Cyber Essentials Certification is the UK government-backed security standard that more of your clients, insurers and tenders now insist on. We get businesses in Edinburgh and east central Scotland ready for it. First we fix what would fail you, then we manage the assessment through to the certificate.
Why you are being asked for it
Most businesses do not come to us because they woke up wanting a security certificate. Instead, they come because somebody else has made it a condition of doing business.
- A tender or framework you want to bid for lists it as a requirement, and the deadline is closer than you would like
- A larger client has sent a supplier security questionnaire and Cyber Essentials is the quickest honest answer to half of it
- Your insurer has asked what controls you have in place, or has quoted a premium that assumes the worst
- Your own board or partners have decided that hoping for the best is no longer a security policy
Whichever of those brought you here, the useful thing to know is that the certificate is the easy part. However, the work is getting your systems into a state that passes, and that is the part we do.
What changed in April 2026, and why it matters to you now
Cyber Essentials moved to version 3.3, known as the Danzell question set, in April 2026. Perhaps your last experience of the scheme was two or three years ago. Or perhaps somebody told you it is a box-ticking exercise. Either way, that advice is now out of date. Three things now fail an assessment outright, and you cannot argue the point.
- Multi-factor authentication is now mandatory on every cloud service that offers it. Not recommended, not where convenient. If a service supports MFA and you have not enforced it at account level, the assessment fails. That applies even where MFA needs a higher licence tier. As a result, it catches a lot of businesses on entry-level Microsoft 365 plans.
- High-risk and critical updates to operating systems and firewall firmware must be applied within 14 days of release. In other words, miss that window and it is an automatic fail, not a point deduction.
- The same 14-day rule now applies to applications. Browsers, Office, PDF readers, the line-of-business package nobody has updated since it was installed.
Two further changes are worth knowing before you start. First, you can no longer leave cloud services out of scope on the grounds that the provider looks after security. You have to declare every service you use, and the assessment covers each one. Second, once Cyber Essentials Plus testing begins, your answers lock. You cannot quietly fix a problem the tester has just found. For that reason alone, it pays to do the preparation properly rather than submit hopefully and see what happens.
The five controls, in plain English
The whole standard rests on five technical controls. None of them is exotic. The difficulty is almost never understanding the question. Instead, it is proving the answer holds for every device and every account in your business.
Firewalls
Your internet connection and your devices have to block traffic that has no business reaching them. You also need to change the default administrative password on your router or firewall to something strong.
Secure configuration
Devices and services set up deliberately rather than left as they came out of the box: unnecessary accounts and software removed, auto-run restricted, and screen locks in place.
Security update management
Everything in scope is supported by its manufacturer and patched inside 14 days for anything high-risk or critical. This is where out-of-support software bites, because you cannot patch what the vendor has stopped fixing.
User access control
People have the access their job needs and no more. Everyday accounts stay separate from administrative ones, you remove leavers promptly, and MFA protects cloud services.
Malware protection
Every in-scope device is protected, kept current, and configured to act rather than to ask.
What actually fails people first time
We have taken enough businesses through this to know where it goes wrong, and it is the same four things almost every time. Three of them now carry the auto-fail rules described above, which is why first-time pass rates have become less forgiving.
Software or Windows that is out of support
Usually a handful of machines rather than the whole estate, and often a single old laptop somebody keeps for one application. It is the most expensive problem to solve because it normally means buying hardware, and it is the reason we look at this first rather than last.
MFA missing somewhere in the cloud
Rarely on the main email accounts, which most people have sorted. Instead, it is the forgotten ones: the shared mailbox, the old administrator account, the accounts package, the file-sharing service somebody signed up for in 2021. Under the current rules, one of those is enough to fail the whole assessment.
Administrator accounts used for everyday work
Someone reading email and browsing the web from an account with the rights to change anything. Common, understandable, and not permitted. Separating the two is quick once somebody decides to do it.
No patching process that can be evidenced
Updates may well be happening. However, the question is whether you can show that critical ones land within 14 days across every device, and most businesses without managed patching cannot. In fact, this is the one that quietly converts into an auto-fail.
Not sure where to start?
Book a free IT audit. We will tell you what is working, what is at risk and what to fix first.
Cyber Essentials Certification: Basic or Plus?
