Cyber Essentials, ready in two weeks.
A sprint, quoted up front, that takes you from where you are to certification-ready against the five Cyber Essentials controls, with the fixes made, the evidence gathered and the questionnaire completed together. The certificate itself is issued by an accredited certification body.
- Gap assessment
- Remediation plan
- Fixes begin
- Evidence gathered
- Questionnaire
- Readiness sign-off
2 of 3 complete
- A1FirewallsYesterday3 filesPass
- A2Secure configurationYesterday4 filesPass
- A3Security update management2m ago2 filesFixed in sprint
- A4User access control18m ago3 filesMFA enforced
- A5Malware protection3 days ago2 filesPass
Priced per engagement, certification body fee separate, fixed quote agreed up front
At a glance
Gap assessment against the five controls
We check your devices, accounts, cloud services and home-working setup against every requirement of the scheme and tell you exactly what would fail today, in plain English.Remediation plan and hands-on help
A short, ordered list of what to fix, then we fix it with you: MFA turned on, updates enforced, admin accounts separated, unsupported software retired. Within scope, the fixes are part of the price.Evidence pack and questionnaire, done together
Screenshots, exports and a device list that back up every answer, kept together so you can reuse them next year or when a client asks. Then we complete the self-assessment questionnaire with you, answer by answer, and sign off that you are ready to submit.Everything between where you are and ready to submit.
One quote agreed up front, one fortnight, one outcome: a business that can honestly answer yes to every question on the Cyber Essentials self-assessment.
The sprint runs to a fixed plan so you always know where you are. Most of the work happens in the first week; the second is about evidence, the questionnaire and making sure nothing has been missed.
Most businesses come to us because someone has asked: a client onboarding you as a supplier, an insurer at renewal, a tender that lists it as a condition, or a larger customer tightening its supply chain.
Not sure you are ready for a sprint? Take the free security check or book a one-off assessment to get the full picture first. Once you are certified, a vCISO keeps you that way year on year, and training covers the awareness expectations behind the scheme.
With the sprint, you can:
- Know exactly which of the five controls would fail today
- Get the fixes made with you, within the agreed quote
- Keep an evidence pack you can reuse next year
- Complete the self-assessment questionnaire without guessing
- Submit to your chosen certification body with a written readiness sign-off
- Satisfy the client, insurer or tender that asked for the certificate
What happens, step by step.
- Gap assessment
- Remediation plan
- Fixes begin
- Evidence gathered
- Questionnaire
- Readiness sign-off
2 of 3 complete
- A1FirewallsYesterday3 filesPass
- A2Secure configurationYesterday4 filesPass
- A3Security update management2m ago2 filesFixed in sprint
- A4User access control18m ago3 filesMFA enforced
- A5Malware protection3 days ago2 filesPass
The five controls, and what they mean for you.
Cyber Essentials is a UK government-backed scheme that sets a baseline of five technical controls. Its scope now includes cloud services and home-working devices, multi-factor authentication is mandatory on cloud services, and high-risk security updates must be applied within 14 days, with evidence.
Firewalls
Every device and internet connection sits behind a properly configured firewall, with default passwords changed and no services exposed that do not need to be.Secure configuration
Devices and cloud services set up securely: unnecessary accounts and software removed, auto-run disabled, screen locks and strong authentication in place.Security update management
Supported software only, automatic updates on, and high-risk patches applied within 14 days, with the evidence to show it.User access control
Everyone has their own account with only the access they need, admin accounts are separate, and multi-factor authentication is on for cloud services.Malware protection
Anti-malware on every device in scope, kept current, with unknown applications and untrusted sources blocked.Firms that have been asked for the certificate.
Solicitors
Client confidentiality obligations, panel requirements and lender or corporate clients who now expect Cyber Essentials as standard.Accountants
Client financial data, HMRC and portal access, and professional indemnity insurers who ask for the certificate at renewal.Clinics and practices
Patient records, NHS and commissioner requirements, and a duty of care that makes the five controls a sensible minimum.Anyone in a supply chain
You supply a larger organisation and they have made Cyber Essentials a condition. The sprint gets you ready without derailing the business for months.Quoted up front. No hourly surprises.
What it costs
Priced per engagementcertification body fee separate, fixed quote agreed up frontPriced per engagement, typically two weeks.Included
- Gap assessment against all five controls
- Remediation plan with hands-on fixes within scope
- Evidence pack you can reuse
- Self-assessment questionnaire completed with you
- Written readiness sign-off
Not included
- The certification body's assessment fee, paid to them directly
- The Cyber Essentials Plus technical audit
- Large remediation projects, quoted separately before any work starts
“Every engagement ends with something you can act on, in plain English, at the price we agreed before we started.”
Related services.
Security assessment
An expert, one-off engagement that maps your risks in plain English: what is solid, what is exposed, and what to fix first. Fixed quote agreed before we start.Priced per engagementSafe AI use
Your staff are probably already using ChatGPT, Copilot or Gemini. We find out how, fix the settings that leak data, write simple rules everyone can follow, and show your team what is safe to put in and what is not.Priced per engagementPenetration testing
A CREST-accredited partner tests your external systems, web applications or internal network the way an attacker would. We scope it, manage it and turn the findings into a plan you can act on.Priced per engagement · with a partnerCompliance support
A gap analysis against the framework you are being measured against, right-sized policies and registers, and hands-on support through the audit. Certification is carried out by an accredited certification body.Priced per engagement
Tell us what you need. A person replies, usually the same day.
Or email [email protected].
CE Readiness Sprint, answered
No, and nobody should tell you they can. Certificates are issued by accredited certification bodies. The sprint gets you certification-ready: gaps closed, evidence gathered and the self-assessment questionnaire completed with you, so you are ready to pass when you submit.
No. The certification body charges its own assessment fee, which you pay directly to them. Our quote covers the readiness work only. We will tell you what to expect from the body before you book so there are no surprises.
The sprint prepares you for the standard Cyber Essentials self-assessment. Cyber Essentials Plus adds a hands-on technical audit by the certification body, and that audit is not included. Because Plus tests the same five controls, the sprint is still the right foundation if you plan to go on to it.
Hands-on fixes within the sprint's scope are included. If we find something larger, for example a fleet of unsupported devices or a network that needs redesigning, we tell you straight away and quote it separately. You decide whether to do it now or first, and the sprint price does not change.
Typically two weeks. We need admin access to the systems in scope (or someone who has it), a named person who can answer questions and approve changes, and a little time from whoever manages your devices. The faster fixes are made, the sooner you are ready to submit.