Cyber Essentials · UK certification
Pass Cyber Essentials first time.
Guided by someone who has worked as a certified assessor. I know what gets checked, where applications fail, and how to get you ready without the panic.
Cyber Essentials is a UK government-backed scheme, run by IASME on behalf of the NCSC. It confirms your business has five basic technical controls in place to stop the most common cyber attacks. More and more contracts, especially in the public sector, now require it before you can even bid.
The problem is that the self-assessment questionnaire is written in language that assumes you already understand it. Plenty of capable businesses fail on their first go, not because their security is bad, but because they answered a question wrong or missed a control they didn't know applied to them.
Where I fit in: I've previously worked as an IASME-certified Cyber Essentials assessor, reviewing real submissions from the assessor's side of the table. I'm not the body that issues your certificate, I'm the person who gets you ready so that when you do apply, you pass. I know exactly what an assessor is looking for, because I've been one.
How the process works
A look at where you stand
I review your current setup against the five controls and tell you plainly what already passes and what needs work, no scare tactics.
Fix the gaps
We close whatever's missing: device settings, user accounts, updates, firewalls, malware protection. I can do the hands-on work or guide your team.
Prepare the submission
I help you answer the questionnaire accurately and in the language the assessor expects, the step where most first-time applicants trip up.
Certify with confidence
You submit through a certification body knowing it's right. If you're going for Cyber Essentials Plus, I'll get you ready for the hands-on audit too.
The five controls
What Cyber Essentials actually checks
All five, in plain English. This is the whole scheme: nothing hidden.
Firewalls
Your internet connection and devices are protected by properly configured firewalls.
Secure settings
Devices and software are set up securely, with default passwords and needless features removed.
Access control
People only have access to what they need, and admin accounts are used carefully.
Malware protection
Anti-malware is in place and working across your devices.
Security updates
Everything is kept patched and up to date, within the scheme's time limits.
Knowing how these map to your actual kit (Windows, Mac, phones, cloud apps) is where the detail lives. That's the part I handle.
Questions
Common questions
Do I really need it?
If a contract or customer is asking for it, yes, you usually can't bid without it. Even when it's not required, it's a strong, recognised signal that you take security seriously, and it covers the basics that stop most real-world attacks.
Cyber Essentials or Cyber Essentials Plus?
Standard Cyber Essentials is a verified self-assessment. Plus adds a hands-on technical audit by an assessor, so it carries more weight, and some contracts specifically ask for Plus. You need standard first. I'll advise which one your situation calls for rather than upselling you.
How much does it cost?
The certification itself has a set fee that depends on your organisation's size, paid to the certification body, not to me. My preparation work is quoted separately and depends on how much needs fixing first. You'll get a clear figure before anything starts.
How long does it take?
A tidy small setup can be ready in a couple of weeks. If there are gaps to close, allow four to six. I'll give you a realistic timeline after the first review.
Can you do the technical fixes too?
Yes. That's the advantage of working with an actual systems engineer, I can prepare you for certification and carry out the hands-on remediation, rather than handing you a list and wishing you luck.
Got a contract asking for Cyber Essentials?
Send me the requirement and a quick description of your setup. I'll tell you honestly how close you are and what it'll take.
Get started