Cyber Essentials.
On-time. Done right.
Cyber Essentials is the UK government-backed certification that demonstrates your business has the basic controls to keep the most common attacks out. Most companies come looking for it the week a contract starts.
We have done that, solo, end-to-end, on a clock that left no room for a six-week fact finding mission first. Self-assessment or the audited Plus tier, scoped, evidenced and passed.
We have done that, solo, end-to-end, on a clock that left no room for a six-week fact finding mission first. Self-assessment or the audited Plus tier, scoped, evidenced and passed.
Cyber Essentials certificate, or a missed contract. You choose…
It usually happens the same way… Someone you are quoting lists it as a requirement. A larger customer sends a security questionnaire with it ringed in the conditions, or the insurer asks whether you hold one. Suddenly this cyber essential certificate you half-remembered hearing about is standing between you and money you had already counted on.
Then the quotes come back for the work and they tell you weeks or months. You get an onboarding call from a cyber security consultant, feel quite confident, then get a second onboarding call (from a junior second round). The readiness phase is priced way higher than the certificate it is preparing you for.
Most of the above is padding. Cyber Essentials is a defined set of five technical controls, evidenced and submitted to a single scheme. Yes it may seem like a black art from the outside, which rather suits the people who bill for it as though it were. It will be handled by someone who has delivered Cyber Essentials and Cyber Essentials Plus internally, end to end, and understands which answers and controls receive the closest scrutiny, and it will move at the speed your business needs it, not the speed of a company's billing cycle.
Then the quotes come back for the work and they tell you weeks or months. You get an onboarding call from a cyber security consultant, feel quite confident, then get a second onboarding call (from a junior second round). The readiness phase is priced way higher than the certificate it is preparing you for.
Most of the above is padding. Cyber Essentials is a defined set of five technical controls, evidenced and submitted to a single scheme. Yes it may seem like a black art from the outside, which rather suits the people who bill for it as though it were. It will be handled by someone who has delivered Cyber Essentials and Cyber Essentials Plus internally, end to end, and understands which answers and controls receive the closest scrutiny, and it will move at the speed your business needs it, not the speed of a company's billing cycle.
What is Cyber Essentials?
Cyber Essentials is a UK government-backed scheme, overseen by the National Cyber Security Centre (NCSC) and certified through IASME. It checks that five core controls are genuinely in place: firewalls, secure configuration, security update management, user access control, and malware protection, (that's five, not fifty).
Get it right and you shut out the overwhelming majority of opportunistic attacks, which is most of what bothers a small or mid-sized business in the first place. The certificate is recognised across the UK, and opens the door to a great many public sector and government contracts, in fact, it's not normally sitting politely in the optional column. It is required.
Get it right and you shut out the overwhelming majority of opportunistic attacks, which is most of what bothers a small or mid-sized business in the first place. The certificate is recognised across the UK, and opens the door to a great many public sector and government contracts, in fact, it's not normally sitting politely in the optional column. It is required.
Cyber Essentials or Plus?
The two get muddled up constantly, and the difference is refreshingly simple. Cyber Essentials is a verified self-assessment: you submit your answers, a qualified assessor reviews them, and, if they meet the requirements, the organisation is certified. Cyber Essentials Plus is the same controls inspected with the gloves on, an assessor actually tests your systems directly instead of taking your word for it.
Which one you need is up to you, if you have been asked to put it in place, check the level requested. Some accept self-assessment. Some organisations and higher-assurance supply chains require Plus, particularly where the contract explicitly calls for independently tested controls (and potentially ISO 27001, but that's a different beast).
Which one you need is up to you, if you have been asked to put it in place, check the level requested. Some accept self-assessment. Some organisations and higher-assurance supply chains require Plus, particularly where the contract explicitly calls for independently tested controls (and potentially ISO 27001, but that's a different beast).
How long does full certification take?
The answer - Less time than the quote you are holding, almost certainly. The self-assessment can be scoped, evidenced and submitted inside days when your setup is already in decent shape, and inside a couple of weeks when something needs fixing, or hardware needs changing first.
Cyber Essentials Plus adds the hands-on audit, which must be completed within three months of the Cyber Essentials award. Auditor availability and any remediation identified during testing can therefore affect the final date. The reason most providers quote longer is structural, not technical. Handoffs, junior review, an account manager turning your problem into a brief and the brief back into a problem. Take that layer out and the timeline shrinks to the actual work.
Cyber Essentials Plus adds the hands-on audit, which must be completed within three months of the Cyber Essentials award. Auditor availability and any remediation identified during testing can therefore affect the final date. The reason most providers quote longer is structural, not technical. Handoffs, junior review, an account manager turning your problem into a brief and the brief back into a problem. Take that layer out and the timeline shrinks to the actual work.
0
Typical Turnaround
Cyber Essentials Readiness Assessment
The Readiness Assessment is a ninety-minute review of your real setup, measured against what Cyber Essentials actually asks for. We tell you what already passes, what needs attention, and what to tackle first. You finish with a plan you can act on, in language that makes sense.
The assessment includes:
- A review of your current security posture
- Identification of compliance gaps and potential risks
- Practical, prioritised recommendations in plain English
- A clear path to certification
- A follow-up call to answer anything left open
Whether it's for cyber insurance, a customer's contract, public-sector work or simply a stronger setup, you leave knowing exactly what certification will take.
