In short: The NCSC Cyber Advisor scheme assures individuals who give small and medium-sized organisations affordable, hands-on help to implement the Cyber Essentials technical controls. Each Assured Cyber Advisor is independently assessed and must work for an Assured Service Provider registered with IASME, which itself must hold Cyber Essentials.
What a Cyber Advisor does
Many small organisations know they should improve their security but do not know where to start, and cannot justify a large consultancy engagement. The NCSC created the Cyber Advisor scheme to give them a trustworthy source of practical help.
A Cyber Advisor gives general cyber security advice and, importantly, hands-on support focused on putting the five Cyber Essentials controls in place: firewalls, secure configuration, security update management, user access control and malware protection. Using a Cyber Advisor does not by itself give you a certificate, but it can make the path to Cyber Essentials certification much smoother.
Read the NCSC's own description on the Cyber Advisor scheme page.
How advisors and providers are assured
The scheme has two layers:
| Role | What is required |
|---|---|
| Assured Cyber Advisor | An individual independently assessed on knowledge of the Cyber Essentials technical controls, practical competence in hands-on support, and the ability to work with small and medium-sized organisations |
| Assured Service Provider | The company the advisor works for. It must meet NCSC standards, be registered with IASME, hold a valid Cyber Essentials certificate and employ at least one assessed Cyber Advisor |
IASME, the NCSC's Cyber Essentials Delivery Partner, publishes the requirements for Assured Service Providers. Because every provider must hold Cyber Essentials itself, you know the business advising you has met the same baseline it is helping you reach.
Who the scheme is for
The scheme is designed for small and medium-sized organisations across the UK that want to strengthen their basic security: small businesses, charities, schools and similar organisations with fairly simple IT.
It is not intended for organisations with complex requirements or those in nationally critical sectors. The NCSC points those organisations to its Assured Cyber Security Consultancy scheme instead, which covers more specialist and higher-risk work.
| Cyber Advisor | Assured Cyber Security Consultancy | |
|---|---|---|
| Typical client | Small and medium-sized organisations | Organisations with complex needs or in nationally critical sectors |
| Focus | Implementing the Cyber Essentials controls | Broader, more specialist cyber security consultancy |
How to find a Cyber Advisor
- Decide what you need: general advice, hands-on help with the controls, or preparation for a Cyber Essentials assessment.
- Start from the NCSC's Cyber Advisor scheme page, which links to IASME's Cyber Advisor information, and confirm that the provider is a current Assured Service Provider.
- Check the provider's own Cyber Essentials certificate using IASME's certificate search.
- Ask who your named Assured Cyber Advisor will be and what support is included before you agree the work.
Small and medium-sized organisations can also book a free, no-obligation 30-minute consultation with an NCSC-assured Cyber Advisor through IASME, focused on the Cyber Essentials controls. Offers like this can change, so check the current terms before you book. Our page on funded Cyber Essentials lists other free help, such as the IASME Readiness Tool and the NCSC Cyber Action Toolkit.
Where Forever Systems fits
To be clear: Forever Systems is not part of the Cyber Advisor scheme, is not an Assured Service Provider and does not employ Assured Cyber Advisors. If you specifically want an assured advisor, use IASME's listings.
What we offer is Cyber Essentials and Cyber Essentials Plus preparation: a gap analysis, remediation of the technical gaps, and support through assessment alongside an IASME-licensed Certification Body. Some organisations use free help first and then come to us for the remediation work. Either way, contact us if you would like to talk about your options.
How Forever Systems helps you get certified
Most organisations fail Cyber Essentials for the same handful of reasons: unsupported operating systems left in scope, missing multi-factor authentication on cloud services, default passwords on routers and firewalls, and security updates that sit for longer than the 14 days the scheme allows. We find those gaps before an assessor does, then help you fix them.
- Readiness review and gap analysis of your devices, cloud services, firewalls and user accounts against the current question set
- Remediation: patching, configuration hardening, MFA roll-out, firewall changes and device management with tools such as Microsoft Intune
- Support through assessment with an IASME-licensed certification body, for both Cyber Essentials and Cyber Essentials Plus
- Supply chain and sector requirements: help when a customer, a public-sector contract or a framework asks for certification as a condition of working with them
- Staying compliant all year, so renewal is a formality rather than a scramble
Forever Systems Ltd is an IT and cyber security provider. We prepare you for certification and work alongside a licensed certification body, which carries out the assessment and issues the certificate.
Want to know how close you are to passing Cyber Essentials?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is an NCSC Assured Cyber Advisor?
An individual who has been independently assessed on their knowledge of the Cyber Essentials controls, their practical competence and their ability to work with small organisations. They must work for an Assured Service Provider.
Is a Cyber Advisor the same as a Cyber Essentials assessor?
No. A Cyber Advisor helps you put the controls in place. An assessor at an IASME-licensed Certification Body marks your self-assessment or carries out Cyber Essentials Plus testing and decides whether to issue a certificate.
Do Cyber Advisor providers need Cyber Essentials?
Yes. An Assured Service Provider must hold a valid Cyber Essentials certificate and be registered with IASME.
Who should use the Assured Cyber Security Consultancy scheme instead?
Organisations with complex security needs or in nationally critical sectors. The Cyber Advisor scheme is designed for small and medium-sized organisations with basic security needs.
Is Cyber Advisor help free?
Assured Service Providers are commercial businesses, so ongoing work is normally paid for. Small and medium-sized organisations can book a free, no-obligation 30-minute consultation with a Cyber Advisor through IASME; check the current terms before booking.