Cyber Essentials for financial advisers, brokers and wealth managers
Client portfolios, pension details and mortgage applications are exactly what fraudsters are looking for. Cyber Essentials gives you clear, independently assessed evidence that the basics are covered.
At a glance
- Evidence for networks, platforms and corporate clients
- Scoping help for CRM, platform and e-signature tools
- Honest guidance on where Cyber Essentials stops
Why financial services firms certify
Systems and controls
The FCA expects firms to have systems and controls appropriate to their business, including for cyber risk. Cyber Essentials isn’t an FCA requirement, but it is recognised, independently assessed evidence of the essentials.
Supply chain requests
Networks, providers and corporate clients increasingly ask smaller advisory firms and brokers to hold Cyber Essentials, and sometimes Cyber Essentials Plus.
Fraud prevention
Account takeover and payment diversion rely on weak passwords and missing MFA. The Cyber Essentials controls close off many of the routes fraudsters use.
Where advisory firms commonly trip up
These are the issues we see most often when marking assessments, so you can deal with them before you submit.
- CRM and platform logins. Back-office systems, CRMs and investment platforms are cloud services, so they’re in scope and need MFA enabled for every user where it’s offered.
- Advisers on the move. Laptops and phones used at home or at client meetings must meet the same controls, including supported operating systems and high and critical security updates within 14 days.
- Onboarding and e-signature tools. Document exchange, ID verification and e-signature services hold client data and belong in your scope.
Two ways to get certified
Our Supported Service gives you a plain-English gap analysis before submission, which is useful if a network, platform or client has set you a deadline. Firms with well-managed IT can go straight to Marking Only. Work closely with accountants? See our Accountancy page too.
For confident, well-prepared teams
Ideal if you have in-house expertise and have already checked your setup against the requirements.
- Your own secure assessment portal
- Independent marking with a feedback report
- Two working days to fix any non-compliances, then a complimentary re-mark
- Cyber Essentials report and certificate included
Cyber liability insurance is subject to IASME’s terms. Certifying more than one organisation? Define each additional organisation within your assessment and you’ll automatically be asked whether you’d like a duplicate certificate.
Buy Marking OnlyA senior assessor with you all the way
The right choice for most organisations, and for anyone working to a deadline.
- Your own assigned senior assessor
- Readiness check and gap analysis before anything is submitted
- Feedback within 24 working hours, with same-day assessments available subject to T&C’s
- Unlimited remote support for every question
- As many attempts as you need within the six-month assessment window
- Cyber Essentials report and certificate included
For our Supported Service: 100% of applicants who have followed our advice and who have submitted within the required deadlines have passed. Cyber liability insurance is subject to IASME’s terms. Certifying more than one organisation? Define each additional organisation within your assessment and you’ll automatically be asked whether you’d like a duplicate certificate.
Buy SupportedPrices are “from” prices, exclude VAT and depend on organisation size; your exact price is shown in our shop. Free cyber liability insurance is available to eligible organisations (IASME terms apply).
Guidance for financial services firms
Practical articles from our assessors in the Resource Hub.
“I’ve used Get Cyber Certified for the last 6 years and the service that Mark has provided has always been second to none. Always clear, concise and constructive to help us achieve our certification.”
Greg · Google reviewCommon questions
Does Cyber Essentials satisfy all our FCA obligations?
No. It’s a strong foundation and good evidence for your systems and controls, but wider operational resilience and third-party risk management sit outside its scope. We’ll be clear about that boundary.
Do we need Cyber Essentials Plus?
Usually that’s driven by a specific network, platform or client requirement, so check what’s being asked of you first. If you need it, we deliver Plus with a trusted partner certification body.
More answers in our full FAQs.
Has a network or client set you a deadline?
Talk to an assessor and we’ll help you plan a clean, first-time submission.