Cyber Essentials 1: decide what certification needs to achieve

A useful baseline, with a defined boundary

Cyber Essentials is a UK government-backed certification scheme focused on reducing exposure to common internet-based attacks. Its five technical control areas are firewalls, secure configuration, security update management, user access control and malware protection. Those controls turn a vague request to “improve security” into concrete questions about devices, accounts and services you operate.

The basic certification uses a verified self-assessment: you answer the scheme questions and a certification body assesses the submission. Cyber Essentials Plus adds independent technical testing against the scheme. Plus is not a different set of business policies, a full penetration test of every application, or proof that no breach can happen. Both certificates concern an assessed scope at a point in time and need ongoing maintenance.

This series uses requirements version 3.3 and the Danzell question set applicable to new assessment purchases from 27 April 2026. Before buying an assessment, download the current requirements and question set from NCSC and IASME. Record their versions in your project folder; do not complete an old questionnaire found in last year's shared drive.

Decide why the organisation wants it

Ask the person requesting certification to bring the actual tender condition, customer clause or board objective. A customer asking for Plus will not necessarily accept the basic certificate. A certificate for one segregated subsidiary may not satisfy a contract delivered by another. Compare the exact legal entity, service, locations and deadline before anyone promises a completion date.

There is a useful internal business case even without a tender: finding unmanaged laptops, retiring unsupported software and making ownership of cloud accounts explicit. These are practical benefits, not a claim that certification guarantees lower insurance premiums or legal compliance. If insurance is important, check eligibility and terms with the actual provider.

Our worked organisation, Merefield Services, is fictional. It has 48 staff, hybrid working, 42 Windows laptops, six Macs and 12 company phones. It uses Microsoft 365, a hosted CRM and a cloud accounting service, with an MSP maintaining the office network. The operations director wants Plus for a customer requirement. Those numbers describe a starting inventory, not a sample size or proof of scope; part 2 tests what has been missed.

Turn the request into funded work

Appoint an accountable sponsor, an internal coordinator and a named contact at the MSP. The sponsor resolves spending and business disruption; the coordinator reconciles evidence and answers; system owners implement changes. Outsourcing support does not outsource the truth of your answers. Ask the MSP which activities are in its contract and which require additional work.

Build a short gap register before booking fixed assessment dates. Separate an unknown from a known failure. “We do not know which phones access email” needs discovery; “this supported laptop has overdue required patches” needs remediation. A green dashboard for managed computers cannot settle the first question.

Budget for staff time, replacement devices, licence changes needed for controls, assessor fees and possible retesting. Get a written quotation with scope, remote/on-site arrangements and retest terms. Do not use a generic online price as the budget for a mixed estate. Book Plus early enough to leave remediation room within the scheme's completion window, covered in part 8.

Make a project board you can actually use

The table is an editorial planning aid, not an additional scheme requirement. Give every open item an owner, due date and dependency. “MSP to sort” is not an owner if nobody at the provider has accepted the task. Review blockers with the sponsor, especially replacements or changes that affect how staff sign in.

Keep broader security work visible

Backups are strongly recommended by NCSC but are not one of the five technical requirements for Cyber Essentials. Continue restore testing, incident response and privacy work alongside certification. Do not stop a useful control simply because it is outside the assessment, or mark the whole organisation secure because the questionnaire is complete.

Use a restricted evidence folder with dates, owners and links to live records. Never place passwords, tokens or recovery codes in the assessment pack. Give the assessor an agreed secure sharing route and keep a record of what was shared. A short evidence index is easier to maintain than hundreds of unexplained screenshots.

Exercise: the first planning meeting

Write a one-page brief containing the certification level requested, the intended scope, the business reason, the sponsor, the unresolved questions and the budget decision needed next. Add one measurable readiness gate: no unanswered scope questions before the final declaration. Ask the sponsor and technical lead to challenge it together.

You are ready for part 2 when the request is specific enough to quote, ownership is accepted and you can explain what the certificate will and will not establish. If the deadline is already unrealistic, escalate now with options. A rushed inaccurate declaration creates a larger problem than an honest revised plan.

Check your understanding