Cyber Essentials Consultant — Certified in Days
Need Cyber Essentials for a tender, a customer or your insurer? Gap assessment, fixes applied on Microsoft 365 and your devices, and the self-assessment completed with you — in days.
Cyber Essentials is the UK government-backed baseline and, increasingly, a condition of contracts, frameworks and cyber insurance. Most businesses on Microsoft 365 can pass it with settings they already own. The failures we see are always the same three: MFA not on every account, unsupported devices still in use, and third-party apps not patched within 14 days. We find them, fix them and complete the questionnaire with you.
How the engagement runs
- Day 1 — Gap assessment against the five controls (firewalls, secure configuration, update management, user access control, malware protection) across Microsoft 365, devices and your network boundary
- Days 2–3 — Fixes applied: Intune or Jamf baselines, MFA and Conditional Access, patching rings, admin account separation, unsupported devices identified for replacement
- Day 4 — Self-assessment questionnaire completed with you on the IASME portal, evidence pack assembled, scope statement written so it passes first time
- Cyber Essentials Plus — audit preparation, vulnerability scan remediation and support on the assessor's test day (add-on)
What you get
- A pass, first time, or we keep working until you do
- Devices and Microsoft 365 configured to a documented baseline your IT partner can maintain
- Evidence pack reusable for insurer questionnaires and supplier due diligence
- A renewal checklist so next year takes an afternoon
Frequently asked
Cyber Essentials or Cyber Essentials Plus?
Basic is a self-assessment and satisfies most tenders and insurers. Plus adds an independent technical audit and is required for some public-sector contracts and higher-value insurance. We prepare you for either; Plus is an add-on to the package.
How long does certification take?
The work takes three to four days. The certificate is usually issued within a few days of submitting the questionnaire; Plus audits are scheduled within the three months after.
We use Google Workspace, not Microsoft 365.
That is fine — the controls are the same. Device management is done with Google endpoint management, Jamf or Kandji instead of Intune.
Not sure where your business stands?
Book a free 30-minute call. We will tell you the three things we would fix first — no report to buy, no hard sell.