If a customer, insurer or tender document has asked whether you hold Cyber Essentials, you are not alone. This Cyber Essentials audit guide walks through how the process really works, what is looked at and how to get ready, so the assessment feels like a tidy-up rather than a scramble.
One point first: Cyber Essentials is not a traditional audit where someone inspects your office for days. The basic level is an online questionnaire about how your organisation is set up, which you sign off at director level and a certification body then reviews. The scheme is run by the NCSC, and the rules are updated from time to time, so always check the current official guidance before you start.
Know what is in scope
The assessment covers the devices, software and accounts your business uses to handle company data. That usually means laptops, desktops, phones, tablets, servers, your office network and cloud services such as Microsoft 365.
Deciding the boundary early saves trouble later. Be honest about personal devices used for work and about any old machine still running in the corner, because both can cause problems if left out.
The five areas an assessor looks at
The scheme is built around five technical themes. In plain terms:
- Firewalls and routers. Is there a barrier between your network and the internet, and are the default settings and passwords changed?
- Secure settings. Have you removed software and accounts you do not need, and turned off features that create unnecessary risk?
- User access. Does each person have only the access they need, are admin rights limited, and is a second check such as multi-factor authentication in place where required?
- Malware protection. Are devices protected against malicious software, and is that protection switched on and up to date?
- Security updates. Are operating systems and applications patched promptly, and is unsupported software removed or isolated?
Common reasons businesses stumble
Most delays come from a handful of everyday problems:
- Software that no longer receives updates from its maker.
- Shared accounts or former staff accounts that were never closed.
- Admin rights handed out for convenience.
- Devices that nobody has patched for months because they are rarely switched on.
- Answers given from memory instead of being checked against the real settings.
An incorrect answer can fail the assessment, so it pays to verify rather than assume. If you have a mix of old and new equipment, a quick inventory is a good first step.
Basic or Plus: which level?
The basic level relies on your own answers, reviewed by the certification body. The Plus level adds an independent technical check, in which an assessor tests a sample of your devices and systems to confirm the answers are true.
Plus carries more weight with some buyers, but it needs more preparation. Many businesses start with the basic level, then step up later if their customers expect it. Certification is not permanent, so plan to renew it each year.
How to prepare in a few weeks
- Make a list of every device, user and cloud service.
- Remove anything unsupported, or plan its replacement.
- Apply outstanding updates and set them to install automatically.
- Review who has admin rights and switch on multi-factor authentication.
- Check that your firewall settings and malware protection are in order.
- Answer the questionnaire from evidence, not memory.
Regular health checks help you stay in shape afterwards. Vulnerability scanning can flag missing updates before an assessor does, and staff who know how to spot phishing make your controls far more effective, which is where cyber security training comes in.
Getting support for your assessment
Preparing for certification is much easier with someone who has done it many times. Our Cyber Essentials service helps businesses in Pulborough and across West Sussex prepare, fix gaps and complete the submission properly. If you would like to talk it through, contact us and we will explain what to expect for a business of your size.