Cyber Essentials
Need Cyber Essentials to win a contract? We help you pass first time.
Expert-led consultancy, gap analysis and flexible packages from an official Certification Body, for Cyber Essentials or Cyber Essentials Plus.
✔ Official Cyber Essentials Certification Body
✔ NCSC-certified assessors
✔ Free retest in every package
Prefer to talk? Call 0330 311 0990
Sound familiar?
A tender or government contract asks for Cyber Essentials
→ Certification is often mandatory for public-sector work. We get you certified with expert-led consultancy.
You don’t know if you’d pass today
→ We run a gap analysis and give remediation advice to help you pass the first time.
You have no written security policies
→ Premium packages include tailored policy documents, such as password and access control policies.
You’re worried about failing and paying twice
→ Every package includes a free retest, and premium packages include two.
You run old systems you can’t upgrade yet
→ We advise on removing out-of-support systems from scope by isolating them on a segregated subset.
A customer wants more than a self-assessment
→ Cyber Essentials Plus adds an independent technical audit that verifies every claim you make.
Why WorkNest for Cyber Essentials?
Why WorkNest for Cyber Essentials?
Why WorkNest for Cyber Essentials?
Official Certification Body
We know exactly what it takes to get you certified.NCSC-certified assessors
Expert guidance throughout certification.Tailored advice
Personalised to your needs, challenges and goals.End-to-end support
Consultancy, gap analysis and remediation advice to help you pass the first time.
Official Certification Body
We know exactly what it takes to get you certified.NCSC-certified assessors
Expert guidance throughout certification.Tailored advice
Personalised to your needs, challenges and goals.End-to-end support
Consultancy, gap analysis and remediation advice to help you pass the first time.
Choose your package
We’ve always been very impressed with the cyber security services WorkNest provide us. Their professional approach, knowledge and flexibility have ensured they have become a key trusted partner in our supply chain.
”
How it works
Gap analysis: we find what stands between you and the five controls.
Remediation: hands-on advice and remote support to close the gaps.
Assessment: Your questionnaire, or Plus audit, is assessed, with a free retest if needed.
Gap analysis: we find what stands between you and the five controls.
Remediation: hands-on advice and remote support to close the gaps.
Assessment: Your questionnaire, or Plus audit, is assessed, with a free retest if needed.
Call 0330 311 0990 or use the button.
The next step
lorem ipsum dolor sit amet consectetur adipiscing elit possimus voluptas, exercitation sint assumenda sint dolor in fuga cillum excepturi excepturi omnis ipsum aut aut.
Cyber Essentials Plus
An official Cyber Essentials Certification Body takes you from gap analysis to the independent technical…
Penetration testing
Find and fix the weaknesses an attacker would use across your web apps, networks, cloud and mobile, with…
Cyber security FAQs
After completing your Cyber Essentials or Cyber Essentials Plus assessment, you will receive:
An official PDF Cyber Essentials Certificate
A compliance report with all findings and recommendations
High-resolution Cyber Essentials logos and branding guidelines for use on your website and marketing materials
Your organisation will be listed on the Government website, showing your certification level
Our premium packages offer:
Additional free retests - Many organisations need at least one retest, and those with complex IT setups or still building their security posture often require two. Premium packages include up to 2 retests, saving time and money by eliminating the need to repurchase if more attempts are required.
Extended support time - Premium packages include up to 6 hours of expert guidance, ideal for organisations unfamiliar with the process who want extra time to elaborate on points and ask additional questions.
Tailored policy documents - Access pre-written policy templates, such as password and access control policies. These help organisations without existing policies meet Cyber Essentials requirements quickly and confidently, avoiding the time and complexity of drafting from scratch.
Cyber Essentials focuses on fundamental IT controls, whereas ISO 27001 takes a more holistic approach, incorporating policies and procedures. As ISO 27001 is much more involved, you’ll find it easier to obtain Cyber Essentials/Cyber Essentials Plus certification if you’re already ISO 27001 compliant.
We recommend achieving Cyber Essentials certification in addition to ISO 27001 as it demonstrates your commitment to good security practices, and some business/customers may only look for your Cyber Essentials certification, or not understand the difference between Cyber Essentials and ISO 27001.
| ISO 27001 | Cyber Essentials |
|---|---|---|
What is it | An international standard that sets out the requirements of an Information Security Management System to manage information security risk in a systematic way. The standard isn’t mandatory however many contracts/tenders do stipulate it as a requirement. | An NCSC backed UK assurance scheme addressing five technical security controls to help businesses address the most common cyber security vulnerabilities. Cyber Essentials is mandatory for government contracts. |
Risk | ISO 27001 adopts a risk-based approach where organisations set their risk acceptance criteria and risk methodology. This determines how risks are addressed. | Cyber Essentials aims to address the most common vulnerabilities found in organisations. It is not a risk-based approach. |
Recognition | ISO 27001 is an international standard recognised around the world. | Cyber Essentials is a UK based scheme and is not well known worldwide. |
Time to implement | Months | Days – weeks |
Certification process | Certification is provided by a Certification Body. This involves a Stage 1 and Stage 2 audit, and annual surveillance audits. Certification lasts for 3 years, as long as the organisation passes the audits. | Complete a self-assessment questionnaire (or undergo vulnerability scans and a workstation assessment if taking Cyber Essentials Plus) and be assessed by a IASME Cyber Essentials Assessor. Certification must be repeated annually. |
Costs | Med/High | Low |
Scope | Scope is defined by the organisation but the standard encompasses the business and is not just focused on IT. | Focuses on 5 key areas (shown below) and is more IT focused.
|
Applicability | Aimed at all businesses. | Aimed at all businesses, but particularly targets smaller businesses that may have not previously considered cyber security. |
Yes, all questions apply to applicants. Requirements may vary based on whether your organisation is office-based, hybrid or remote. ISP (Internet Service Provider) is not included in the scope. If no in-scope network exists, confirmation of software-based firewall use is required.
Yes, all questions presented in Cyber Essentials are applicable whether you are a single-person company or an organisation with 200+ employees. When answering those questions, consider the “what if?” scenarios.
Yes, you must use separate administrator accounts from standard user accounts, such as when installing software. Using administrator accounts all day exposes the device to malware compromise.
Call 0330 311 0990 or use the button.
