In short: Cyber Essentials for MSPs has two sides. The accounts an MSP uses inside a client's systems are in the client's scope, so they must meet the controls, including MFA and separate admin accounts. MSPs also certify their own organisation because customers, public contracts under PPN 014 and the Cyber Advisor scheme expect it.
Angle one: your access is part of your clients' scope
When a client applies for Cyber Essentials, the NCSC requirements put every account the client owns in scope, including accounts used by a managed service provider or contractor. The MSP's own laptops and tools are not in the client's scope, but the access they use is. In practice that means the client must be able to show, for the accounts you use:
- Unique, named accounts. No shared "support" login used by the whole service desk.
- Separate admin accounts used only for admin work, with privileges removed when no longer needed.
- MFA, which is required on every cloud service that offers it. Under the Danzell question set missing MFA on a cloud service fails the whole assessment, and that includes your admin access to the client's Microsoft 365 or Google Workspace tenant.
- Remote administration that meets the firewall rules. Firewall and router admin interfaces must not be reachable from the internet to the internet unless there is a clear, documented business need and they are protected by MFA, or by an IP allow list of trusted addresses combined with properly managed passwords.
- Prompt removal of accounts belonging to engineers who leave.
The client signs the declaration, but much of the evidence sits in your tools. Good MSPs give clients a clear record of how their access is controlled. See Cyber Essentials user access control and Cyber Essentials firewall requirements.
Shared responsibility for patching, malware and cloud
Clients often assume that because "the MSP does patching", the Security Update Management control is covered. The assessment does not care who does the work, only that it is done: critical and high-risk updates within 14 days, unsupported software removed or isolated, and malware protection active on every in-scope device. Under Danzell, late operating system, firmware or application updates are automatic fails.
Write down who is responsible for each control:
| Control | Often done by the MSP | Client still needs to |
|---|---|---|
| Firewalls | Configure and document firewall rules | Approve inbound rules and their business need |
| Secure Configuration | Build standards, remove default accounts | Tell the MSP about new devices and software |
| Security Update Management | Patch deployment and reporting | Retire devices that fall out of support |
| User Access Control | Account creation, MFA policy | Approve joiners and notify leavers promptly |
| Malware Protection | Deploy and monitor endpoint protection | Keep users from disabling it |
For cloud platforms, the NCSC's IaaS, PaaS and SaaS split applies on top of this. User Access Control is always the customer's job, whoever administers it. See cloud services and Cyber Essentials.
Angle two: certifying your own MSP
MSPs increasingly need their own certificate:
- Customers ask. An MSP with privileged access to many organisations is an attractive target, and clients doing supply chain assurance want evidence. Schools and colleges, for example, are prompted by the DfE to ask their IT provider whether it holds Cyber Essentials or Cyber Essentials Plus.
- Public contracts. Under PPN 014, suppliers on in-scope central government and NHS contracts, which include certain ICT services, must show Cyber Essentials or Cyber Essentials Plus before award and renew every year.
- The Cyber Advisor scheme. Organisations registered with IASME as Assured Service Providers under the NCSC Cyber Advisor scheme must hold a valid Cyber Essentials certificate. See the NCSC Cyber Advisor scheme explained.
An MSP's own scope deserves care. Your remote monitoring and management platform, PSA, documentation system and the admin accounts your engineers use into client environments are the crown jewels; keeping them out of scope undermines the point of the certificate. Many MSPs choose Cyber Essentials Plus so the controls are tested, not just declared.
The Cyber Security and Resilience Bill
MSPs should also watch the Cyber Security and Resilience Bill, a government bill amending the NIS Regulations 2018. It would bring medium and large managed service providers into regulation for the first time, alongside data centres and designated critical suppliers, with stronger incident reporting duties and much of the detail left to secondary legislation.
At the time of writing (October 2026) the bill was in its final parliamentary stages and had not received Royal Assent, so the obligations are not yet in force. Check the bill's progress on the UK Parliament website. Cyber Essentials is not the same as NIS compliance, but an MSP that cannot show the five basic controls will struggle with anything more demanding. For the wider picture see UK cyber security frameworks.
How we help MSPs and their clients
Forever Systems works with organisations whose IT is managed by a third party, and with IT providers preparing their own certification. We map who does what for each control, review admin access, MFA and remote management against the current question set, and support the assessment alongside an IASME-licensed Certification Body. We are not a Certification Body and do not issue certificates, and we do not claim to be an Assured Service Provider.
Typical tools in this space include Cisco Duo for MFA on admin and remote access, Sophos Intercept X or Cisco Secure Endpoint for malware protection, and zero trust network access instead of exposed remote admin. Pricing depends on scope, so ask us for a quote. Contact us to discuss your situation.
How Forever Systems helps you get certified
Most organisations fail Cyber Essentials for the same handful of reasons: unsupported operating systems left in scope, missing multi-factor authentication on cloud services, default passwords on routers and firewalls, and security updates that sit for longer than the 14 days the scheme allows. We find those gaps before an assessor does, then help you fix them.
- Readiness review and gap analysis of your devices, cloud services, firewalls and user accounts against the current question set
- Remediation: patching, configuration hardening, MFA roll-out, firewall changes and device management with tools such as Microsoft Intune
- Support through assessment with an IASME-licensed certification body, for both Cyber Essentials and Cyber Essentials Plus
- Supply chain and sector requirements: help when a customer, a public-sector contract or a framework asks for certification as a condition of working with them
- Staying compliant all year, so renewal is a formality rather than a scramble
Forever Systems Ltd is an IT and cyber security provider. We prepare you for certification and work alongside a licensed certification body, which carries out the assessment and issues the certificate.
Want to know how close you are to passing Cyber Essentials?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Are MSP accounts in scope for a client's Cyber Essentials?
Yes. All accounts the client organisation owns are in scope, including those used by a managed service provider or contractor. The MSP's own devices are not in the client's scope, but the accounts and access they use must meet the controls, including MFA and separate admin accounts.
Do MSPs need Cyber Essentials themselves?
It is not a legal requirement, but customers increasingly ask for it, public contracts under PPN 014 can require it, and Assured Service Providers in the NCSC Cyber Advisor scheme must hold a valid certificate.
Who signs the Cyber Essentials declaration if IT is outsourced?
The applying organisation does. A board member or equivalent signs the declaration, and under Danzell accepts responsibility for staying compliant throughout the certification period, even when an MSP does the technical work.
Will the Cyber Security and Resilience Bill regulate MSPs?
It proposes to bring medium and large managed service providers into regulation. In October 2026 the bill had not received Royal Assent, so check bills.parliament.uk for its current status and any secondary legislation.
Should an MSP get Cyber Essentials or Cyber Essentials Plus?
Either is a valid certificate, but because MSPs hold privileged access to many organisations, Cyber Essentials Plus gives clients stronger assurance that the controls have been independently tested.