Protect your business, meet compliance requirements, and win more contracts with expert-led Cyber Essentials support.
Cyber Essentials is a UK government-backed cybersecurity certification designed to help businesses protect themselves against common cyber threats. It focuses on a set of key technical controls that reduce risk and improve your overall security posture. Completing the certification demonstrates that your business takes cybersecurity seriously and meets a recognised standard.
The process involves answering a structured assessment about your systems, devices, and security controls, reviewed by an approved certification body before issuing your certificate.
Protects your business from the most common cyber attacks targeting SMEs.
Shows customers and partners that your business takes security seriously.
Often required for government contracts, tenders, and supply chain participation.
Provides assurance that your IT environment meets recognised security standards.
Cyber Essentials focuses on five technical areas that form the foundation of a secure business environment. These controls are proven to significantly reduce the likelihood of cyber incidents.
Controlling access into and out of your network to block unauthorised traffic and external threats.
Ensuring devices and systems are set up securely, removing unnecessary features and applying appropriate settings from the outset.
Making sure only the right people have access to the right systems, minimising the impact of compromised credentials.
Protecting devices from viruses, ransomware, and malicious software through appropriate anti-malware and application controls.
Keeping systems, software, and devices patched and up to date to close known vulnerabilities before they can be exploited.
Both certifications demonstrate a commitment to cybersecurity. Most businesses start with Cyber Essentials as a baseline before progressing to Plus.
| Feature | Cyber Essentials | CE Plus |
|---|---|---|
| Self-assessment questionnaire | ✓ | ✓ |
| Verified by assessor | ✓ | ✓ |
| Independent technical audit | - | ✓ |
| Hands-on testing of systems | - | ✓ |
| Faster and more cost-effective | ✓ | - |
| Higher level of assurance | - | ✓ |
| Ideal starting point for most SMEs | ✓ | - |
| Suitable for higher-risk or regulated environments | - | ✓ |
At On IT, we don't just tick boxes. We make sure your business is genuinely secure and ready to pass first time.
We review your current setup and identify gaps against Cyber Essentials requirements before any work begins.
We implement the changes needed across your environment:
We help you complete the assessment accurately, avoiding common pitfalls that lead to failed applications.
We liaise with assessors and support you through any clarifications or revisions needed to get across the line.
Cyber Essentials is renewed annually. We keep you compliant and secure long-term, so recertification is never a scramble.
We have completed Cyber Essentials ourselves and understand the process end-to-end - not just in theory.
We help clients achieve certification quickly when it's needed for bids, tenders, and supply chain requirements.
We focus on genuine security improvements, not just getting you through the assessment. The certificate is the outcome, not the goal.
We integrate Cyber Essentials into your wider IT strategy so it strengthens - rather than disrupts - your day-to-day operations.
Most businesses run into the same obstacles when attempting certification alone. We remove that complexity and guide you through the process step by step.
Many businesses don't know which controls they already meet. Our gap analysis gives you a clear picture from day one.
Incorrect answers and misconfigured systems are the most common reasons businesses fail. We prepare you thoroughly before submission.
Time pressure from upcoming bids is stressful. We work to your timeline, prioritising what matters most to get you certified in time.
Poor M365 and email security settings are a frequent failure point. We know exactly what assessors look for and configure it correctly.
Lack of documented security policies is a common stumbling block. We help you create the documentation you need to satisfy the assessment.
Certification lapses without ongoing management. We track renewal dates and keep your controls up to date throughout the year.
Cyber Essentials is the right choice for a broad range of UK businesses.
Businesses handling sensitive customer or employee data that need to demonstrate responsible data security.
Companies bidding for government contracts or private sector tenders where Cyber Essentials is a stated requirement.
Organisations that want to proactively reduce their cyber risk exposure rather than wait for an incident.
SMEs that need a practical, cost-effective starting point for building a credible cybersecurity posture.
The timeline depends on your current setup. For businesses with relatively few gaps, certification can be achieved in a few weeks. Where significant remediation is required, it may take 4-8 weeks. We'll give you a realistic estimate after the initial assessment.
The certification body fee for Cyber Essentials is set nationally and varies by organisation size. On top of this, our support fee covers the gap analysis, remediation work, and guided submission. Contact us for a tailored quote based on your environment.
Cyber Essentials is a self-assessment questionnaire verified by a certification body. Cyber Essentials Plus includes all of this plus an independent technical audit and hands-on testing of your systems. Plus provides a higher level of assurance and is suited to organisations in regulated industries or those handling particularly sensitive data.
Yes. Cyber Essentials certification is valid for 12 months and must be renewed annually. We manage this process for our clients, tracking renewal dates and ensuring controls stay current throughout the year.
Yes. We regularly support clients who need to achieve certification within a short window for an upcoming bid or tender. We triage the most critical gaps first and work to your deadline. Contact us as early as possible so we can assess what's achievable in your timeframe.
Yes. Cloud services used by your organisation are in scope for Cyber Essentials. This includes Microsoft 365, email platforms, and other SaaS tools. Correct configuration of these services is one of the most common areas where businesses need support, and it's something we specialise in.