02 / Compliance and certification
Cyber Essentials, the basics done properly and checked
We help you scope your systems, close the gaps in the five technical controls and prepare for the certification body, whether you are going for Cyber Essentials or Cyber Essentials Plus.
Overview
What Cyber Essentials asks of you
Cyber Essentials is a UK government-backed certification scheme, overseen by the National Cyber Security Centre, that sets a baseline of technical controls against common internet-based attacks. The requirements cover firewalls, secure configuration, security update management, user access control and malware protection.
There are two levels. Cyber Essentials is a self-assessment questionnaire, reviewed by a certification body. Cyber Essentials Plus uses the same requirements and adds hands-on technical verification of your systems by the certification body's assessor. Either way, the scope has to include the devices, cloud services and accounts that actually handle your organisation's data.
Certificates are issued by certification bodies licensed under the scheme by its accreditation body, IASME. Black Fox is not one. We prepare you, fix what needs fixing with your team, check it before the assessor does and coordinate the assessment with our long-standing certification partners or a certification body of your choice.
Who it is for
Organisations bidding for UK public sector contracts that require it, suppliers whose customers ask for it, and small and mid-sized organisations that want an external check of their security basics.
The work, from scoping to evidence.
What we do
Scoping
We work out which offices, devices, cloud services and users are in scope, including home working and bring-your-own devices where they apply.
Gap assessment
A review of your setup against the five technical controls, with each gap stated plainly and ranked by effort.
Configuration and updates
Help with secure configuration, removing unsupported software and getting updates applied within the scheme's expectations.
Access and authentication
User and administrator accounts, multi-factor authentication for cloud services and removal of accounts nobody uses.
Questionnaire support
Help answering the self-assessment accurately, so each answer describes what is really configured.
Plus readiness
For Cyber Essentials Plus, a technical check of sample devices and services along the lines the assessor will test.
How the engagement runs
Kickoff
We agree the level you are aiming for, the scope and your deadline, and sign an NDA first if you need one.
Gap assessment
Document review, interviews and a look at the actual configuration, ending in a prioritised gap list.
Remediation
We work with your team on configuration, updates, accounts and malware protection.
Pre-assessment check
We review the questionnaire answers and, for Plus, test sample systems the way the assessor will.
Certification
We coordinate the assessment with one of our long-standing certification partners or the certification body of your choice, and help with any questions or findings along the way.
What you receive
- Scope definition with device, service and user inventory
- Gap report against the five technical controls
- Remediation guidance for each gap
- Reviewed self-assessment answers
- Technical pre-assessment results for Cyber Essentials Plus
Black Fox prepares and supports you, and does not issue certificates, attestation reports or official assessments itself. Where a certificate or report is the goal, we coordinate the audit with our long-standing certification partners or a body of your choice, so the work runs end to end in one engagement.
Questions
Do you issue Cyber Essentials certificates?
No. Certificates are issued by certification bodies licensed under the scheme. We work with long-standing certification partners and coordinate the assessment with them or with a certification body of your choice, so you go from preparation to the certificate in one engagement.
What is the difference between Cyber Essentials and Plus?
The requirements are the same. Cyber Essentials is verified through your answers to the questionnaire. Cyber Essentials Plus adds a technical audit of your systems by the certification body's assessor.
Do cloud services count?
Yes. Cloud services that handle your organisation's data are in scope, and the controls apply to the parts you are responsible for, such as user accounts and multi-factor authentication.
Is Cyber Essentials enough on its own?
It is a baseline, not a full programme. It covers common attacks well. Larger or more exposed organisations often build on it with ISO/IEC 27001, penetration testing or ongoing vulnerability management.
Related services
- Managed securitySecurity hardeningSecurity hardening by Black Fox Security: endpoint, server and network hardening, secure configuration baselines, monitoring setup and personal security.
- Managed securityVulnerability managementRecurring vulnerability reviews from Black Fox Security: scanning, triage, prioritisation by exploitability and exposure, fix tracking and trend reporting.
- Compliance and certificationISO/IEC 27001ISO/IEC 27001 support from Black Fox Security: ISMS scoping, risk assessment, Statement of Applicability, internal audit and certification audit preparation.
- Managed securityAccess reviewsPeriodic access reviews by Black Fox Security: user and privileged access across directories, cloud and key applications, joiners and leavers, audit evidence.
Check the basics before the assessor does
Tell us which level you need and by when. We will show you what stands between you and the certificate.