Cyber Essentials (UK)
Cyber Essentials is the UK government-backed scheme that certifies an organization has the basic technical controls in place to defend against the most common internet-based attacks. It's intentionally not exhaustive — it covers five control areas: firewalls, secure configuration, user access control, malware protection, and patch management. That's the point. Most successful attacks don't involve anything exotic; they exploit the absence of these fundamentals. Getting them right, and proving it, is what the certification is for.
The two levels
Cyber Essentials is a self-assessment questionnaire, verified by an external assessor and backed by cyber insurance in most cases. Cyber Essentials Plus goes further: an assessor actually tests your systems — vulnerability scans, verification of patch levels, checks that the controls you claimed in the questionnaire are really in place. A lot of organizations pass the base certification comfortably and then discover during Plus testing that patching has drifted, or that an admin account somewhere doesn't have multi-factor authentication, or that a legacy device never got decommissioned.
How I help
I go through the questionnaire with you honestly before you submit anything, scoping which devices, cloud services, and user accounts are actually in scope — getting scope wrong is one of the most common ways organizations trip themselves up. Then I help close the real gaps: firewall rules that are looser than anyone remembers, default configurations that were never hardened, local admin rights that have spread further than intended, missing MFA on remote access and cloud admin accounts, and patch management that's inconsistent across the device fleet.
If you're going for Cyber Essentials Plus, I treat the onsite or remote technical testing as a dry run beforehand — running the same kind of checks an assessor will run, so surprises show up on my watch instead of theirs. For organizations that need this to win a UK government contract or satisfy a customer, I also help you think past the certificate itself to whether these five control areas are genuinely protecting you, since a lot of real attacks land exactly where a sloppy Cyber Essentials implementation leaves a gap.
Who this is for
UK-based organizations bidding on government contracts that require certification, companies whose customers are asking for it, and anyone who wants a straightforward, credible baseline without taking on a full ISO 27001 program.
Ready to find out what shape your five control areas are actually in? Get in touch.