Guidance for applicants
Guidance for applicants considering or who have already started their journey to certification.
MSPs Hold the Keys: Patching Your Own Systems and Every Client's After PHP2Shell
If you run a managed service provider or IT support business, you are not just another organisation with a website to patch. You hold remote access…
PHP2Shell: Why the Cyber Essentials 14-Day Patching Rule Is a Maximum, Not a Target
On 21 October 2026, the PHP project released emergency fixes for two critical vulnerabilities in PHP itself, the language that sits underneath a…
Cyber Essentials Marking Only vs Supported: Which Service Is Right for You?
If you're working out how to get Cyber Essentials, one of the first decisions you'll make with us is which service to choose: Marking Only or…
Account Separation for Cyber Essentials: Don't Forget Your Cloud Services
A common scenario is where the applicant has done a great job of separating admin and user accounts on their Windows laptops, only to fall down when…
Downloading Your Cyber Essentials Logo: How to Add It to Your Email Signature and Website
One of the questions we're asked most often after a client passes is: how do I download the Cyber Essentials logo? It's a fair question. You've…
Duplicate Cyber Essentials Certificates: How to Certify Group Companies and Other Legal Entities
Many organisations hold Cyber Essentials certification on behalf of a group: a parent company and its subsidiaries, or several companies run by the…
Your Guide to Setting Up BlockMark After Cyber Essentials Certification
Once you've achieved Cyber Essentials or Cyber Essentials Plus certification, your digital certificate and badge are issued through BlockMark…
How to Use a Helper for Your Cyber Essentials Self-Assessment
If you're completing your Cyber Essentials or Cyber Assurance self-assessment, you might need assistance. Whether it's an IT provider, a colleague…
Unique Credentials and Shared Admin Accounts: A Common MSP Challenge
If your organisation manages a fleet of client devices, servers, domains, or cloud services, you've likely run into a tension between two Cyber…
Security Update Management: How to Actually Meet the Cyber Essentials 14-Day Patching Rule
If you take one thing from this article, take this: clicking "Update" is not the same as being compliant. Cyber Essentials does not ask whether your…
How to Write and Summarise a Compliant Process for Cyber Essentials
Two of the most common reasons applicants receive a non-compliance finding during a Cyber Essentials assessment are not what most people expect. It…
The April 2026 Cyber Essentials Requirements
If you are reading this today, the April 2026 Cyber Essentials question set is now live. From today — 27 April 2026 — all new Cyber Essentials…
Setting Up User Accounts for Cyber Essentials: A Complete Guide to Account Separation on Windows 11
One of the questions I encounter most frequently during Cyber Essentials assessments is around user accounts — and specifically, whether…
Understanding Network Segregation for Cyber Essentials Certification
By Mark Kindred, Senior Assessor – Get Cyber Certified Estimated reading time: 5 minutes
Asset Management and Cyber Essentials: If You Don't Know What's in Your Estate, How Can You Protect It?
By Mark Kindred, Senior Assessor – Get Cyber Certified Estimated reading time: 5 minutes
Achieving Cyber Essentials Certification: Understanding the Principle of Least Privilege
If your organisation is preparing for a Cyber Essentials Certificate, one of the most important controls to understand is the principle of least…
How to Scope Cyber Essentials
When planning for Cyber Essentials certification, one of the first and most important decisions your organisation must make is establishing the scope…
Understanding Multi-Factor Authentication (MFA) for Cyber Essentials Certification (updated with the April 2026 requirements changes)
Multi-factor authentication (MFA) is a mandatory control within Cyber Essentials when using cloud services. One of the most common reasons…
The Risks of Relying on AI for Your Cyber Essentials Assessment
Cyber Essentials certification helps organisations prove they have basic cybersecurity measures in place. Many businesses see it as a straightforward…
Cyber Essentials and Personal Devices: A Common Misunderstanding Explained
One of the most frequent points of confusion we see from Cyber Essentials applicants relates to personally owned devices or Bring Your Own Device…
Cyber Essentials 2025 Updates: What You Need to Know (kept for reference however outdated).
The Cyber Essentials scheme is designed to help you protect your organisation from common cyber threats. The 2025 updates focus on strengthening…
Saying that you do something isn't the same as describing how it is done.
In the world of Cyber Essentials, it is not enough to simply declare that a security control or process is in place. Saying, for example, “We patch…
Policy vs Process: Understanding the Difference for Cyber Essentials
When preparing for Cyber Essentials assessments, one of the most common pitfalls is confusion between policies and processes. Organisations often…
Need help with your assessment?
Book a free scoping call with an assessor, or answer six quick questions to find the right package.