Cyber Essentials support — outsourced certification help and technical fixes

Cyber Essentials support helps SMEs prepare for and pass the NCSC’s two certification levels (Cyber Essentials and Cyber Essentials Plus) NCSC Cyber Essentials, by running vulnerability scans, preparing policy evidence and fixing straightforward technical gaps.

Many small firms attempt self-certification and trip up on evidence: missing multi-factor authentication records, incomplete patch logs or untested backups are common problems. That slows certification, weakens security and wastes staff time when external assessors ask for proof.

Read this to decide whether to fix the few technical items in-house or buy short-term Cyber Essentials support that delivers certification and reduces future incident risk.

Prepare the essentials yourself — a focused 7-point technical plan

If you want to save cash by doing the work yourself, take a tight, task-driven approach. Focus only on the items the assessor will check: user access, patching, malware defences, secure configuration, boundary firewalls and backups. Start with multi-factor authentication (MFA) and patching — these appear in almost every assessment query and are quick wins.

Confirm MFA is enforced for all remote access and privileged accounts.
Run and document a device inventory, noting OS versions and patch status.
Apply critical patches and capture screenshots or export update reports as evidence.
Verify antivirus/endpoint protection is centrally managed and listed in your policy.
Check firewall rules are in place and log a configuration export.
Test backups by restoring one file and record the restore time and result.
Create simple policy documents: acceptable use, access control and incident reporting.

Keep records in a single folder (PDFs and screenshots). When the assessor asks for evidence, having timestamped exports and a short narrative of each control speeds approval.

Buy the right Cyber Essentials support — scope, timings and common price drivers

When outsourcing, ask potential suppliers to show a scoped plan with deliverables and timings. A solid support package should cover: an initial scan, a gap list, remediation work (or clear handover steps), policy templates and the application submission. Avoid suppliers who only run a scan and leave remediation to you without clear estimates.

Good questions to ask suppliers include:

Which remediation tasks are included in the fixed price, and which are billed hourly?
Will they supply documented evidence (screenshots, logs and signed policy templates)?
How do they handle network segmentation or legacy kit that can’t be patched?
What guarantee do they provide around passing the certifier’s review?

Expect the support engagement to be outcome-focused: the supplier should own the application packaging and liaise with the certification body, so your internal team can keep working. If you prefer a quick reference on service levels and examples of deliverables, see our Cyber Essentials support page which explains common scopes and what a finished evidence pack looks like.

If your estate has bespoke systems, legacy servers or in-house line-of-business applications, budget for one or two days of hands-on remediation by an engineer; many suppliers price those as an add-on. In contrast, purely cloud-based organisations often need only policy drafting and a scan.

Final practical choices: if you have a technically confident staff member who can gather evidence with a checklist, self-help is cheaper; if your IT time is scarce, buy a scoped support package that guarantees the evidence pack and application submission. That trade-off saves time, reduces risk of assessor rework and protects reputation with customers.

FAQ

How many Cyber Essentials levels are there in the UK?

There are two levels: Cyber Essentials and Cyber Essentials Plus; the programme is administered by the NCSC.

What does Cyber Essentials support typically include?

Typical support includes an initial vulnerability scan, a remediation plan, policy templates, evidence-gathering and the completed application submission to the certifier.

How long does a typical support engagement take?

Most scoped support projects aimed at small organisations run between a few days and three weeks, depending on the number of devices and the need for hands-on fixes.

Will good Cyber Essentials support reduce future incident recovery time?

Yes. Practical fixes like enforced MFA, centralised patching and tested backups reduce the scale of incidents and shorten recovery windows, typically saving days during a ransomware or compromise event.