Cyber Essentials certification for UK SMBs, run end-to-end by a certified IASME assessor. Fixed price quoted in 48 hours, free re-submission if anything fails, and a direct line to the person actually signing off your certificate.
Cyber Essentials is the UK government-backed cyber security certification scheme, created by the National Cyber Security Centre (NCSC) and administered by IASME. It sets out five technical controls that, when configured properly, stop the vast majority of common internet-based attacks against UK small and medium-sized businesses.
Those five controls cover firewalls and boundary protection, secure configuration of devices and software, user access control, malware protection, and security update management. The certification is a self-assessment questionnaire signed off by an IASME-approved assessor. Cyber Essentials Plus adds an independent technical audit on top of the same five controls.
For most UK SMBs, Cyber Essentials is no longer optional. It is required to bid for many central government contracts that handle personal data, it is a common procurement gate for enterprise customers and prime contractors, it unlocks cyber insurance discounts (and in some cases inclusion at all), and it gives your customers and supply chain measurable confidence that your basics are in order. It is also the natural prerequisite to ISO 27001 and to Cyber Essentials Plus.
Cyber Essentials is built on five technical controls. Get these right and you remove most opportunistic attack paths. Here is what each one means in practice - and what Bluewater configures for you.
Every device that connects to the internet needs a properly configured firewall - both at the network edge and on each laptop. Default passwords go, inbound rules get locked down, and remote-admin interfaces stop facing the open internet.
Devices and cloud services should ship in a known-good state, with unused accounts and services disabled. We harden Windows, macOS and your core SaaS - Microsoft 365, Google Workspace - against the obvious mistakes.
People should have the access they need to do their job and no more. Admin rights are separated from day-to-day accounts, leavers are removed promptly, and shared logins are eliminated wherever possible.
Every in-scope device needs working anti-malware that updates automatically and blocks known-bad files and sites. For mobile, we lean on app-store sandboxing and managed device profiles instead of legacy AV.
High and critical patches must be applied within 14 days. That means supported operating systems and applications only, with a documented patching cadence - not "we update when we remember".
Most CE providers hand you a long questionnaire and disappear. We do the opposite - we run the project, talk to the assessor for you, and stand behind a fixed price and a fixed window.
You talk to the person who actually signs off your certificate, not a sales team relaying messages. Questions get answered in hours, not weeks.
From kick-off to submission in 30 days for standard SMB scopes. We give you a dated plan on day one and we hold to it.
One number, quoted within 48 hours of your enquiry. Includes scoping, remediation guidance, the IASME assessor fee and submission.
If the assessor flags anything, we fix it and resubmit at no extra cost. That is part of the price - not an upsell.
A predictable, dated plan from day one. Here is what happens, and when.
We lock down what is in scope - users, devices, cloud services, locations - and run a structured gap analysis against the five controls. You get a written remediation plan with owners and dates.
We work alongside your team (or do it directly) to close the gaps: firewall configuration, MFA enforcement, patching cadence, leaver processes, MDM where needed. Daily progress against the plan.
We complete the IASME self-assessment with you, evidence every answer, and run an internal dry-run review against the same criteria the assessor will use. Anything weak gets tightened.
Formal submission to IASME, assessor review, and your certificate issued. If anything is flagged, we remediate and resubmit free of charge - included in the fixed price.
Same five controls. Different level of independent verification. Honest guidance on which is right for you.
You complete the IASME questionnaire, the assessor reviews and signs off. Right for most SMBs starting their certification journey, for insurance, and for the majority of commercial procurement gates.
Everything in Cyber Essentials, plus an independent hands-on audit of a sample of your devices and cloud services by the assessor. Required for some central government and MoD contracts and increasingly requested in enterprise supply chains.
If any of these apply, Cyber Essentials is on your roadmap whether you planned it or not. Better to lead it than to scramble.
Book a 15-minute call or run the free readiness check first - both go to the same place: a fixed-price Cyber Essentials quote within two working days.