, depending on what fits. Most clients handle the form themselves; some want our hands on the technical fixes.
Ongoing Support Beyond Certification:
The relationship doesn’t end at the certificate. We handle annual renewal, re-scoping when your business changes, and any follow-up advice you need.
A Single Point of Contact from Start to Finish:
Our partnership with CyberSmart, an accredited certification body, gives you a single, trustworthy point of contact for the whole journey.
If that fits the way you want to work, we’d be glad to have a conversation. Our cyber security certification work is grounded in best-practice technical advice and the same plain-English approach we apply to everything else we do.
Speak to a Cyber Essentials Specialist
Whether you’re starting from scratch, recovering from a failed attempt, or planning your annual renewal, we can help you take practical steps toward certification. The first conversation is free, and we’ll be honest about which level of support fits: platform-only, full hands-on, or somewhere in between. Hands-on work is billed by the hour and scoped to what you actually need. Get expert guidance on the route that helps you reduce risk fastest in your situation, with strong security baked in from the start. Our expert support stays with you through annual renewal and any re-scoping.
Contact Us
FAQs
Is Cyber Essentials mandatory for UK businesses?
Not generally, but it’s mandatory for any organisation bidding for certain UK government contracts that involve handling personal data or providing IT products and services. Many private-sector clients and insurers also require it as part of their procurement checks.
How long does certification take?
From a complete Self Assessment Questionnaire (SAQ) submission via CyberSmart to certificate is typically within 24 hours. If your controls already meet the standard, you can move from first conversation to certificate in days. If gap analysis surfaces missing controls, the timeline depends on what needs to change and how quickly you (or your IT provider) move on it. CE+ typically follows the basic certification within a couple of weeks if the basic submission was accurate.
Can SMEs achieve Cyber Essentials certification?
Yes. The scheme was designed with SMEs in mind. Most of our clients are small businesses with anywhere from five to 250 staff, and the controls are achievable for any team willing to undertake the work.
What happens if the assessment fails?
For the basic certification, the assessor returns the Self Assessment Questionnaire (SAQ) with the findings and you have a defined window to fix them and resubmit. For CE+, some failures are immediate and unrecoverable in that assessment (missing MFA, or patches more than 14 days old). Others get a 15- or 30-day window to fix and resubmit, with a re-test that includes additional devices. If the same issue surfaces again on the re-test, the CE+ result is failed and the basic CE certification is withdrawn.
Does Cyber Essentials cover cloud systems?
Yes, and cloud services cannot be excluded from scope. SaaS, IaaS, and PaaS your organisation controls and uses for business data are all in scope. The shared responsibility model means some controls are met by the cloud provider and some by you. The MFA-on-every-cloud-service rule has made this area materially harder for businesses with a long tail of SaaS tools.
Can it help with insurance and compliance requirements?
Often, yes. Many UK cyber insurance policies offer better terms or eligibility if you hold Cyber Essentials, and it satisfies a baseline level of compliance for many supplier and customer frameworks. Some insurers require it outright. Worth checking with your broker for the peace of mind that comes from knowing where you stand.
Does hybrid or remote work affect certification scope?
Yes. Any user device used for work, including home machines and BYOD where it’s permitted, falls inside the boundary of scope. The five controls still apply. We help clients work out the cleanest way to handle this without unnecessarily expanding scope.
When should businesses start preparing for Cyber Essentials?
The right time to start is before a customer or tender forces it on you. Many organisations’ boards now treat the certificate as a standing item rather than a one-off project.
Does the Cyber Essentials Certification cover the whole business?
The certification covers the whole business by default, but the boundary of scope can be defined more narrowly if it makes sense (for example, certifying one subsidiary or one office).
How often should businesses review their Cyber Essentials strategy?
Annually at minimum, because certification is renewed every 12 months. We recommend a lighter touch quarterly review of the controls, especially after a significant change like a move to new cloud services, a new office, or onboarding a new IT provider. Maintaining the controls is part of building real resilience, not just keeping a certificate on the wall.
Is Cyber Essentials recognised outside the UK?
Though primarily UK-focused, Cyber Essentials is now internationally recognised as a sensible starting point for SME cyber security.
