Cyber Essentials, without the headache.
I'm Lewis — I help small businesses across Lancashire and the North West get Cyber Essentials certified and stay certified. I review where you stand, fix what's missing, walk you through the assessment, and pick it back up again at renewal.
Usually it starts with a customer asking.
Most small businesses come to Cyber Essentials because someone else has asked for it. It's worth having for its own sake too.
Customers are asking for it
Cyber Essentials is a UK government-backed scheme created by the National Cyber Security Centre. It is commonly required for public-sector work involving sensitive or personal data — and if you cannot show a certificate, you often cannot bid.
Bigger clients push it down the chain
Larger organisations increasingly ask their suppliers to certify before they will sign. Having it already sorted turns an awkward questionnaire into a one-line answer and gets you onboarded faster.
The controls genuinely help
The five controls are the basics that stop the everyday attacks — phishing, malware, ransomware, stolen passwords. Most businesses find a gap or two they had no idea about, which is rather the point.
What certification actually asks of you.
Cyber Essentials covers five technical control themes. None of them are exotic — they're the things that quietly slip when nobody owns them.
1. Firewalls
Everything that touches the internet sits behind a properly configured firewall, with inbound connections blocked unless you actually need them.
2. Secure configuration
Default passwords changed, unnecessary software and accounts removed, and your devices and cloud services set up so there is less to attack in the first place.
3. User access control
Everyone works from a standard account, admin rights are kept separate and minimal, access goes when people go, and multi-factor authentication is on.
4. Malware protection
Devices are properly protected against malware — usually active anti-malware kept up to date, with dodgy websites blocked while people browse.
5. Security update management
Everything in use is still supported by its vendor, updates are applied promptly, and end-of-life software is removed rather than quietly tolerated.
And then, every year
Certification runs for twelve months. I keep an eye on things through the year and handle the renewal, so it never becomes a last-minute scramble.
From "where do I even start" to certified.
You deal with me from start to finish. The certificate itself is issued by an approved certifying body — I get you ready for it and stay alongside you through the process.
Gap review
I look at what you have and compare it against the five controls, then tell you plainly where you stand and what needs doing.
Scope it properly
We agree what counts — laptops, servers, the office router, cloud services, work phones and any personal devices touching company data.
Fix the gaps
I do the work: multi-factor authentication, device settings, admin accounts, malware protection, updates and anything else the review flagged.
The questionnaire
We go through the self-assessment together so your answers are accurate and you understand what you are signing up to.
Certification
You submit to an approved certifying body and I stay with you through the review and any questions that come back.
Quoted properly, once I know your setup.
- A gap review of your setup against all five controls
- Help agreeing what is in scope — devices, cloud services, phones
- Hands-on fixing of whatever the review turns up
- A walk-through of the self-assessment questionnaire with you
- Support right through submission and any follow-up questions
- Annual renewal support so you stay certified year after year
- Plain-English explanations, no jargon, one person throughout
Every business is a slightly different shape, so I quote once I've seen your setup. The certifying body's own assessment fee is separate and I'll always show it to you plainly — no mark-up hidden in the middle.
Common questions
What actually is Cyber Essentials?+
It is a UK government-backed certification created by the National Cyber Security Centre. It confirms your business has five fundamental security controls in place — firewalls, secure configuration, user access control, malware protection and keeping software updated. It is deliberately practical: the basics, done properly, rather than a huge compliance programme.
What does the assessment involve?+
You complete an online self-assessment questionnaire covering the five controls, and an assessor at a certifying body reviews your answers. I am not a certifying body — my job is to get you genuinely ready, help you answer the questionnaire accurately, and support you through submission. The certificate itself is issued by an approved body.
My business is tiny. Is it still worth it?+
Often yes. I work with businesses of up to about five people and the controls apply just the same — small does not mean out of scope, and attackers are not fussy. It is usually a shorter, simpler job than owners expect, and it settles a lot of customer questions in one go.
What if I do not pass?+
You are told exactly what fell short and you get the chance to put it right. That is the whole reason I start with a gap review rather than diving at the questionnaire — the point is to find the problems while they are still easy and private to fix. I cannot promise an outcome, but surprises are rare when the groundwork is done.
Does it come with cyber insurance?+
Certification under the scheme can include a level of cyber liability insurance for eligible UK organisations, but eligibility and terms are set by the certifying body and can change. I would not treat it as a reason to certify — I will point you at the current terms so you can check whether you qualify.
Find out how close you already are.
Most small businesses are further along than they think. Tell me a bit about your setup and I'll tell you honestly what stands between you and a Cyber Essentials certificate.
Get certifiedStart your Cyber Essentials certification.
Tell me roughly how many people and computers you have, and whether a customer has asked you for certification. I'll come back within one working day with a quote and a straightforward plan. No pressure, no jargon.