+44 (0)1482 770583
hello@systechitsolutions.co.uk
In short: How a client closed its security gaps and achieved Cyber Essentials certification, meeting the assurance its contracts and supply chain demanded.
The challenge
The client needed Cyber Essentials to satisfy contract and supply-chain requirements, but a first look revealed gaps across MFA, patching, device configuration and account management, the kind of issues that fail the assessment.
Most Cyber Essentials projects start commercially rather than technically: a contract, a tender or a supply-chain questionnaire requires the badge, and a date arrives with it. That framing is why so many first attempts fail. The certification is treated as paperwork to be completed, when the questionnaire is really a set of statements about controls that either are or are not in place. A first honest look at an estate almost always surfaces gaps in the same places, and finding them before an assessor does is the difference between a straightforward certification and a failed one.
What we did
- Assessed the estate against all five Cyber Essentials control themes
- Closed MFA and account-management gaps and tightened access
- Brought patching and device configuration up to the required standard
- Prepared the evidence and completed the self-assessment questionnaire
- Guided the client through to Cyber Essentials certification
Assess honestly against all five control themes
The estate was assessed against every Cyber Essentials control theme before any answers were drafted. Working the other way round, filling in the questionnaire and then justifying the answers, is how organisations end up self-certifying a position they cannot actually evidence.
Close the identity and access gaps first
MFA and account-management gaps were closed and access tightened. These are consistently the highest-risk findings and also the ones most likely to fail an assessment, so they are worth front-loading rather than leaving until the evidence-gathering stage.
Bring patching and device configuration to standard
Patching cadence and device configuration were brought up to the required standard. This is usually the stage that takes the longest, because it depends on the estate being fully known first, and unmanaged or forgotten devices have a habit of appearing here rather than earlier.
Prepare the evidence, then answer the questionnaire
Evidence was assembled and the self-assessment questionnaire completed against it. Sequencing evidence before answers keeps the submission defensible, every answer points at something real rather than at an intention.
See it through to certification
The client was guided through submission to certification rather than handed a completed form. The gap between a finished questionnaire and an awarded certificate is where most first-time attempts stall.
The results
- Cyber Essentials certified, meeting the contract requirements
- A measurably improved baseline security posture, not just a certificate
- A clear path to maintain the controls through to annual renewal
The client achieved Cyber Essentials certification and met the contract requirements that prompted the work. Because the gaps were genuinely closed rather than worked around, the outcome was a measurably improved baseline security posture rather than a certificate on its own, and a clear path to maintain those controls through to annual renewal.
What we would tell you before you start
Assess before you answer
The questionnaire is a set of claims about your controls. Establish what is true first, then complete it, not the other way round.
Plan for the renewal, not just the badge
Certification is annual and the controls have to hold in between. Estates that treat it as a one-off project tend to drift and face the same clean-up twelve months later.