The assessment includes:
- A review of your current security posture
- Identification of compliance gaps and potential risks
- Practical, prioritised recommendations in plain English
- A clear path to certification
- A follow-up call to answer anything left open
Whether it's for cyber insurance, a customer's contract, public-sector work or simply a stronger setup, you leave knowing exactly what certification will take.
0
Fixed fee. No obligation.
What the work actually involves.
01. Scope and gap check
Work out what is in, what is out, and where you actually stand today. Over-scoping is the most popular way to make both the cost and the timeline balloon, so we do this part properly.
If hardware is required, we look for the best balance of quality, speed and keep an eye on that End of Life date, so you can be confident you will be up-to-spec for years.
If hardware is required, we look for the best balance of quality, speed and keep an eye on that End of Life date, so you can be confident you will be up-to-spec for years.
Asset & device inventory
Scope definition
Control gap analysis
Quick-win triage
Honest findings, no inflation
02. Configure and harden
The unglamorous controls that quietly stop the expensive day. Devices, endpoints and the boundary, set to a sensible baseline rather than whatever shipped out of the box.
For an SME this means we aim to get your Microsoft Defender Secure Score over 80% (a reasonable level if you don't want to splash out on Microsoft's more expensive licenses every month).
For an SME this means we aim to get your Microsoft Defender Secure Score over 80% (a reasonable level if you don't want to splash out on Microsoft's more expensive licenses every month).
Microsoft Defender / EDR
Secure config baselines
Host & boundary firewalls
Applications, web & email
Disable vulnerable services
03. Patch and control access
Bring unsupported software, overdue updates and excessive permissions back under control. We establish a maintainable patching process, enforce appropriate access and make sure the controls still work after the certification project ends.
Intune update rings / WSUS
End-of-life & updates
Entra ID Conditional Access
MFA enforcement
Process rollouts
04. Verify, evidence and pass
Prove the controls hold, write down the bits the scheme wants written down, and put the submission in front of the assessor in the form they expect.
For Plus, we go hands-on, liaising directly with the Cyber Essentials assessor.
For Plus, we go hands-on, liaising directly with the Cyber Essentials assessor.
Policy authorship & review
Staff security awareness
Device sampling
Evidence pack assembly
Submission & pass
A clean form is not a secure business.
The self-assessment is a questionnaire, and a questionnaire is precisely the thing an AI will complete for you with the serene confidence of something that has never met your network. The answers come out tidy and plausible. A few are wrong, and it will not flag which ones. Submit those and you own a certificate stapled to your front door overnight, propped open with a fire extinguisher allowing anyone to come in... Passing the form was never the work.
Closing the gap the form is poking at, that was the work all along. Which is the deeply unfashionable reason a human who understands your systems costs far less than the cyber incident that finds the issue first.
Closing the gap the form is poking at, that was the work all along. Which is the deeply unfashionable reason a human who understands your systems costs far less than the cyber incident that finds the issue first.
What you will not get here.
No onboarding ceremony performed before any of the actual work begins. No readiness phase invented just to be invoiced. No certificate handed over by someone who will have moved on by the time the assessor asks the awkward question.
We do not take on businesses unwilling to act on a clear finding, because a control you decline to fix is just a control you are pretending to have. The certificate is only worth the paper if the thing behind it is true. We rather insist on that part!
We do not take on businesses unwilling to act on a clear finding, because a control you decline to fix is just a control you are pretending to have. The certificate is only worth the paper if the thing behind it is true. We rather insist on that part!
Certified in as little as 14 days
Deadline Guaranteed
Precisely Scoped
Truth Over Comfort
Shared Risk Model
Senior-Led Execution
Q&A: Cyber Essentials Basics
What Is a Cyber Essentials Consultant?
Someone who scopes the assessment, checks your controls against the scheme, fixes what fails, and walks you through to a pass. The ones worth hiring have sat the assessment themselves rather than just read about it. We have done it solo, end to end, including the audited Plus tier, on deadlines with no margin for a redo.
How Much Does Cyber Essentials Cost?
Two parts. The scheme's own certification fee is fixed, published and banded by company size. The rest is the work to get you ready, which depends entirely on the state of your current controls. A well-run business needs little; a neglected one needs more. We scope it to your estate rather than a fixed package.
How Long Does Certification Take?
The self-assessment can be done in days when your setup is already sound, or a couple of weeks when something needs fixing first. Cyber Essentials Plus adds a hands-on audit that must fall within three months of the self-assessment award. The work is fast; the calendar is usually the only constraint.
How Long Is a Cyber Essentials Certificate Valid?
Twelve months. It is an annual certification, so you recertify each year. That cadence also stops your controls quietly drifting out of date between renewals.
Can AI Tools Complete Cyber Essentials for Me?
They can fill in the form. They cannot tell you which of their confident answers is wrong, and a wrong answer is either a failed audit or a false sense of security. The form is the easy part. Knowing what it is really asking is the part worth paying for.
AI will write your security policy in seconds, but it might leave your door open.
Speak to a cyber essentials consultant.
Most enquiries open with a deadline and a tender clause nobody has read properly yet. A short call is usually enough to tell you which certificate the contract genuinely requires, how fast it can realistically be done, and whether the quote already in your inbox is being honest with you.