Getting a client through Cyber Essentials, and keeping them there

Short answer. I don’t issue Cyber Essentials certificates. That is done by an IASME-licensed certification body, and for Cyber Essentials Plus their assessor runs the technical audit. What I do is everything around it: scope the business, run a gap check against the five controls, fix what it finds, help the client answer the questionnaire accurately, and then keep the controls in place for the next 12 months. Atera, the remote management tool on every device I look after, is what turns the device side from guesswork into evidence.

This is how that works in practice, from first conversation to the renewal a year later.

Who does what

Cyber Essentials is often described as “an audit”, which makes it sound like one firm does all of it. In practice there are three parties, and it helps to be clear from day one.

Who	What they do
The certification body	Reviews the self-assessment, asks follow-up questions, issues the certificate. For Plus, tests a sample of devices and scans your network.
Me	Scoping, inventory, gap check, remediation, evidence, technical answers, Plus readiness, and keeping it all current for the year.
The client	Signs the declaration that the answers are true, approves any hardware replacement, and makes sure staff complete MFA enrolment.

The director’s signature matters. The questionnaire is a declaration, and an answer that was true in March and false in June is still your answer. That is the main reason the year after the certificate matters as much as the certificate itself.

Step 1: scope and inventory

The first question is what is in scope. Usually it is the whole organisation, because that is what clients and tenders ask for. In scope means every laptop, desktop, server, phone and tablet that touches company data, every cloud service the business uses, and the internet connection and router at each office.

Most businesses can name their laptops. Fewer can name the old PC in the warehouse, the director’s personal iPad that has Outlook on it, or the trial software someone signed up to with a work email two years ago.

This is where Atera earns its place. The agent goes on every company device, and within a day I have a live list of each machine, its operating system and version, every piece of installed software with its version, the antivirus status and the last time it patched. Phones and tablets come through Microsoft Intune. Cloud services come from a conversation and a look through the Microsoft 365 sign-in logs, which show what people are actually using.

Step 2: the gap check

With the inventory in hand I go through the five controls: firewalls, secure configuration, security updates, user access and malware protection. The Cyber Essentials explainer covers what each one asks for. The same things come up first time almost every time.

1. Unsupported software. A Windows 10 machine past its support date, an old version of Adobe Reader, a PDF tool nobody uses but nobody removed. Anything unsupported fails, and the software inventory finds it in minutes. The Windows 10 post covers the options for machines that can’t upgrade.
2. Patches older than 14 days. High-risk and critical updates must be applied within 14 days of release. A business relying on staff to click “restart now” will have machines outside that window on any given day.
3. MFA gaps on cloud services. Microsoft 365 usually has it, at least for most people. The accounting package, the CRM and the shared mailbox login often don’t. The invoice fraud post explains why this one matters beyond the certificate.
4. Everyday accounts with admin rights. Staff who are local administrators on their own laptop “because it was easier”. Admin rights need to be separate accounts, used only when needed.
5. Devices nobody knew were in scope. Personal phones with company email, a home PC used for the odd invoice, a router still on its default password.

The output is a short written list, in plain English, of what would fail today and what it takes to fix each item. Some fixes are an afternoon. Some are a hardware order.

Step 3: remediation

Most of the fixing is configuration, not spending.

• Patching. Atera runs Windows and third-party application patching on an automated schedule, well inside the 14-day window, with a restart policy agreed with the client so nobody loses work. Machines that miss a cycle raise an alert to me rather than waiting to be noticed.
• Unsupported software. Removed remotely where it isn’t needed, upgraded where it is. Machines that can’t run a supported operating system are replaced, and that is usually the only real cost.
• MFA. Enforced in Microsoft 365 with conditional access, and switched on in every other cloud service that offers it. Staff enrolment is the slow part, so I book short sessions rather than sending an email and hoping.
• Admin accounts. Everyday accounts become standard users. Separate admin accounts are created for the people who genuinely need them, with MFA.
• Firewalls and routers. Default passwords changed, remote management closed from the internet, inbound rules reviewed. The Windows firewall is enforced by policy on every machine.
• Malware protection. Managed antivirus on every device, with Atera reporting any machine where it is off or out of date.
• Phones and tablets. Enrolled in Intune with a screen lock, a supported OS and the ability to wipe company data without touching personal data.

Step 4: the submission

The questionnaire is completed together, usually in one sitting. I answer the technical questions and the director answers the organisational ones, and nothing goes in that we can’t show. If the certification body comes back with follow-up questions, I deal with those directly.

For Cyber Essentials Plus, the assessor tests a sample of devices and scans the external network, and Plus has to be completed within three months of the basic certificate. A week before the assessment I check that every sampled device is fully patched, has antivirus running and has nothing unsupported installed. Atera makes that a report rather than a walk round the office.

Step 5: the 12 months after the certificate

This is the part most businesses don’t plan for. The certificate is a snapshot of one day. From the next morning, new updates are released, new staff join, someone installs a browser extension, a laptop goes three weeks without being switched on.

For clients I look after, the year runs like this:

• Patching stays automated, and any device that falls behind raises an alert to me the same day.
• New devices are picked up the moment the Atera agent reports in, and checked against the controls before they are trusted.
• New starters and leavers go through a checklist, so admin rights are never handed out by default and accounts are closed on the last day.
• A monthly report from Atera shows patch compliance, antivirus status and anything unsupported, so drift is spotted in weeks, not at renewal.
• A quarterly review walks through the controls against what has changed in the business.
• The question set changes every April. I read the changes and tell the client what, if anything, they need to do before renewal.

When the renewal comes round, the evidence already exists. It becomes a morning’s work instead of a scramble.

What a tool can’t do

Atera is very good at the device side: knowing what exists, keeping it patched, and proving it. It doesn’t configure your cloud services, decide who should have admin rights, or sign the declaration. Those are judgement calls, and that is the part of Cyber Essentials a business is really paying someone for.

If you have been asked for Cyber Essentials by a client or a tender, or you have a certificate and aren’t sure it is still true, book a call. The gap check usually tells you within a week how far off you are, and if you would rather have the whole estate looked at independently and in writing, the IT & Security Audit covers all five controls in two weeks, from £1,500. It is standard IT security work, and for managed IT clients the year of upkeep runs inside the retainer.