Cyber Essentials Readiness
Get Ready for Cyber Essentials with Confidence
Pulsar IT helps you understand what Cyber Essentials requires, find the gaps in your systems, fix them and prepare your application. Certification itself is issued through an independent, IASME-licensed certification body.
What is Cyber Essentials Readiness?
Cyber Essentials is a UK government-backed certification scheme, overseen by the National Cyber Security Centre (NCSC), that shows your organisation has basic technical controls in place against the most common cyber attacks. You complete an online self-assessment questionnaire, which is reviewed by an independent certification body licensed through IASME, the NCSC's Cyber Essentials delivery partner.
Our readiness service gets you to the point where you can answer that questionnaire accurately and confidently. We check your devices, accounts, network equipment and cloud services against the current requirements, help you fix what falls short, and support you as you prepare your application.
Pulsar IT does not assess or certify. We prepare you for assessment; the certification body reviews your answers and issues the certificate if you meet the requirements.
Key benefits
- A clear picture of where you stand against the current requirements
- Gaps found and fixed before your assessment, not after
- A scope you can explain, including cloud services and home-working devices
- Support preparing accurate answers for the self-assessment questionnaire
- Controls that keep protecting the business after certification
How does it work?
Cyber Essentials checks five technical control areas across everything in scope. We work through them with you, starting with scope, because what is in scope decides what has to meet the requirements.
Agree the scope
We help you decide whether to certify the whole organisation or a clearly separated part of it, and list the devices, users, networks and cloud services that fall within it, including home-working devices and personally owned devices that access work data.
Readiness assessment
We check your setup against each of the five control areas and the current version of the requirements, and give you a gap list ranked by what would be most likely to cause a fail.
Technical remediation
We help close the gaps: switching on MFA, applying updates, removing unsupported software, separating admin accounts, tightening firewall rules and confirming malware protection. Any work beyond the agreed scope is quoted before it starts.
Prepare your application
We help you gather the information and draft accurate answers. You buy the assessment through IASME and submit the questionnaire; the certification body reviews it and issues the certificate if you meet the requirements.
- ScopeDevices, users, networks and cloud services
- Readiness assessmentChecked against the five control areas
- RemediationGaps closed before you apply
- Your applicationSelf-assessment questionnaire submitted by you
- Certification bodyIASME-licensed body reviews and certifies
What the readiness assessment covers
- Scope definition, including any separated parts of your network and how they are separated
- End-user devices: desktops, laptops, tablets and phones, including personally owned devices that access work data
- Home and remote working devices, and any routers your organisation supplies
- Cloud services that store or process your data, such as Microsoft 365, which cannot be excluded from scope
- Boundary firewalls, routers and wireless equipment
- Servers, whether on site or hosted
- Support status of operating systems and software
- MFA coverage across every cloud service where it is available
- Admin account separation and how access is approved and removed
- Password and device-unlock settings
Common reasons organisations fail
MFA missing on a cloud service
Often a less-used system rather than email. Under the current requirements, not using MFA where it is available is an automatic fail.
Unsupported software
Windows 10 reached end of support on 14 October 2025, so devices still running it need upgrading, replacing or another supported option agreed with the assessor.
Default passwords
Routers, firewalls and other equipment still using the administrative password they shipped with.
Everyday work from admin accounts
Staff reading email or browsing the web while signed in with administrator rights.
The five Cyber Essentials control areas
Every device, account and service in scope has to meet the same five technical controls. This is what our readiness assessment checks under each one.
Firewalls
Every in-scope device is protected by a correctly configured firewall. Default admin passwords are changed, inbound rules are approved and documented, and laptops used on untrusted networks such as public Wi-Fi have a software firewall switched on.
Secure configuration
Unneeded accounts and software are removed, auto-run is disabled and device unlocking is protected against guessing. Where a PIN or password is used only to unlock a device, it must be at least six characters.
Security update management
All software must be licensed and supported. Critical and high-risk security updates, including router and firewall firmware, must be installed within 14 days of release.
User access control
Accounts are created through a defined process, admin accounts are used only for admin tasks, and MFA is used on every cloud service. Missing MFA on a cloud service where it is available is an automatic fail.