Cyber Essentials is a self-assessment that a licensed Certification Body verifies. Cyber Essentials Plus covers the same five controls, then proves them: a technical assessor samples your devices, scans for vulnerabilities and tests your malware protection by hand.
Most businesses start with the basic certification. You need Plus when a client or a framework specifically demands it, and increasingly they do. We take clients through both. Once Plus testing starts, your answers lock, so Plus is unforgiving of anything left unfinished. That is why we would rather find the problems ourselves first.
What Cyber Essentials Certification costs
For a typical 20-person office, expect £1,500 to £2,500 all in for basic certification. That covers the certification body’s fee, our preparation work, and fixing what would otherwise fail you. We quote Cyber Essentials Plus separately. The cost depends on how many devices the assessor needs to sample and what that sampling turns up.
It is worth understanding what you are comparing when you see a lower figure advertised. The certification fee is a published amount paid to IASME: around £440 plus VAT for an organisation of 10 to 49 people. That fee is the same whoever helps you with the paperwork. So an offer priced near that number is assessment support: somebody helps you fill in and submit the questionnaire. However, that support does not include rolling out MFA, replacing an unsupported machine or putting a patching process in place. That is where the actual time and cost sit.
We quote for getting you to a state that passes, because submitting an assessment you are going to fail is not a saving.
Certification lasts 12 months, so you need to renew it each year. Certify the whole business with a turnover under £20 million and you usually qualify for the scheme’s included cyber liability insurance. It is worth checking that cover against what you currently pay.
How long Cyber Essentials Certification takes
Four to six weeks from first conversation to certificate, for a 20-person office. Our own work, however, takes days. The calendar time goes on remediation, on ordering anything that needs replacing, and on your people being available for the parts that need them.
It can be quicker. We took a 20-user civil engineering company from first engagement to certification in four weeks. Working to a tender deadline? Tell us the date at the start. Then we will tell you honestly whether it is achievable, rather than you finding out in week five.
What we do
- Gap assessment. We check the current question set against what you actually have. That includes the cloud services you can no longer leave out of scope. Then we tell you where you stand.
- A plan with a price. What needs fixing, what it costs, what you can keep, and anything that needs buying. Agreed before the work starts.
- Remediation. MFA enforced everywhere it is available, administrative accounts separated, patching brought inside 14 days with evidence behind it, devices configured and protected, unsupported software dealt with.
- Assessment. We complete the questionnaire with you, in your words, and manage it through the Certification Body to the certificate.
- Keeping it. Certification is annual, and the standard moves. Our support clients stay certified rather than rediscovering the problem each year. We have a 35-user market research firm in Edinburgh we have kept certified over several years.
Cyber Essentials: frequently asked questions
Do you issue the certificate yourselves?
No, and you should be wary of anyone who says they do. Certification Bodies licensed by IASME issue the certificates. IASME runs the scheme on behalf of the National Cyber Security Centre. We get you ready, complete the assessment with you and manage it through to certification. In fact, keeping those roles separate is how the standard is meant to work.
What happens if we fail Cyber Essentials Certification?
With basic certification, you usually get a short window to fix what the assessor flagged and resubmit. So a first attempt that falls short is not the end of it. Cyber Essentials Plus is stricter: once testing begins your answers are locked and you cannot remediate mid-assessment. That is exactly why we would rather find the problems during the gap assessment than have an assessor find them.
Does it have to be renewed?
Yes. Certification is valid for 12 months. The question set also changes periodically, as it did in April 2026, so renewal is not always a formality. If your systems have drifted or the requirements have tightened, there is work to do again. That is the main reason clients ask us to look after it rather than handle it themselves each year.
Can we keep our existing IT provider and still use you for this?
Yes. Some clients bring us in specifically for certification while somebody else handles day-to-day support. It works best when your provider is willing to make the changes we identify. If we think that will be a problem, we will tell you early.
We have fewer than ten staff. Is it still worth it?
Yes, if someone is asking you for it, and the certification fee is lower for organisations under ten people. Even if nobody is asking, the five controls are still the right things to have in place, and you can put them in place without certifying. We will say so if that is the honest answer for your situation.
Will MFA everywhere make life harder for our staff?
Less than people expect, if it is set up properly. Done badly, however, it means everyone typing codes all day. Done well, trusted devices in the office rarely see a prompt, and the friction lands where the risk is. The scheme now explicitly accepts hardware keys and passwordless sign-in. For some businesses, these are easier than an app on a phone.