Resource Hub
Practical Cyber Essentials guidance from our assessors: how to scope, what the requirements mean in practice, and the mistakes we see most often when marking.
Supporting charity clients through Cyber Essentials: five things for MSPs to check in 2026
Charity IT tends to grow piecemeal: donated laptops, free licences, a volunteer who set up the website years ago, and a handful of online platforms…
Your charity's IT is outsourced. Here's what the finance lead should still be asking
In a lot of charities with separate departments, the finance director or finance lead is the main contact for the outsourced IT provider. It makes…
Has your charity's email been caught in a data breach? How to check, and how to switch on MFA
If you're the person at your charity who "looks after the computers", this guide is for you. In about an hour you can find out whether your charity's…
Large Organisations and PHP2Shell: Applying the NCSC's Active Exploitation Timelines
For a large organisation, the hard part of PHP2Shell wasn't applying the update. It was knowing, within hours, every place PHP was running across a…
SMEs After PHP2Shell: Building a Patch Process That Beats the 14-Day Deadline
Most SMEs that hold Cyber Essentials have a patching policy. Fewer have a patching process that would have coped with PHP2Shell, the two critical PHP…
Sole Traders and Micro Businesses: A 10-Minute Check for the PHP Vulnerability
If you run a small business with no IT department, you may have seen headlines about websites going offline this week and wondered whether yours is…
Law Firms and PHP2Shell: Protecting Client Confidentiality When Your Website Is the Weak Point
For most law firms, the website is no longer a brochure. It's where new matters begin: enquiry forms describing a client's situation in detail…
PHP2Shell for IFAs, Brokers and Wealth Managers: Patching Isn't Enough, Rotate Your Secrets Too
Most coverage of PHP2Shell, the two critical PHP vulnerabilities fixed on 21 October 2026, has focused on attackers taking over web servers. For…
Schools, Colleges and Moodle: Responding to the PHP2Shell Vulnerability
Education settings run a surprising amount of PHP. School and trust websites are often built on WordPress, many colleges and schools use Moodle as…
Charity Websites and the PHP Vulnerability: A Plain-English Guide for Trustees and Volunteers
A lot of charity websites have a similar history. A generous volunteer or a small local agency built the site on WordPress a few years ago, it has…
PHP Vulnerability: Five Questions Every Accountancy Practice Should Ask Its Web and Portal Suppliers
Accountants, bookkeepers and payroll bureaus sit on some of the most useful data a criminal can steal: bank details, tax references, payroll records…
MSPs Hold the Keys: Patching Your Own Systems and Every Client's After PHP2Shell
If you run a managed service provider or IT support business, you are not just another organisation with a website to patch. You hold remote access…
PHP2Shell: Why the Cyber Essentials 14-Day Patching Rule Is a Maximum, Not a Target
On 21 October 2026, the PHP project released emergency fixes for two critical vulnerabilities in PHP itself, the language that sits underneath a…
Cyber Essentials Marking Only vs Supported: Which Service Is Right for You?
If you're working out how to get Cyber Essentials, one of the first decisions you'll make with us is which service to choose: Marking Only or…
Account Separation for Cyber Essentials: Don't Forget Your Cloud Services
A common scenario is where the applicant has done a great job of separating admin and user accounts on their Windows laptops, only to fall down when…
Downloading Your Cyber Essentials Logo: How to Add It to Your Email Signature and Website
One of the questions we're asked most often after a client passes is: how do I download the Cyber Essentials logo? It's a fair question. You've…
Duplicate Cyber Essentials Certificates: How to Certify Group Companies and Other Legal Entities
Many organisations hold Cyber Essentials certification on behalf of a group: a parent company and its subsidiaries, or several companies run by the…
Your Guide to Setting Up BlockMark After Cyber Essentials Certification
Once you've achieved Cyber Essentials or Cyber Essentials Plus certification, your digital certificate and badge are issued through BlockMark…
NCSC Wants Your Feedback: Help Shape How Their Website Works
The National Cyber Security Centre (NCSC) is asking for feedback on how people find information on its website — and as a Cyber Essentials…
How to Use a Helper for Your Cyber Essentials Self-Assessment
If you're completing your Cyber Essentials or Cyber Assurance self-assessment, you might need assistance. Whether it's an IT provider, a colleague…
Unique Credentials and Shared Admin Accounts: A Common MSP Challenge
If your organisation manages a fleet of client devices, servers, domains, or cloud services, you've likely run into a tension between two Cyber…
Security Update Management: How to Actually Meet the Cyber Essentials 14-Day Patching Rule
If you take one thing from this article, take this: clicking "Update" is not the same as being compliant. Cyber Essentials does not ask whether your…
Cyber Essentials Certification: Is it a contractual requirement for you?
