How Cyber Essentials works
You complete an online questionnaire covering your organisation, the scope of the assessment, and each of the five technical controls. A board-level or equivalent person signs it off as accurate. An assessor at an IASME-licensed certification body then reviews your answers and either certifies you or explains what needs to change.
Answers must describe what is true today, not what you plan to do. Saying a control is in place when it is not can invalidate your certificate, so we check the reality first.
Getting the scope right
Scope is where many applications go wrong. In general, every device that can access organisational data or services is in scope, including laptops, desktops, servers, mobiles and tablets, cloud services such as Microsoft 365, and user-owned devices used for work.
Anything running software that no longer receives security updates must be removed, replaced, or isolated in a separately defined sub-set. Our requirements guide explains the detail.
Common reasons for failing
- Windows, macOS or phone operating systems that are out of vendor support
- Cloud services without multi-factor authentication switched on
- Default or weak admin passwords on routers and firewalls
- High or critical updates not applied within 14 days of release
- Users working day-to-day with administrator accounts
When you are ready to go further, Cyber Essentials Plus adds independent technical verification.
How Forever Systems helps you get certified
Most organisations fail Cyber Essentials for the same handful of reasons: unsupported operating systems left in scope, missing multi-factor authentication on cloud services, default passwords on routers, and patches that sit for weeks. We find those gaps before an assessor does.
- Readiness review of your devices, cloud services, firewalls and user accounts against the current question set
- Remediation: patching, configuration hardening, MFA roll-out, firewall changes and device management with tools such as Microsoft Intune
- Support through assessment with an IASME-licensed certification body, for both Cyber Essentials and Cyber Essentials Plus
- Staying compliant all year, so renewal is a formality rather than a scramble
Forever Systems Ltd is an IT and cyber security provider; we prepare you for certification and work alongside a licensed certification body, which issues the certificate.
Want to know how close you are to passing?
Talk to Forever Systems on 0333 358 3808 or send us an enquiry and we will come back to you with options, not a hard sell.
Call 0333 358 3808Send an enquiryFrequently asked questions
How long is Cyber Essentials valid?
A certificate reflects your position at the time of assessment. It is generally treated as valid for 12 months, and you should renew each year to keep it current.
Can a small business pass Cyber Essentials?
Yes. The scheme was designed with small organisations in mind. Many sole traders and small teams pass once they have tidied up patching, passwords and MFA.
Are BYOD phones in scope?
User-owned devices that access organisational data or services are generally in scope. Devices used only for calls and texts, or for MFA apps, are treated differently. We help you define scope correctly.