Cyber Essentials certification

Cyber Essentials certification for UK businesses

We sell Cyber Essentials certification, and we get you ready for it. We fix the gaps, then arrange your certificate through an independent certification body.

What it is

Cyber Essentials explained

Cyber Essentials is the minimum standard of cyber security the UK Government recommends for organisations of all sizes. It was developed by the National Cyber Security Centre (NCSC) and is delivered by IASME. It is built around five technical controls designed to stop the most common internet-based attacks.

You answer a set of questions about your devices, accounts and settings. A board member or business owner signs them off, and an independent assessor marks them. If you pass, you receive a certificate.

Backed by the UK Government and the NCSC
Independently assessed, not self-declared
Open to any business, from 1 person upwards
Certificates last 12 months and are renewed each year

Get Cyber Essentials certified

Cyber security protection for a UK business

Why it matters

Why businesses get certified

Four reasons customers ask for it, and two reasons it is worth doing anyway.

Required for some contracts

Government and NHS buyers must ask suppliers for Cyber Essentials on certain contracts, such as those that involve personal data. Other customers often ask for it too.

Stops the common attacks

The five controls are designed to prevent the most common internet-based threats, such as phishing, password guessing and unpatched software.

Cyber insurance option

UK businesses with a turnover under £20 million can opt into cyber insurance when they certify. Terms apply, so read them first.

Proof for customers

An independently assessed certificate is easier to show a client than a promise that you take security seriously.

A clear baseline

It gives you a checklist for what good looks like, and shows where MFA, updates or account controls are missing.

Kept up to date

The certificate is renewed every year, so security does not slip once the paperwork is done.

The standard

The five controls you are assessed on

Each control is checked against how your business actually works.

Firewalls

A security filter between the internet and your network, set up properly with no default passwords.

Secure configuration

Computers and devices set up securely, with unused accounts and software removed.

Security updates

Software kept up to date, so criminals cannot use known weaknesses to get in.

User access control

Each person has their own account with only the access they need, and multi-factor authentication where offered.

Malware protection

Anti-malware software on every device, to stop viruses and malicious files before they cause harm.

Cloud services such as Microsoft 365 and Google Workspace are part of the assessment, not just the laptops in your office.

Two levels

Which level do you need?

Most small businesses start with Cyber Essentials. Ask us if a customer has asked for Plus.

LEVEL 1

Cyber Essentials

A verified self-assessment. You answer the questions, a board member or owner signs them off and an assessor marks them.

Covers the same five controls
Independently marked
The right start for most small businesses

LEVEL 2

Cyber Essentials Plus

The same controls, with more rigorous independent technical testing of your devices and cloud services.

Higher level of assurance
Tested by an assessor, not just marked
Often asked for in larger contracts

Who does what

We resell certification and do the work

You deal with one team, and the assessment stays independent.

WE DO

Blackgate Tech

We sell the certification as a service and do the technical work.

Check your devices, accounts and cloud services against the five controls
Fix the gaps, such as MFA, updates and account clean-up
Handle registration and complete the questions with you
Support you through assessment and renewal

THEY DO

The certification body

An independent, IASME-licensed body assesses your answers and issues the certificate. We are not the certification body. You are not billed by them: you receive one invoice, from us.

Marks your assessment independently
Issues the Cyber Essentials certificate
Works to the NCSC standard

How it works

From first call to certificate

Five steps, and the technical work is done by the team that already looks after your IT.

STEP 01

Readiness check

We compare your devices, accounts and settings against the five controls and list what needs fixing.

STEP 02

Fix the gaps

We switch on MFA, patch software, tidy accounts and set up protection, so you meet the requirements.

STEP 03

Register and answer

We arrange your registration and complete the questions with you. A director or owner signs them off.

STEP 04

Independent assessment

An assessor at the certification body marks your answers. If something needs changing, we help you fix it.

STEP 05

Certificate and renewal

You receive your certificate. We remind you before it expires so renewal is not missed.

Questions

Common questions

What is Cyber Essentials?

Cyber Essentials is a UK Government-backed certification built around five technical controls. It shows that a business has the basic protections in place against common online attacks.

Is Blackgate Tech the certification body?

No. We resell Cyber Essentials certification. An independent, IASME-licensed certification body assesses your answers and issues the certificate. We get you ready, fix the gaps and manage the process for you. You pay only Blackgate Tech. The certification body does not bill you separately.

What is the difference between Cyber Essentials and Plus?

Both cover the same five controls. Cyber Essentials is a verified self-assessment. Plus adds more rigorous independent technical testing and gives a higher level of assurance.

Do we need it to work with government or the NHS?

For certain contracts, such as those involving personal data, central government departments and NHS bodies must require it from suppliers. Check the tender to see what applies to you.

Will we pass first time?

We check your setup and fix gaps before you submit, which gives you the best chance. An independent assessor does the marking, so we cannot promise a result.

Do Microsoft 365 and other cloud services count?

Yes. Cloud services are part of the assessment, so accounts, MFA and sharing settings in Microsoft 365 or Google Workspace are checked as well as your devices.

Useful for healthcare clinics, law firms, accountants, recruiters, estate agents and hospitality businesses.

Sources: NCSC Cyber Essentials · Procurement Policy Note 09/23 · IASME

Talk to us about Cyber Essentials

Book a free 15-minute call. We will explain what certification involves for your business.

Book a free 15-minute call