Cyber Essentials
Fully handled from first check to certification. We find the gaps, help you close them, prepare and submit the assessment.
For North West London and Central London businesses that need the certificate for tenders, a panel, an insurer or a regulator.
Certified ourselves, and we certify businesses like yours
- Cyber Essentials certified ourselves
- 25+ businesses certified this year
- Current on v3.3, the Danzell question set
- One point of contact from start to certificate
- Opens doors to public sector and larger tenders
WHO NEEDS CYBER ESSENTIALS?
It gets you into tenders, panels and contracts that uncertified competitors can’t bid for.
Cyber Essentials is the government-backed baseline, run by IASME with the NCSC. These are the requests we see most.
📄
Tenders and Contracts
Required for suppliers on many central government contracts, and common in public sector and larger private tenders.
⚖️
Law Firms and Professional Services
Commonly asked for in panel and referrer arrangements, and by professional indemnity insurers.
👩⚕️
Healthcare Providers
The technical backbone for your DSPT evidence and for showing CQC you manage information securely.
THE REQUIREMENTS
The five Cyber Essentials controls, explained
Cyber Essentials checks five technical controls. Together they block the most common attacks on small businesses: phishing, password guessing and exploiting unpatched software. Here is what each one means in practice, and where businesses usually fall short.
| Control | What it means | Where businesses fail |
|---|---|---|
01Firewalls |
Every device that connects to the internet sits behind a correctly configured firewall. That covers your office router and the built-in firewall on each laptop, which matters most when staff work from home or on public Wi-Fi. |
|
02Secure configuration |
Devices and software must be set up securely from day one: unused software and accounts removed, default passwords changed, auto-run switched off, and a PIN or password needed to unlock every device. |
|
03Security update managementv3.3 automatic fail |
High-risk and critical updates must be installed within 14 days of release, across operating systems, applications, firewalls and routers. Software that no longer receives updates must be removed or replaced. |
|
04User access controlv3.3 automatic fail |
Staff only get the access their role needs. Admin accounts are separate and used only for admin tasks, leavers are removed promptly, and MFA is on for every cloud service that offers it, including where it is a paid option. v3.3 also puts more weight on passkeys and FIDO2 keys. |
|
05Malware protection |
Every in-scope device is protected, either with anti-malware software that updates and scans automatically, or with application allow-listing. |
|
Not sure how you measure up?
The free Readiness Checker walks you through all five controls in a few minutes.
HOW MUCH DOES CYBER ESSENTIALS COST?
Every route ends with a certificate you can bid with.
- ✓Intake questionnaire and review call
- ✓Gap report and remediation plan
- ✓Fee credited in full if you certify within 30 days
- ✓Scope agreed and devices checked
- ✓Assessment prepared and submitted
- ✓IASME certificate fee included
- ✓Annual certificate included
- ✓Reassessment handled for you
- ✓Gaps caught before the renewal date
HOW IT WORKS
Assess. Fix. Certify.
01
Assess
You complete a short questionnaire. We review it with you on a call and send a written gap report against all five controls.
02
Fix
You close the gaps yourself, or we do it for you on a fixed quote. Most fixes are MFA, updates and old devices.
03
Certify
We prepare and submit your assessment. The certification body reviews it and issues your certificate, valid for 12 months.
Cyber Essentials for care providers
If you are a CQC-registered care provider, data security is already part of your inspection. Inspectors ask how you keep information secure, and the Data Security and Protection Toolkit (DSPT) is the recognised way to show it. Cyber Essentials is the technical backbone for that evidence.
How Cyber Essentials supports your DSPT
The DSPT is an annual self-assessment that CQC-registered adult social care providers in England are expected to complete. Many of its technical questions cover the same ground as Cyber Essentials, so getting Cyber Essentials right puts much of your technical evidence in place.
MFA on your systems
Devices and software kept up to date
Controlling who has access
Protecting devices against malware
Backing up data and restoring it
What we cover, and what stays with you
The DSPT is wider than IT. It also covers paper records, staff conduct, information sharing and data protection training, which 95% of staff must complete each year. We say this up front so nothing is assumed.
We provide
- The technical evidence for your submission
- The controls behind that evidence, set up and maintained
- Documentation you can show an inspector or commissioner
Your team keeps
- Your policies and procedures
- Your care records processes
- The final DSPT submission
Commissioning contracts
Commissioners are advised to build DSPT at Standards Met into provider contracts.
NHS access
The DSPT is the route to NHS.net Connect secure email and shared care records.
Hands-on DSPT experience
You deal with one person who understands both the technical controls and what an inspector expects to see. Tell us when your DSPT is due.
QUESTIONS
Answers before you book.
How long does it take?
Typically 1-3 weeks depending on the size of your business.
What happens if we fail?
Most failures are fixable and we’ll handle that for you. Because we check your setup before submitting, including the MFA and 14-day patching rules that cause most failures, the aim is to pass first time.
Do we need to be a managed IT client?
No. Assessment and certification are available on their own. Managed clients on our Compliance plan pay the certificate fee plus a small admin charge.
We already hold Cyber Essentials. Do we need this?
Your next renewal is judged under v3.3. If MFA or 14-day patching is not in place, you will fail. A readiness assessment before you open your renewal account avoids that.
Do you offer Cyber Essentials Plus?
Talk to us. Plus needs an independent audit on top of the self-assessment.
WHERE WE WORK
Cyber Essentials across London and Hertfordshire
Most Cyber Essentials work is done remotely, so we can certify businesses anywhere in the UK. Where on-site checks help, such as reviewing office routers or older devices, we cover the areas below.
North West London
- Edgware
- Stanmore
- Harrow
- Hendon
- Mill Hill
- Wembley
- Kingsbury
- Colindale
Central London
- West End
- Fitzrovia
- Marylebone
- Holborn
- The City
Hertfordshire
- Hemel Hempstead
- Watford
- Borehamwood
- Bushey
- St Albans
We work with law firms, accountants, care providers and construction businesses across these areas who need the certificate for a tender, a panel, an insurer or a regulator.
Book a Free Consultation
Speak directly to the engineer who will look after your systems, with no call centre in between. Tell us how you’re set up and what’s prompted the review.
Prefer email?
Fill in your details below and we’ll get back to you today.