Cyber Essentials and Cyber Essentials Plus.

Certification done with you by our own assessors. Readiness, questionnaire, assessment and the Plus testing, at a fixed price set by your headcount.

Cyber Essentials and Cyber Essentials Plus.

Certification done with you by our own assessors. Readiness, questionnaire, assessment and the Plus testing, at a fixed price set by your headcount.

Cyber Essentials, done with you

One project, our assessors, a fixed price. Cyber Essentials first, then Cyber Essentials Plus, and the evidence your contracts and insurers ask for.

  • Cyber Essentials and Cyber Essentials Plus assessed by our own assessors

  • Fixed price, set by your headcount

  • Readiness review before anything is submitted

  • £25,000 of cyber liability insurance included with a valid certificate, for eligible UK organisations

  • The same team as our CREST certified penetration testing

Cyber Essentials Plus certified

What Cyber Essentials is

Cyber Essentials is the UK government-backed scheme, run by the National Cyber Security Centre and delivered by IASME, that sets out five technical controls every organisation should have in place. It is designed to stop the common, untargeted attacks that cause most incidents. Cyber Essentials Plus covers the same five controls and adds independent technical testing of your systems by an assessor.

One or both are required for many UK government contracts, for Ministry of Defence suppliers and across the NHS supply chain, and they are increasingly asked for by insurers and by larger customers running supply chain audits. The deadline is usually set by someone else, and it is often short.

Certified organisations that meet IASME’s eligibility rules also receive cyber liability insurance with a £25,000 limit of indemnity and access to a 24-hour incident helpline, at no extra cost. The whole organisation must be certified, it must be domiciled in the UK or Crown Dependencies, and annual turnover must be under £20 million.

The five controls

Both certifications assess the same five controls across every in-scope device, service and user, including cloud services and the laptops and phones people use at home.

Firewalls

Boundary and device firewalls allow only the services you need in from the internet.

Secure configuration

Default passwords and unneeded accounts, software and services removed; devices locked.

Security update management

Systems kept in support, high and critical updates applied within 14 days of release.

User access control

Individual accounts, least privilege, separate admin rights, MFA on cloud services.

Malware protection

Anti-malware or allow-listing on every in-scope device, kept current and set to act.

Cyber Essentials and Plus, together

Most organisations that need one benefit from both. Cyber Essentials proves the controls are in place; Plus proves they work. Done as one project, with one assessor and one price, it is the strongest evidence you can give a buyer or insurer.

Step one

Cyber Essentials

A self-assessment questionnaire covering the five controls, completed by you with our guidance and marked by one of our assessors.

What you get
  • Certificate valid for twelve months
  • £25,000 cyber liability insurance for eligible UK organisations
  • Meets contracts that specify Cyber Essentials
  • Listed on the NCSC certificate register
Step two

Cyber Essentials Plus

Everything in Cyber Essentials, plus hands-on testing of a sample of your devices and services by an assessor, within three months of the Cyber Essentials certificate.

What you get
  • Independent proof that the controls work
  • External scan of every internet-facing service
  • Device, email and browser tests on a representative sample
  • Commonly asked for by the MOD and by NHS and enterprise supply chains

Recommended

Both together

Cyber Essentials first, Plus scheduled straight after, with the same assessor from readiness to certificate.

Why both
  • One scope, one readiness review, one plan
  • Plus booked inside the three-month window, so nothing lapses
  • One fixed price, set by headcount
  • Renewal planned so there is no gap in cover

75% off your first Cyber Essentials certificate

The Cyber Essentials First Step Fund, backed by the UK government and run by IASME, gives micro, small and medium-sized organisations 75% off a new Cyber Essentials certificate. It is for organisations that have not held Cyber Essentials in the past four years, and it runs until the end of March 2027 or until the funding runs out.

The discount still applies when you certify through an assessor like Heretek. It covers the Cyber Essentials assessment and, when you pass, the certificate. Cyber Essentials Plus is priced as normal.

  • 75% off a new Cyber Essentials certificate

  • Micro, small and medium-sized organisations

  • No Cyber Essentials certificate held in the past four years

  • Open until the end of March 2027, or until the funding runs out

  • Applies when you certify with Heretek

  • Plus can follow straight after, at the normal price

Done with you, in four steps

From first call to certificate, one path and one team.

1. Readiness

A short call, then a review of your environment against the five controls. We tell you what would fall short before anything is submitted.

2. Preparation

We guide you through the questionnaire question by question and set out, in plain terms, what needs to change and how to do it.

3. Assessment

Our assessors mark the submission. For Plus, we schedule and carry out the technical testing on a sample of your devices.

