Cyber Essentials Certification Support
Achieve Cyber Essentials with practical support from Weald IT
Cyber Essentials is a UK Government-backed certification scheme designed to help organisations protect themselves against the most common internet-based cyber threats.
Weald IT can guide your organisation through the process, identify technical gaps and complete the work needed to prepare you for Cyber Essentials or Cyber Essentials Plus certification.
We provide the technical expertise and practical support. Your formal assessment and certification are completed independently by an authorised Cyber Essentials Certification Body.
Speak to us about a Cyber Essentials readiness review.
What is Cyber Essentials?
Cyber Essentials sets out five key areas of technical security:
- firewalls;
- secure configuration;
- security update management;
- user access control;
- protection from malware.
These controls provide a practical security baseline for organisations of all sizes.
Certification can help you demonstrate to customers, suppliers, insurers and other interested parties that appropriate basic cyber security measures are in place.
It may also be required when tendering for certain government, defence or supply-chain contracts.
Cyber Essentials or Cyber Essentials Plus?
Cyber Essentials
Cyber Essentials is based on a verified self-assessment.
Your organisation completes a detailed questionnaire covering its devices, networks, cloud services and security controls. The answers are reviewed by a qualified assessor working for an authorised Certification Body.
Weald IT can help you:
- determine the correct certification scope;
- assess your current position;
- identify and resolve technical gaps;
- prepare draft questionnaire answers;
- gather supporting information;
- respond to technical questions from the assessor.
A senior representative of your organisation must review and approve the final submission.
Cyber Essentials Plus
Cyber Essentials Plus covers the same technical controls and includes independent testing of a representative sample of your systems.
This may include:
- vulnerability testing;
- checks on security updates;
- malware protection tests;
- testing of internet-facing systems;
- inspection of workstation, laptop, mobile device and server configurations;
- verification that the controls described in the Cyber Essentials assessment are operating effectively.
Weald IT can prepare your systems, coordinate the assessment and provide technical support during testing.
How Weald IT supports you
1. Initial consultation
We discuss why certification is required, the timescale involved and consider whether Cyber Essentials or Cyber Essentials Plus is the most appropriate route.
We also consider:
- the legal entity requiring certification;
- office locations and remote workers;
- the number and type of devices;
- cloud and hosted services;
- existing certification;
- customer, tender or insurance requirements.
2. Certification scope
Establishing the correct scope at the beginning is essential.
We review the systems used to conduct your business, including:
- computers and laptops;
- servers;
- mobile phones and tablets;
- office and home-working networks;
- firewalls and internet gateways;
- Microsoft 365 and other cloud services;
- hosted systems;
- remote access;
- personally owned devices used for business.
The proposed scope is then agreed with the Certification Body where required.
3. Readiness review
Our technicians assess your environment against the current Cyber Essentials requirements.
We examine areas including:
- supported operating systems and applications;
- security updates and vulnerability management;
- firewall configuration;
- Microsoft 365 security;
- multi-factor authentication;
- administrator accounts;
- user access rights;
- endpoint security;
- malware protection;
- remote access;
- mobile devices;
- cloud services;
- evidence and asset records.
You receive a clear record of any gaps, recommended actions and responsibilities.
4. Remediation
Where improvements are needed, Weald IT can complete or coordinate the necessary work.
This may include:
- updating or replacing unsupported systems;
- installing outstanding security updates;
- improving firewall configurations;
- enabling multi-factor authentication;
- separating administrator and everyday user accounts;
- restricting excessive access rights;
- securing remote access;
- deploying appropriate endpoint protection;
- improving device management;
- removing insecure software or services;
- documenting the environment.
We will distinguish between work included within your existing Weald IT service and any separately chargeable project work.
5. Assessment preparation
Once the technical work is complete, we help prepare the certification submission.
This can include:
- drafting questionnaire responses;
- checking device and software information;
- gathering supporting evidence;
- reviewing the submission for consistency;
- coordinating with the Certification Body;
- helping respond to assessor questions;
- arranging any required corrections.
