Ready for Cyber Essentials, and the next supplier questionnaire.
More customers and tenders now ask suppliers to prove their security. We get your business ready for Cyber Essentials and keep it ready. An accredited certification body carries out the assessment itself.
Your insurer asking questions too? Read the guide →Sound familiar?
- A tender or framework says suppliers must hold Cyber Essentials
- A big customer sent a security questionnaire and you’re not sure what to put
- You started the self-assessment and stalled on the questions about sign-in and updates
- Your certificate is due for renewal and the rules have changed since last time
What good looks like.
- Ready before the assessment
- The five areas the scheme checks are in place first: firewalls, settings, user access, malware protection and security updates.
- Answers you can stand behind
- Supplier questionnaires answered from how your systems are set up, with evidence to show if a customer asks.
- Ready again next year
- Certificates last a year. Monitoring and updates keep you ready, so renewal is a check, not a scramble.
Why customers are asking.
Among small businesses, 12% now hold Cyber Essentials, up from 5% a year earlier (government breaches survey, April 2026).
41% of large businesses require suppliers to meet a security standard. Central government contracts have used Cyber Essentials as the baseline since February 2025.
Since April 2026, two-step sign-in must be switched on for every cloud service in scope, and urgent updates installed within 14 days.
From questionnaire to certificate.
Your setup is checked against the current requirements, and you get a short list of what would fail and why.
Two-step sign-in everywhere, software that still gets updates, admin accounts tidied and devices protected.
The certification body carries out the assessment. We help you answer the questions and gather the evidence.
Updates, monitoring and a check before each renewal keep you on the right side of the requirements all year.
The services behind it.
- Cyber SecuritySecure email, protected devices and sensible access controls, kept up to date, plus practical training so your team can spot a scam email.
- Monitoring & MaintenanceYour servers, devices and connections are monitored and updated on a schedule, so problems are often caught before you notice them.
- IT SupportCall, email or message and you reach a person who knows your setup. Once you’re working again, the cause gets fixed so it doesn’t come back.
Common questions.
Do you issue the certificate?
No. Only accredited certification bodies can issue certificates. We get you ready, then the certification body carries out the assessment.
What’s the difference between Cyber Essentials and Cyber Essentials Plus?
Cyber Essentials is a self-assessment that the certification body checks. Cyber Essentials Plus adds a hands-on technical audit of your systems. Many contracts ask for the first and some ask for Plus, and the preparation covers either.
Can you guarantee we’ll pass?
No. The certification body makes that decision. Before you apply, you’ll know if anything is likely to fail, so you can fix it first.
Some of our laptops still run Windows 10. Is that a problem?
It can be. The scheme requires software that still gets security updates. Windows 10 only does with Microsoft’s paid extended updates, so replacing those laptops is usually the better plan.
Gotschna took our call in the worst week our business has had and got us back online. Then they rebuilt everything: connectivity, cloud, phones, laptops. The old servers are gone, and so is the downtime.
Emma VidlerDirector, Keylet