Challenges
Getting Cyber Essentials certification
Cyber Essentials asks for five security controls and evidence they are in place, and since April 2026 the questions are stricter. We find the gaps, close them and prepare the evidence with you.
The challenge
A customer has added Cyber Essentials to their supplier questionnaire, or a contract you want to bid for requires it. You think your IT is reasonably secure, but you do not know which requirements you already meet, and working through them alone takes time you do not have.
If it is left
The deadline is usually someone else's: a tender closing date or a customer's supplier review. A business that starts late either misses the bid or submits a self-assessment it cannot back up, which fails and costs a resit. Since 27 April 2026 the common failure points are automatic: a cloud service with multi-factor authentication available and not switched on for every user, or a router or firewall that has not had a critical update within 14 days. The services people forget, the accounting package, the HR system, the supplier portal, are the ones that fail it.
What good looks like
A gap analysis that says where you stand against the five controls, the missing controls put in place in the order that matters, the questionnaire completed with answers you can evidence, the certificate in hand before the tender closes, and a date in the diary for the renewal check so next year is not a scramble. If a contract wants Plus, the hands-on test is booked once the self-assessment is clean.
What to do first
Before you call anyone
List every cloud service the business uses
Microsoft 365 is the easy one. The accounting package, payroll, HR, the CRM, the supplier portal, the domain registrar and the bank are all in scope now, and every one with multi-factor authentication available must have it switched on for every user.
Find the devices that are not PCs
Routers, firewalls, switches and any software on them. Critical updates must be applied within 14 days on those too, and the ISP's router nobody has logged into for years is the usual gap.
Check who is an administrator
Count the accounts with admin rights in Microsoft 365 and on your computers. The requirement is that people use standard accounts for everyday work and separate accounts for administration.
Count what is out of support
A device or operating system that no longer receives security updates fails the scheme. Windows 10 reached end of support on 14 October 2025.
Agree the scope
Which legal entities, sites, cloud services and devices the certificate will cover. A group can now certify per legal entity, and anything excluded has to be described.
To see where you stand on all five controls, take the Cyber Essentials check. You get the result straight away, with no name or email needed.
What we would do first
-
Check where you stand
A gap analysis of your systems against the Cyber Essentials requirements, so you know what is already in place and what is missing.
-
Close the gaps
The missing controls put in place, which can mean a managed firewall, protection on every device, multi-factor authentication and strong, unique passwords.
-
Prepare the self-assessment
Help preparing and submitting the questionnaire and the evidence behind it, with guidance on Cyber Essentials Plus if you need it.
-
Keep it current
Support for the annual renewal, so the controls are still in place when the certificate comes round again.
How we approach it
-
Scope and gap analysis
The scope agreed and written down, then every cloud service listed and its multi-factor authentication checked, every device and router's update status, user accounts and admin rights, malware protection and firewall configuration, with a plain-language list of passes and gaps.
-
Fix the automatic fails first
Multi-factor authentication enforced on every cloud service, starting with Microsoft 365 through Entra Conditional Access, then the forgotten logins; routers and firewalls patched or replaced where they cannot be; unsupported operating systems upgraded or retired.
-
Put the other controls in place
A hosted Fortinet firewall at the network edge, Microsoft Defender with Huntress detection and response on every device, standard user accounts with separate admin accounts, Keeper for strong unique passwords, and Intune enforcing device configuration.
-
Complete the self-assessment
The Danzell questionnaire completed with you so every answer reflects a control you actually have, and the evidence filed with it. For Plus, the fixes an assessor's vulnerability scan and device tests look for are made before the test is booked.
-
Renew without a scramble
Before each annual renewal, a check that the controls are still in place and the scope is still right, and a note of what has changed in the requirements since last time.
The services that apply
-
Cyber Essentials consultancy
The gap analysis, the remediation plan, the self-assessment prepared with you and the renewal check are this service.
-
IT health check
If you want the whole estate looked at, not only the five controls, the health check does that and the Cyber Essentials gaps fall out of it.
-
Endpoint and identity protection
Malware protection is one of the five controls, and Microsoft Defender with Huntress detection and response on every device is how we meet it.
-
Hosted firewall
Firewalls are the first control, and the 14-day patching rule now applies to them; a hosted firewall we keep current removes the box nobody has touched.
-
Password management
User access control asks for unique passwords and controlled admin rights; Keeper gives every account a strong, unique password and removes a leaver's access centrally.
How you would buy it
Every hour we work falls under one of four engagement models. These are the ones that fit this situation; How we work compares all four.
-
02
Fixed price
A defined piece of work or project
The gap analysis and the self-assessment are a fixed fee set by the size of the estate, and remediation is quoted from the gap analysis as a fixed sum, so you know the cost of the certificate before you commit.
-
03
Retainer
The way most of our clients work with us
For a client on a retainer, small remediation items and the annual renewal check are pre-authorised within the retained hours, and the controls the certificate relies on are kept in place as managed service.
Who you would work with
A tech consultant
Runs the gap analysis, agrees the scope with you and prepares the self-assessment answers and evidence.
Our engineers
Put the missing controls in place: multi-factor authentication, patching, the firewall, device protection and the password manager.
An account manager
Keeps the tender date in view and books the renewal check for next year.
Further reading
-
Guide
Cyber Essentials is changing on 27 April: what it means for your certificate
New Cyber Essentials requirements apply from 27 April 2026. The five controls stay the same, but MFA, patching and cloud scope get much stricter.
Read the guide →
Questions people ask
What is Cyber Essentials?
A UK government-backed scheme that certifies a business has five basic security controls in place: firewalls, secure configuration, user access control, malware protection and security update management. Many customers, insurers and public contracts require it.
What is the difference between Cyber Essentials and Cyber Essentials Plus?
Cyber Essentials is a verified self-assessment. Plus adds hands-on technical testing by an assessor, including a vulnerability scan and checks on sample devices, and since April 2026 you cannot change your self-assessment answers based on what the assessor finds.
What changed in April 2026?
Assessment accounts created on or after 27 April 2026 are assessed against version 3.3 of the requirements, the Danzell question set. Multi-factor authentication must be on for every user on every cloud service that offers it, critical updates must be applied within 14 days on routers, firewalls and applications as well as PCs, and cloud services cannot be left out of scope.
How do we find out which requirements we already meet?
A gap analysis checks your systems against the requirements, cloud service by cloud service and device by device, so you know what is already in place and what is missing before anything is submitted.
What if we do not have all the controls in place yet?
We put the missing controls in place, in the order that matters: multi-factor authentication everywhere first, then patching of the things that are not PCs, then configuration, accounts and passwords. If you would rather your own team did it, the gap analysis tells them what to do.
Does Odyssey award the certificate?
No. We prepare the gap analysis, the controls, the self-assessment and the evidence with you; the certificate is awarded by an IASME-licensed certification body on the strength of that self-assessment, and for Plus on its assessor's tests.
How long does it take?
It depends on how many gaps the analysis finds. A business with multi-factor authentication already on everywhere and patching under control can move quickly; one with several cloud services to bring into line takes longer. The gap analysis gives you a realistic timeline against your tender date before you commit.
Does Cyber Essentials need renewing?
Yes, the certificate comes round again each year, and the requirements change. We check before each renewal that the controls are still in place and the scope is still right, so it renews without a scramble.
Talk to a human about Cyber Essentials
Call and we answer within three rings. Or tell us what you need and we will call you back at any time.