The client remains responsible for reviewing and approving the accuracy of the final declaration.
6. Cyber Essentials Plus testing
For Cyber Essentials Plus, we work with the Certification Body to prepare for the technical audit.
We can:
- confirm the systems included in the assessment;
- prepare the selected test devices;
- ensure required devices are online and available;
- provide access to security and management systems;
- prepare patching and endpoint protection evidence;
- support users during testing;
- provide a Weald technician during the assessment;
- resolve technical issues identified during the permitted correction period.
Cyber Essentials Plus must normally be completed within three months of achieving Cyber Essentials.
7. Certification and renewal
Cyber Essentials certification is valid for 12 months.
We can record the certificate and renewal date within our systems and contact you before renewal is due.
An optional ongoing compliance service can help keep your organisation prepared throughout the year rather than treating compliance as a once-a-year exercise.
Ongoing Cyber Essentials compliance
Your systems will continue to change after certification. New devices, applications, users and cloud services can all affect compliance.
Our ongoing support can include:
- quarterly compliance reviews;
- monitoring for unsupported operating systems and applications;
- security update reporting;
- reviews of administrator accounts;
- multi-factor authentication checks;
- firewall and remote-access reviews;
- asset and scope updates;
- annual renewal preparation;
- coordination of repeat certification.
This can be combined with Weald IT’s managed IT support, Microsoft 365 management and cyber security services.
Who is the service for?
Our Cyber Essentials support service is suitable for:
- small and medium-sized businesses;
- charities and not-for-profit organisations;
- professional services firms;
- organisations bidding for public-sector work;
- Ministry of Defence and other supply-chain organisations;
- businesses required to certify by a customer;
- organisations seeking cyber insurance;
- existing Cyber Essentials certificate holders approaching renewal;
- organisations looking for a practical cyber security baseline.
We can support existing Weald IT clients and organisations whose day-to-day IT is managed internally or by another provider.
Why work with Weald IT?
- Established IT support provider serving businesses since 1988
- ISO 27001 and ISO 9001 certified
- Experienced Microsoft 365 and infrastructure technicians
- Practical readiness and remediation support
- Assistance from initial scoping through to assessment
- Coordination with an independent, authorised Certification Body
- Ongoing support to help maintain compliance
- Employee-owned and technician-led
Frequently asked questions
No. Weald IT provides readiness, remediation and certification support. Formal assessment and certification are completed independently by an IASME-authorised Cyber Essentials Certification Body.
We can help prepare draft answers, gather technical information and explain the requirements.
However, a suitably senior representative of your organisation must review and approve the final submission and confirm that the information supplied is accurate.
The assessment generally covers the internet-connected IT infrastructure used to conduct your business.
The precise scope depends on your organisation and must be established carefully. We will help identify relevant devices, services, networks and any legitimate exclusions before the assessment begins.
Yes. Devices used by home and remote workers may fall within the certification scope. The applicable security controls must still be met.
Cloud services used to perform business activities can be relevant to the assessment. This commonly includes Microsoft 365, Azure and other hosted applications.
Unsupported software within scope will normally prevent certification unless it is removed, replaced, appropriately isolated or otherwise handled in accordance with the scheme requirements.
We identify these issues during the readiness review.
This depends on the size and complexity of the organisation and the amount of remediation required.
A well-managed organisation may already be close to compliance. Organisations with unsupported systems, inconsistent patching, incomplete MFA or unclear asset records may require more preparatory work.
Not always.
Cyber Essentials provides independently verified self-assessment certification. Cyber Essentials Plus adds technical testing and provides a higher level of assurance.
The appropriate level may be determined by your customers, contracts, tender requirements, insurers or internal security objectives.
Cyber Essentials and Cyber Essentials Plus certificates are valid for 12 months and must be renewed annually.
Start with a Cyber Essentials readiness review
Whether you are seeking certification for the first time, preparing for Cyber Essentials Plus or approaching your annual renewal, Weald IT can help you understand the requirements and create a practical route to certification.
Complete our short enquiry form or contact us to arrange an initial discussion.
Better IT starts with a conversation.