Get Cyber Essentials
certified. Without
the headache.
Cyber Essentials is a UK government-backed certification that shows customers, insurers and tender panels your business takes security seriously. We handle the technical controls, policies and configuration, so you can get certified without it taking over your week. Typically 4 to 6 weeks. Readiness is included in Protect, from £70 per user per month, with no separate project fee. Most of the work is done remotely, and you won’t fill in the questionnaire alone.
Free 20 minute call. We'll tell you if we're not the right fit.
Cyber Essentials
UK government-backed certification. Readiness is included in Protect and Protect & AI.
Our rule: we don’t put clients in for assessment until we’re confident they’ll pass.
Covered by ProtectFour very good reasons
to get certified.
Cyber Essentials isn't just a box-ticking exercise. For most of our clients, it makes a real, practical difference to their business.
Win more contracts
Many government and public sector contracts require Cyber Essentials, and more private sector clients are asking for it too, particularly in construction, finance and professional services. Certified means GDPR and tender ready.
Actual security
This isn't just a certificate for the wall. The five controls, properly implemented, genuinely reduce your risk. Most successful attacks exploit the same basic weaknesses, and Cyber Essentials closes them.
Protect your reputation
A cyber incident doesn't just cost money. It damages the trust you've spent years building. Being certified signals that you take data security seriously, before anything goes wrong.
Cyber insurance
Many insurers now ask about certification for cyber liability policies, and some require it or offer better premiums. Getting certified can reduce your costs and improve the cover available to you.
Five controls.
Plain English explained.
Cyber Essentials is a UK government-backed scheme from the National Cyber Security Centre (NCSC). It is built around five technical controls that stop the most common attacks, such as phishing and ransomware. It is not a guarantee of perfect security, but it is a clear, credible signal that the basics are right, and for many of our clients it opens doors to contracts and tenders.
Firewalls
Boundary firewalls and internet gateways that control what traffic can enter and leave your network. Stops attackers getting in through open doors.
Secure configuration
Making sure devices are configured securely: removing unnecessary software, changing default passwords, disabling features that aren't needed.
User access control
Ensuring people only have access to the data and systems they actually need. Limiting what an attacker can reach if they compromise an account.
Malware protection
Protecting devices against viruses, ransomware and malicious software through up-to-date endpoint protection and safe browsing controls.
Patch management
Keeping software and operating systems up to date. Most successful attacks exploit known vulnerabilities that patches have already fixed, but nobody installed.
From zero to certified.
We handle the hard part.
You don't need to become a security expert. That's what we're here for. Most of the work is done remotely, so it won't disrupt your team. Here's how a typical Cyber Essentials journey looks with ISS.
Gap assessment
We review your current setup against the five controls and give you a clear, honest picture of where you stand and what needs to change.
Technical remediation
We implement the required controls: firewall configuration, Microsoft 365 security, patch management, endpoint protection and access controls.
Policy support
We help you put the right security policies in place: the documented guidance your team needs to maintain good security habits day to day.
Certification & beyond
You won't fill in the questionnaire alone. We work through it with you, then you submit for certification. We then maintain your controls so you stay compliant.
Cyber Essentials readiness
is built in.
Our Protect package is designed around the Cyber Essentials framework. Everything you need to get certified, and stay certified, is included as standard. No add-ons, no extra project quotes.
- Cyber Essentials readiness: controls aligned to NCSC requirements
- Microsoft 365 security configuration
- 24-hour endpoint detection & response
- Cyber Essentials IT policy support
- Network vulnerability scanning
- User security awareness training
- Microsoft 365 identity threat monitoring
Using AI at work? AI tools that staff sign up to on their own sit outside the systems we’ve secured for you. Protect & AI brings AI inside your Cyber Essentials boundary: an agreed AI policy, approved tools managed like the rest of your systems, and unapproved ones found and blocked. That matters if you certify, or if customers ask you to prove how you handle their data. See Protect & AI
“We decided to go with IT Support & Security about 15 years ago and have never regretted our decision. They are extremely competent, friendly, flexible and a fantastic support to our charity.”
Registered charities get 10% off. Supporting Surrey and Sussex businesses since 1992, with a 1 hour response.
Where do you stand on Cyber Essentials?
Ten yes or no questions, two for each of the five controls. The score is worked out in your browser and nothing is sent anywhere. Not sure about an answer? Choose No.
Want the score emailed? Use the quote form and mention Cyber Essentials.
Things people ask
about Cyber Essentials.
A few questions that come up when businesses are considering Cyber Essentials for the first time.
Do I need Cyber Essentials to work with ISS?
No. You don't need to be certified to get support from us. That said, we recommend it for most businesses, particularly if you tender for contracts or handle customer data. Readiness is built into our Protect and Protect & AI packages.
How long does Cyber Essentials take?
The process typically takes 4 to 6 weeks from start to certification, depending on how ready your IT environment is when we begin. We'll do an initial gap assessment so you know what needs fixing before the formal assessment starts.
What's the difference between Cyber Essentials and Cyber Essentials Plus?
Cyber Essentials is a self-assessment verified by an external body. Cyber Essentials Plus involves hands-on technical testing of your systems by an accredited assessor. Plus is more rigorous and is increasingly required for public sector and defence contracts.
Will we definitely pass first time?
We can't guarantee it, because the assessment is independent. What we can do is make sure you're genuinely ready before you submit. We don't put clients in for assessment until we're confident they'll pass.
We're starting to use AI. Does that affect Cyber Essentials?
It can. If staff pick their own AI tools, company data can end up in services nobody has checked or approved. Protect & AI brings AI inside your Cyber Essentials boundary: we find the AI tools in use, approve or block them against an agreed policy, and manage the approved ones like the rest of your systems. Find out about Protect & AI
Will it disrupt the business?
Not much. Most of the work is done remotely, and the changes are the kind your team barely notices: updates applied, admin rights tidied, multi-factor authentication switched on. We agree anything that needs a restart or a visit with you in advance.