Cyber Essentials Support for Kent Businesses

Cyber Essentials is the UK Government-backed scheme that shows your business has the basic protections in place against the most common cyber attacks. It's run by the National Cyber Security Centre (NCSC) and its delivery partner IASME.

More and more SMEs are being asked for it. It's required for many central government contracts, it's increasingly requested by local councils, the NHS, housing associations and main contractors, and many insurers look more favourably on businesses that hold it.

Cyber Essentials checks five areas of your IT:

• Firewalls. Your internet connection and devices are protected by properly configured firewalls.
• Secure configuration. Default passwords are changed and unnecessary software and accounts are removed.
• User access control. Staff only have the access they need, admin accounts aren't used for everyday work, and multi-factor authentication is switched on for cloud services.
• Malware protection. Antivirus or equivalent protection is active and kept up to date.
• Security update management. All software is still supported by the manufacturer, and critical updates are applied within 14 days.

Most businesses don't fail Cyber Essentials because their IT is bad. They fail because they misunderstand a question, leave something out of scope, or miss one unsupported laptop. We make sure that doesn't happen.

1. Free consultation. We explain what's involved and whether Cyber Essentials or Cyber Essentials Plus is right for you.
2. Scoping. We work out exactly which devices, users, offices and cloud services need to be included.
3. Gap check. We go through the requirements with you and identify anything that would fail.
4. Clear fix list. You get a plain-English list of what needs changing. Your IT person or provider makes the changes, and we're on hand to answer their questions.
5. Final review. We check your answers and evidence before you submit, so you're ready to pass.

Your assessment is then marked by an independent, IASME-licensed Certification Body. The certification fee is paid to them separately, and we'll tell you the exact cost up front.

Many businesses go straight to a Certification Body. That works, but many Certification Bodies also sell IT services, software or fixed-price remediation packages, so the company telling you what needs fixing is often the same one selling you the fix.

ISOHS is an independent advisor. We don't sell hardware, software or IT contracts, and we don't earn commission from anyone. That means:

• Options, not one answer. Where something needs fixing, we explain the alternatives, from free built-in settings to paid products, so you choose what suits your budget.
• Use who you already have. Your existing IT provider, or your own staff, can make the changes. You're not tied to a particular supplier.
• Compare quotes with confidence. If you do need outside help, we'll help you understand what you're being quoted for and whether you actually need it.
• Free choice of Certification Body. When you're ready, you pick the Certification Body you want for the assessment. We'll help you compare.

Cyber Essentials Plus uses the same five controls but adds a hands-on technical audit of your systems by a licensed assessor. We help you prepare so your devices and settings are ready before the assessor arrives, reducing the risk of failures and retests.

• ISO 27001 lead auditor (IRCA). Information security is part of what we audit, so we know how assessors think.
• Plain English. We explain the requirements in business terms, not IT jargon.
• Independent. We're not a Certification Body or an IT reseller, so we give you options and alternative quotes rather than a single package to buy.
• One consultant for everything. Many clients combine Cyber Essentials with ISO 9001, ISO 27001 or SSIP accreditation, as the same tenders often ask for all of them.

Cyber Essentials and ISO 27001. Cyber Essentials covers basic technical controls. ISO 27001 is a full information security management system. Cyber Essentials is a quick, affordable first step, and the work you do counts towards ISO 27001 later.

Cyber Essentials and SSIP. Contractors applying for CHAS, SMAS or SafeContractor are often asked about cyber security in the same tender. We can handle both together.