Professional services
Cyber Essentials consultancy
Help getting your business through Cyber Essentials, from finding the gaps to putting the controls in place and preparing the evidence, with guidance on Cyber Essentials Plus if you need it.
Who it is for
Businesses in Teesside and the North East that have been asked for Cyber Essentials by a customer, a supplier questionnaire, a public contract or a cyber insurer, and those whose certificate is up for renewal under the stricter requirements that apply from 27 April 2026. You think your IT is reasonably secure; you do not know which requirements you already meet, and working through them alone takes time you do not have.
What you get
A gap analysis that tells you where you stand against the five controls, the missing controls put in place by our own engineers, the self-assessment questionnaire and its evidence prepared with you, and support at the annual renewal so the controls are still there when the certificate comes round again. Cyber Essentials Plus, with its hands-on testing by an assessor, when a contract requires it.
The problem
Customers and contracts increasingly ask for Cyber Essentials, but the controls are specific, and working through the requirements alone takes time you do not have.
Cyber Essentials is the UK government-backed scheme that shows customers and suppliers you have the basics of cyber security in place. The five technical controls are unchanged: firewalls, secure configuration, user access control, malware protection and security update management. Cyber Essentials is a verified self-assessment; Cyber Essentials Plus adds hands-on technical testing by an assessor.
From 27 April 2026 assessments move to version 3.3 of the requirements, and some of the questions got much stricter. If a cloud service offers multi-factor authentication it must be switched on for every user, not just administrators, and not having it where it is available is an automatic fail; that catches the accounting package, the HR system and the supplier portal, not only Microsoft 365. High-risk and critical updates must be applied within 14 days everywhere, including routers, firewalls and applications, and missing that is also an automatic fail. Cloud services can no longer be left out of scope. For Plus, you can no longer change your self-assessment answers based on what the assessor finds, and a second failure revokes the certificate.
Most businesses that fail do so on the things they have forgotten: the cloud login nobody listed, the router that has never had a firmware update, the ex-employee's account. A gap analysis by people who run IT every day finds those before the assessor does.
What Odyssey provides
- A gap analysis of your systems against the current Cyber Essentials requirements, in plain language
- The five technical controls put in place by our own engineers where they are missing
- Multi-factor authentication switched on for every user on every cloud service, and legacy sign-in methods blocked
- Help preparing and submitting the self-assessment questionnaire and the evidence behind it
- Guidance on Cyber Essentials Plus, and the fixes an assessor's test will need
- Support at the annual renewal, so the controls are still in place when the certificate comes round again
What is included
| Included | Detail |
|---|---|
| Scope | Every legal entity, site, cloud service and device the certificate will cover, listed and agreed before any other work starts |
| Gap analysis | Your firewalls, device configuration, user accounts, malware protection and update management checked against the requirements, with a written list of what passes and what does not |
| Remediation plan | The missing controls, who will put each one in place and in what order, priced from the gap analysis |
| Remediation | The controls put in place by our engineers where you ask us to, from multi-factor authentication on every cloud service to patching routers and firewalls within 14 days |
| Self-assessment | The questionnaire prepared with you so every answer reflects a control you actually have, and the evidence filed with it |
| Plus guidance | What the assessor's vulnerability scan and device tests look for, and the fixes to make first |
| Renewal | A check before each annual renewal that the controls are still in place and the scope is still right |
Not included, or sold separately
- The certificate itself
- Cyber Essentials is awarded by an IASME-licensed certification body on the strength of your self-assessment; we prepare it with you, we do not award it
- Cyber Essentials Plus testing
- The hands-on test is carried out by a licensed assessor and charged by the certification body
- The ongoing services the controls rely on
- Endpoint and identity protection, a hosted firewall, password management and managed patching are each their own service and can be added to the same retainer
- Security awareness training
- Not a Cyber Essentials control, but what most businesses need next, and a separate service
- Wider standards
- ISO 27001 or a full information security management system is a different scale of work; we can advise on the route from Cyber Essentials towards it
How it is delivered
-
Agree the scope
Which legal entities, sites, cloud services and devices the certificate will cover, and anything to be excluded, written down at the start. Group companies can now hold a certificate per legal entity.
-
Check where you stand
A gap analysis against the current requirements: every cloud service listed and its multi-factor authentication checked, every device and router's update status, user accounts, malware protection and firewall configuration, with a plain-language list of passes and gaps.
-
Close the gaps
The missing controls put in place, by our engineers or your own team, in the order that matters: multi-factor authentication everywhere first, then patching of the things that are not PCs, then configuration and accounts.
-
Prepare and submit
The self-assessment questionnaire completed with you and the evidence filed; for Plus, the fixes the assessor will test for made before the test is booked. From gap analysis to certificate usually takes two to four weeks, depending on how many fixes the gap analysis finds.
-
Keep it current
Before each annual renewal, a check that the controls are still in place and the scope still right, so the certificate renews without a scramble.
Why trust Odyssey with this
-
ISO
Certified to ISO 27001 for information security
-
In-house
All work completed by Odyssey employees, never subcontracted
-
3
Calls answered within three rings, and a director is always reachable
- ISO 9001 certified by NQA for quality management
Questions people ask
What is Cyber Essentials?
A UK government-backed scheme that certifies a business has five basic security controls in place (firewalls, secure configuration, user access control, malware protection and security update management). Many customers, insurers and public contracts require it.
What is the difference between Cyber Essentials and Cyber Essentials Plus?
Cyber Essentials is a verified self-assessment. Plus adds hands-on technical testing by an assessor, including a vulnerability scan and checks on sample devices, and since April 2026 you cannot change your self-assessment answers based on what the assessor finds.
What changed in April 2026?
From 27 April 2026 the requirements moved to version 3.3. Multi-factor authentication must be on for every user on every cloud service that offers it, critical updates must be applied within 14 days on routers, firewalls and applications as well as PCs, and cloud services cannot be left out of scope. Each of those is an automatic fail if missed.
Where do we start?
With a gap analysis. We check your systems against the requirements and show you which controls are missing before anything is submitted, so you are not paying for an assessment you will fail.
Can you put the missing controls in place for us?
Yes. Our own engineers put the five technical controls in place, from multi-factor authentication and patching to firewall configuration, and the work is never subcontracted. If you would rather your own team did it, the gap analysis tells them what to do.
Does Odyssey award the certificate?
No. We prepare the self-assessment and evidence with you; the certificate is awarded by an IASME-licensed certification body.
How long does it take?
It depends on how many gaps the analysis finds. A business with multi-factor authentication already on everywhere and patching under control can move quickly; one with several cloud services to bring into line takes longer. The gap analysis gives you a realistic timeline before you commit.
Do you help with the annual renewal?
Yes. Before each renewal we check that the controls are still in place and the scope is still right, so the certificate renews without a scramble, and if the requirements have changed again we tell you what that means for you.
Challenges this helps with
Related services
Ask about Cyber Essentials consultancy
Send us your question and we will come back to you. We call back within the hour in office hours.
Rather talk? Call 01642 661888. Already a customer with a fault? Call the service desk on 01642 661800.
Please fill in every field marked *, then send again.
That email address does not look right. Please check it and send again.
We have had several messages from you in a short time. Please call us on 01642 661888 instead.
Online messages are paused for the moment. Please call us on 01642 661888.
Your message is too long for this form. Please shorten it, or call us.
Something went wrong on our side and your message was not sent. Please call us on 01642 661888.
We could not confirm that a person sent this message. Please try again, or call us on 01642 661888.
Talk to a human about Cyber Essentials consultancy
Call and we answer within three rings. Or tell us what you need and we will call you back at any time.