Malware protection
Windows and macOS devices run up-to-date anti-malware software that stops malicious code and blocks malicious websites, or application allow listing is used so only approved applications can run.
Version 3.3 of the requirements applies to assessment accounts created from 27 April 2026. Our Cyber Essentials requirements guide explains each control and what changed in more detail.
Problems solved
A contract or tender requires Cyber Essentials
We help you prepare in an organised way, so you know exactly what has to change before you apply.
Unsure what is in scope
Cloud services, home-working laptops and personal phones are easily overlooked. We help you define and justify your scope.
Worried about failing
Finding and fixing gaps first means fewer surprises when the certification body reviews your answers.
Questions that are hard to interpret
We explain what each control means for your systems in plain English, so your answers reflect how things really work.
A renewal under new requirements
Certificates last 12 months and the requirements are reviewed each year. We check what has changed since your last assessment.
What's included
Included as standard
- Scoping session to agree what the assessment will cover
- Readiness assessment against the five control areas and the current requirements
- Prioritised gap list highlighting likely fail points
- Technical remediation of agreed gaps, as set out in your proposal
- Help gathering information and preparing your questionnaire answers
- Guidance on buying your assessment through IASME
Optional or scoped
Available on request and confirmed in your proposal; not part of the standard service.
- Additional remediation found during the readiness assessment, quoted before it starts
- Upgrade or replacement of unsupported devices and software
- Moving on to Cyber Essentials Plus Preparation Support
- Ongoing patching and device management through a managed IT plan, to stay on track between renewals
What's not included
- The certification itself, which is issued through an IASME-licensed certification body
- Certification body assessment fees, which are paid separately
- Hardware, software licences and replacement devices
- Answering the questionnaire on your behalf: your organisation remains responsible for the accuracy of its answers
Pulsar IT prepares organisations for assessment; it does not assess or certify. The certification decision rests with the certification body.
Cyber Essentials is a baseline against common attacks. Certification is a strong starting point, but it does not mean an organisation is protected against every threat.
Once an assessment account is created, you have six months to complete the assessment, so it usually makes sense to create the account once remediation is well under way.
Who it's suitable for
- Businesses bidding for UK government contracts that require Cyber Essentials
- Suppliers whose customers ask for Cyber Essentials
- Organisations applying for the first time
- Businesses renewing after a change to the requirements
- Organisations that want a recognised security baseline
Pricing
Our readiness support is tailored to your scope, so we confirm the price after reviewing your requirements. The certification body's assessment fee is separate: IASME publishes its current fees, which are tiered by organisation size.
Use the quote builder to add Cyber Essentials Readiness to an indicative quote, or book a free security review and we'll recommend what fits.
Price
Price Based on Scope
Price to be confirmed following a review of your requirements.
What affects the price
- Number of users and devices in scope
- Number of sites and cloud services
- Whole-organisation or separated scope
- How many gaps need fixing
- Whether we already manage your IT
All prices exclude VAT.
Add to Your QuoteFrequently asked questions
Does Pulsar IT issue the Cyber Essentials certificate?
No. Certificates are issued through independent certification bodies licensed by IASME, the NCSC's Cyber Essentials delivery partner. We help you get ready and prepare your application.
What changed in the April 2026 requirements?
Version 3.3 applies to assessment accounts created from 27 April 2026. The biggest changes are to marking: MFA must be used on every cloud service where it is available, and not doing so is an automatic fail. Cloud services that store or process your data can no longer be excluded from scope. Our Cyber Essentials guide covers the detail.
Are home-working laptops and personal phones in scope?
Devices that access your organisation's data or services are in scope, including personally owned devices and those used at home. Phones used only for calls, texts and MFA apps are out of scope. Home routers are in scope only if your organisation supplies them, so other home-working devices need their own software firewall.
How long does a certificate last?
12 months. To keep your certification you renew each year, against whichever version of the requirements is current at the time.
How much does the certification cost?
Assessment fees are set and published by IASME and tiered by organisation size, so check their current price list. Those fees are separate from our readiness support, which we quote after reviewing your scope.
Let's Secure Your Business
Find out how Pulsar IT can help protect, manage and improve your IT environment.