If you've ever been asked to provide a Cyber Essentials certificate as part of a tender, or if you’re wondering whether your organisation needs one…
How to Write and Summarise a Compliant Process for Cyber Essentials
Two of the most common reasons applicants receive a non-compliance finding during a Cyber Essentials assessment are not what most people expect. It…
Achieving Cyber Essentials as a Sole Trader: A Comprehensive Guide to Compliance and Resources
Cybersecurity is no longer optional for sole traders. With increasing cyber threats targeting small businesses, protecting your digital assets and…
The April 2026 Cyber Essentials Requirements
If you are reading this today, the April 2026 Cyber Essentials question set is now live. From today — 27 April 2026 — all new Cyber Essentials…
Setting Up User Accounts for Cyber Essentials: A Complete Guide to Account Separation on Windows 11
One of the questions I encounter most frequently during Cyber Essentials assessments is around user accounts — and specifically, whether…
Understanding Network Segregation for Cyber Essentials Certification
By Mark Kindred, Senior Assessor – Get Cyber Certified Estimated reading time: 5 minutes
Asset Management and Cyber Essentials: If You Don't Know What's in Your Estate, How Can You Protect It?
By Mark Kindred, Senior Assessor – Get Cyber Certified Estimated reading time: 5 minutes
Cyber Essentials Certification Process: An Overview
Cybersecurity is a top priority for every organisation today. If you want to protect your business from common cyber threats, getting Cyber…
Achieving Cyber Essentials Certification: Understanding the Principle of Least Privilege
If your organisation is preparing for a Cyber Essentials Certificate, one of the most important controls to understand is the principle of least…
New Cyber Essentials Changes Announced for April 2026
The governing body for the Cyber Essentials scheme, IASME Consortium Ltd, has announced important updates to the scheme that will take effect in…
Prepare for Critical Changes in Cyber Essentials. Don't overlook the importance of MFA.
Cybersecurity standards are evolving rapidly to keep pace with new threats. If your organisation is preparing for the Cyber Essentials assessment…
Navigating Cyber Essentials Certification What to Expect from Our Support Process
Achieving Cyber Essentials certification can feel overwhelming, especially if your team is unsure where to start or how to meet the requirements. If…
How to Scope Cyber Essentials
When planning for Cyber Essentials certification, one of the first and most important decisions your organisation must make is establishing the scope…
Cyber Essentials Comparison: Cyber Essentials vs Cyber Essentials Plus Explained
If you want to protect your business from cyber threats and meet government requirements, you’ve probably heard about Cyber Essentials. But what…
Understanding Multi-Factor Authentication (MFA) for Cyber Essentials Certification (updated with the April 2026 requirements changes)
Multi-factor authentication (MFA) is a mandatory control within Cyber Essentials when using cloud services. One of the most common reasons…
The Risks of Relying on AI for Your Cyber Essentials Assessment
Cyber Essentials certification helps organisations prove they have basic cybersecurity measures in place. Many businesses see it as a straightforward…
Cyber Essentials and Personal Devices: A Common Misunderstanding Explained
One of the most frequent points of confusion we see from Cyber Essentials applicants relates to personally owned devices or Bring Your Own Device…
How to Choose a Cyber Essentials Certification Body: A Quick Guide
If you’re looking to achieve Cyber Essentials certification, knowing how to choose a Cyber Essentials certification body or how to select a Cyber…
Cyber Essentials 2025 Updates: What You Need to Know (kept for reference however outdated).
The Cyber Essentials scheme is designed to help you protect your organisation from common cyber threats. The 2025 updates focus on strengthening…
Saying that you do something isn't the same as describing how it is done.
In the world of Cyber Essentials, it is not enough to simply declare that a security control or process is in place. Saying, for example, “We patch…
Policy vs Process: Understanding the Difference for Cyber Essentials
When preparing for Cyber Essentials assessments, one of the most common pitfalls is confusion between policies and processes. Organisations often…
Cyber Assurance vs ISO 27001: Which Path to Certification Fits Your Business?
When it comes to demonstrating your organisation’s cyber resilience, two names often surface — IASME Cyber Assurance and ISO 27001. Both help…
Need help with your assessment?
Book a free scoping call with an assessor, or answer six quick questions to find the right package.