Project Assess & assure
Cyber Essentials and IASME certification
If a customer or tender is asking for Cyber Essentials, you need it on a deadline. We take you from scoping to certificate and fix what would fail along the way.
- Schemes
- CE · CE+ · IASMEone team for all of them
- Certificate
- 12 monthsthen renew against the current requirements
- Readiness
- [x] weekstypical time from kick-off to submission
- Certified
- [x]organisations we've taken through
01 / The problem
The tender says Cyber Essentials. The deadline is next month.
A contract depends on it
Central government and many larger buyers ask for Cyber Essentials before they'll sign. Without it, you can't bid.
The questions are harder than they look
The question set covers every device, cloud service and admin account in scope. One unsupported laptop or missing update can mean a fail.
Plus means proof
Cyber Essentials Plus adds a hands-on technical audit. Saying a control is in place isn't enough; the assessor tests it.
02 / What’s included
From scoping to certificate.
Scoping
We agree what's in scope: devices, users, networks and cloud services. Getting this right first avoids surprises later.
Readiness check
We test your setup against the five Cyber Essentials controls and list what would fail today.
Remediation
Patching, configuration, MFA (multi-factor authentication), removing unsupported software. We help your team, or we do it for you.
Question set support
We help you answer the self-assessment accurately, with evidence ready for each answer.
Cyber Essentials Plus
Preparation for the technical audit, including a pre-test of the kind of device sample the assessor will check.
IASME Cyber Assurance
For organisations that need more than technical controls: governance, risk, data protection and incident response. Level 2 adds an independent audit.
[Placeholder: offer for this service, written by ITB]
03 / How it works
Four steps to a certificate.
- Scope We agree the boundary and which scheme you need: CE, CE+ or IASME Cyber Assurance.
- Check and fix A readiness check against the controls, then we close the gaps that would fail.
- Submit You complete the question set with our help. Our certification body partner reviews and signs it off.
- Certify and renew Certificate issued, CE+ audit booked if you need it, and renewal planned for twelve months' time.
Cyber Essentials isn't paperwork. Done properly, it closes the doors everyday attacks walk through.
ITB on Cyber Essentials
04 / Why ITB
Certify once. Stay certified.
Most fails come from small things: an unsupported laptop, an admin account without MFA, a missed update. Because we also manage endpoints, patching and firewalls, we can fix those, and keep them fixed for renewal. We prepare you and work with a licensed certification body partner for the sign-off, so it's one process from your side.
| What it takes | Do it yourself | With ITB |
|---|---|---|
| Understanding the question set | Read the requirements and guidance | Each question explained in plain English |
| Finding what would fail | Found at assessment | Found and fixed beforehand |
| Fixing the gaps | Your IT team, alongside the day job | Done with you, or for you |
| CE+ technical audit | Hope the sampled devices pass | Pre-tested before the assessor arrives |
| Annual renewal | Remember, then start again | Planned, with a refresh check |
· 05 / Questions
Cyber Essentials, plainly answered.
Q01 What's the difference between Cyber Essentials and Cyber Essentials Plus?
Cyber Essentials is a self-assessment: you answer a question set and a certification body reviews it. Cyber Essentials Plus covers the same controls, but an assessor tests your systems, including a sample of devices. You need Cyber Essentials first, and the Plus audit follows within a set window.
Q02 What does Cyber Essentials cover?
Five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. They apply to the devices, servers, networks and cloud services in scope.
Q03 How long does a certificate last?
Twelve months. Most contracts expect it to stay current, so plan the renewal before it lapses. The requirements are updated from time to time, so each renewal is checked against the current version.
Q04 What is IASME Cyber Assurance?
A scheme for organisations that need assurance beyond the technical controls. It covers governance, risk management, data protection and incident response. Level 1 is a verified self-assessment; Level 2 adds an audit by an independent assessor.
Q05 Do we need Cyber Essentials?
If you bid for central government contracts that handle certain kinds of information, usually yes. Many private-sector buyers ask for it in their supply chain too. Even without a requirement, it's a sensible baseline.
Related services
Security Assessments & Consulting
When you need a wider view than five controls.
See the serviceCompliance: ISO 27001 & CAF
The next step when customers ask for more than Cyber Essentials.
See the serviceVulnerability & Critical Patch Management
Keeps the update control passing between renewals.
See the serviceEDR / XDR / MDR
Malware protection that goes well past the minimum.
See the service· [Placeholder]
[Placeholder] [Placeholder]
[Placeholder: written by ITB]