4. Certification

The submission goes to the certification body and your certificate is issued. If something falls short, you get a clear list of what to fix and when it can be looked at again.

What the Plus assessment involves

Plus is where most organisations are caught out, so we treat it as a project rather than a form. This is what our assessor tests, and what to have ready.

What the assessor tests
  • An external scan of every public IP address and internet-facing service
  • A representative sample of user devices, typically around ten per cent, plus all internet gateways and internet-facing servers
  • Patch checks: high and critical vulnerabilities must be fixed within 14 days
  • Malware protection tested on each sampled device
  • Email and browser tests: can a malicious attachment or download reach the user?
  • Account separation and multi-factor authentication on cloud services
What to have ready
  • Hold a current Cyber Essentials certificate first; Plus must be completed within three months of it
  • Agree the device sample with us from your asset list before the test day
  • Make sure every sampled device is on, reachable and has a user available
  • Have your cloud administrator and anti-malware consoles to hand for evidence
  • Remote testing runs over a screen-sharing session with your IT team; on site is available
  • Anything that fails must be fixed within 30 days and is retested before the certificate is issued

Why certify with Heretek

Assessors who test for a living

The people marking your submission and testing your devices are CREST certified penetration testers. The advice is practical, because they break and fix these controls every week.

Certified ourselves

Heretek holds Cyber Essentials Plus, IASME Cyber Assurance Level One, ISO 27001 and ISO 9001, so we have been through the same process from the other side.

Plain answers

We tell you what will fail and why, in language a finance director and an IT manager can both act on. No jargon and no sales handoff.

Beyond the certificate

Cyber Essentials is a baseline, not a penetration test. When a contract or insurer wants more, the same team delivers the Compliance Kickstarter, penetration testing and the Managed Vulnerability Service.

Public sector ready

Appointed supplier on G-Cloud 15 and the Cyber Security Services 3 DPS, registered on JOSCAR, with security cleared consultants available for defence and government work.

Renewals handled

Certificates last twelve months. Tell us your expiry date and we plan the renewal so there is no gap in cover for your contracts or your insurance.

Fixed price, set by headcount

Cyber Essentials and Cyber Essentials Plus are fixed price. The price scales with the number of people in your organisation, so we always need a headcount to quote. Plus is priced separately from Cyber Essentials and includes the assessor’s testing time. Neither is covered by PTaaS days, which are for penetration testing and vulnerability assessment only.

Send us your headcount and which certificate you have been asked for, and we will come back with a price.

Common questions

Most of the time goes on getting the controls in place. Once they are, the questionnaire takes days rather than weeks, and the Plus testing is scheduled as soon as the Cyber Essentials certificate is issued, inside the three-month window. Tell us your deadline at the start and we plan backwards from it.

You get the questions or tests that fell short, with what to change. For Plus, anything found must be fixed within 30 days and is retested before the certificate is issued. We would rather find the gaps at the readiness stage than at assessment.

Yes. Cloud services you administer and the devices staff use to reach your data, including at home, are in scope. We help you draw the boundary correctly so nothing is missed and nothing is included unnecessarily.

No. It checks that five baseline controls are in place. A penetration test looks for ways an attacker would actually get in. Many clients do both: Cyber Essentials for the contract, and a test for the risk.

IASME includes cyber liability insurance with a £25,000 limit of indemnity, and a 24-hour incident helpline, for certified organisations that are domiciled in the UK or Crown Dependencies, have turnover under £20 million and have certified the whole organisation. It runs for the twelve months of the certificate and you opt in when you certify.

Yes. Scope can be the whole organisation or a defined part of it with its own network boundary. Note that the included insurance only applies when the whole organisation is certified. We agree the scope with you before the questionnaire starts.

Yes, if you qualify. The fund gives micro, small and medium-sized organisations that have not held Cyber Essentials in the past four years 75% off a new certificate, and IASME confirms the discount still applies when you certify through a Certification Body or assessor. Check your eligibility on the IASME First Step site, then tell us and we build it into the quote. It covers Cyber Essentials only; Plus is priced as normal.

Yes. Send us the expiry date and the last submission if you have it, and we start from there.

Ready to test what matters?

Tell us what you need tested and we will scope it with you.

What you get:

  • CREST certified penetration testing

  • Clear, prioritised findings with remediation guidance

  • Fixed scope engagements or PTaaS days
Purple light glowing through a dark pine forest

Ready to test what matters?

Tell us what you need tested and we will scope it with you.

What you get:

  • CREST certified penetration testing

  • Clear, prioritised findings with remediation guidance

  • Fixed scope engagements or PTaaS days