Cyber Essentials Certification Support in Hertfordshire, Essex & London

What is Cyber Essentials — and why is everyone asking for it?

Cyber Essentials is the UK government-backed certification scheme, run by the National Cyber Security Centre (NCSC), that verifies your business has five core technical controls in place:

1. Firewalls — a properly configured boundary between your network and the internet

2. Secure configuration — devices and software set up safely, not left on factory defaults

3. Access control — the right people with the right permissions, and nothing more

4. Malware protection — managed defences on every device

5. Security updates — software patched promptly, with nothing unsupported left running

It's not a box-ticking exercise — these five controls stop the large majority of common, untargeted attacks. And increasingly it's a commercial requirement: larger clients, public sector contracts, professional bodies and insurers now ask suppliers to hold it. If you've landed on this page because someone asked you for a certificate, you're in good company.

Two bonuses worth knowing: certified organisations report 92% fewer cyber insurance claims than uncertified ones (NCSC), and UK organisations under £20m turnover that certify their whole organisation receive cyber liability insurance included automatically with certification.

Cyber Essentials vs Cyber Essentials Plus

Cyber Essentials is a verified self-assessment: you answer a detailed questionnaire about your controls, a qualified assessor reviews it, and you certify. It's the entry point, and what most contracts ask for.

Cyber Essentials Plus covers the same five controls but adds an independent hands-on technical audit — an assessor actually tests your systems, scans devices, and checks that what you said in the assessment is true in practice. CE Plus must be taken within a short window after your basic certification, so the two are usually planned as one project.

Which do you need? If a contract or client specifies "Plus", that answers it. If not: Cyber Essentials is the sensible baseline, and CE Plus is worth it when you handle sensitive client data, work in regulated sectors, or want the stronger signal — it's the difference between "we said so" and "it was tested".

We hold both. Pebble IT is certified to Cyber Essentials and Cyber Essentials Plus — we've sat on your side of the audit, which is exactly why we're good at getting clients through it.

From gap analysis to certificate: how it works

• Book a call — tell us what's prompted it (a contract, an insurer, or just good practice) and any deadline you're working to.

• Gap analysis — we review your environment against the five controls and give you a clear picture of what passes today and what doesn't.

• Remediation — we fix the gaps: patching, configuration, access control, unsupported software, MFA. This is the part that varies most between businesses — some need days, some need an afternoon.

• Assessment and certification — we prepare and manage the assessment submission with you, and for CE Plus we get your systems ready for the hands-on audit and support you through it.

• Stay certified — certification renews annually. As a Pebble IT managed client, the controls are maintained as part of how we run your IT, so renewal becomes routine rather than a scramble.

The head start our managed clients get

Here's the honest truth about Cyber Essentials: most of the work is just running your IT properly — patching, sensible access control, managed malware protection, no unsupported software. If Pebble IT already manages your IT, most of the five controls are already in place, because they're baked into our managed cyber security and IT support plans as standard. Certification becomes a short, predictable project rather than a remediation slog.

Not a client yet? The gap analysis will tell you exactly where you stand — no scare tactics, just a list.

What does Cyber Essentials certification cost?

The assessment itself is a fixed cost, and we manage the whole submission for you. Preparation and remediation work is quoted separately after the gap analysis — because the honest answer is that it depends entirely on how close your current setup is to the standard. A well-run environment might need almost nothing; an unmanaged one needs more. We'll tell you which you are before you commit to anything.

When Cyber Essentials becomes essential

• Supply chain requirements — larger customers requiring certification from their suppliers

• Public sector work — Cyber Essentials is mandatory for many government contracts involving personal or sensitive data

• Professional sectors — accountants, law firms and other regulated businesses using it to evidence data protection

• Insurance — insurers offering better terms, or requiring certification outright

• Winning work — a visible differentiator on tenders and pitches, exactly as it is for us
  

We support businesses across Hertfordshire, Essex and London from our Hoddesdon office. Been asked for Cyber Essentials? Let's find out how close you already are — book a call