Guidance for applicants

Attackers go after managed service providers because one breach unlocks every client. PHP2Shell showed how little time there is. Here's how MSPs should prioritise their own estate, their clients' systems and the Cyber Essentials evidence trail.

Two critical PHP flaws took government websites offline and drew attacks within minutes of the fix. Here's what PHP2Shell means for the Cyber Essentials 14-day patching rule, and why hours now matter.

Marking Only or Supported? Both lead to the same Cyber Essentials certificate. The real difference is how much risk you want to carry. Here's what each service includes, how marking turnaround works, and how to choose.

Separate admin accounts aren't just for Windows. Here's why Cyber Essentials account separation applies to every cloud service, with guidance for Facebook and Instagram (Meta Business Suite), Microsoft 365 and Google Workspace.

Looking to download your Cyber Essentials logo? Here's why it comes as a BlockMark smart badge rather than an image file, and how to add the Cyber Essentials logo to your email signature and website.

Need Cyber Essentials certificates for a parent company and its subsidiaries? Here's which legal entities can share a certification, what to enter at A1.1 and A1.6.1, and how to buy £10 additional certificates under the Danzell question set.

A step-by-step guide to setting up your BlockMark account after Cyber Essentials certification, downloading your certificate, and adding your certification badge to your website and email signature.

Need someone else to help complete your Cyber Essentials self-assessment? Here's how to add a Helper to your IASME portal account in five simple steps.

This is a quick overview to outline the possible solutions MSP's use to overcome the Cyber Essentials requirement to use individual logins.

A guide on what to check in order to ensure that you meet the 14 day patching rule for Cyber Essentials.

# Building Compliant Processes for Cyber Essentials Certification Category: Guidance for Applicants | Read time: ~7 min Two of the most common reasons applicants receive a non-compliance finding during a Cyber Essentials assessment are not what most people expect. It is rarely a missing firewall rule or an unpatched device. More often, it comes down to how a process is described — or rather, how it is not described. Earlier articles in this Resource Hub have explored the diff

The Cyber Essentials April 2026 questionnaire is released today. This article explains the main changes and what you should expect.

Preparing for Cyber Essentials? Learn how to set up user account separation on Windows 11 with this step-by-step guide from a senior assessor. Covering admin and standard user accounts, common mistakes, and how to pass first time.

Why Network Segregation Matters: Cyber Security and Scoping Cyber Essentials in light of the April 2026 assessment changes.

Article detailing the importance of asset management and how to go about documenting your estate ready for Cyber Essentials.

To be complaint your organisation should apply the principle of least privilege. This article explains why this is needed and whats required.

✅ Updated June 2025 — This blog has been revised to align with the Cyber Essentials Requirements for IT Infrastructure v3.3 (April 2026), published by the NCSC. You can download the latest version of the document here: Cyber Essentials Requirements for IT Infrastructure v3.3 What's in Scope for Cyber Essentials? When planning for Cyber Essentials certification, one of the first and most important decisions your organisation must make is establishing the scope of the assessmen

Why you need MFA for all users and administrators for full Cyber Essentials compliance

Cyber Essentials certification helps organisations prove they have basic cybersecurity measures in place. Many businesses see it as a straightforward step to improve security and build trust with clients. With the rise of AI tools, some might consider using artificial intelligence to complete their Cyber Essentials assessment. While AI can assist in many areas, relying on it entirely for this assessment carries significant risks that could undermine your security efforts. Why

One of the most frequent points of confusion we see from Cyber Essentials applicants relates to personally owned devices or Bring Your Own Device (BYOD). Many organisations assume that if a device is owned by a member of staff rather than the business, it is automatically out of scope for Cyber Essentials.This assumption is incorrect and regularly leads to failed assessments. This article explains the correct position under the Cyber Essentials scheme and provides practical g