Cyber Essentials Certification
Protect your business against the most common cyber threats, and prove it to your customers. Q6IT guides you through Cyber Essentials from start to certificate.
What is Cyber Essentials?
Cyber Essentials is the UK government-backed certification scheme that shows your organisation has the basic security controls in place to stop the most common online attacks, such as phishing, malware and password guessing.
It's suitable for organisations of every size and in every sector. More and more customers, public-sector contracts and supply chains now ask for it, and it gives your team and your clients real peace of mind.
Q6IT is Cyber Essentials certified itself, so we know exactly what the assessment asks for and how to get your systems ready.
The five controls
To pass, your business needs these five technical controls in place. We check each one and help you fix anything that falls short.
Firewalls
A secure barrier between the internet and your network, so only the traffic you want gets through.
Secure configuration
Computers, laptops and devices set up securely, with unused software and default passwords removed.
Security update management
Operating systems and software kept up to date, so known weaknesses are fixed before criminals can use them.
User access control
The right people with the right access, admin rights kept to a minimum, and multi-factor authentication switched on.
Malware protection
Viruses and other malicious software detected and stopped before they can harm your business.
Why get certified?
- Protect against the most common cyber attacks
- Win more work: many contracts and tenders require it
- Meet supply-chain and public-sector requirements
- Show customers and partners you take security seriously
- Use the Cyber Essentials badge on your website, tenders and email signatures
- Be listed on the official register of certified organisations
Certified through CyberSmart
Q6IT certifies through CyberSmart, a leading UK Cyber Essentials Certification Body. You get our local, hands-on support, plus everything CyberSmart's certification includes.
Simple online portal
A digital questionnaire with built-in guidance that saves your answers as you go. No spreadsheets or email chains, and you can see exactly what's left before you submit.
Unlimited attempts
If something doesn't pass, the assessor tells you what to fix and you can resubmit as many times as you need, at no extra cost.
IASME-assured assessors
Your application is reviewed by CyberSmart's UK-based team of IASME-assured assessors.
£25,000 cyber insurance
Free cyber insurance cover of up to £25,000 for eligible organisations when you certify. Exclusions and an excess apply; full details are in the policy wording.
Certificate and badges
A digital certificate and badges for your website, tenders, proposals and email signatures, plus a listing on the official register of certified organisations.
Ongoing protection
Optional extras such as Active Protect device monitoring and automatic patching keep you secure and compliant between assessments.
How it works with Q6IT
Readiness check
We review your devices, network, accounts and software against the five controls and agree what's in scope.
Fix the gaps
We sort out anything that would fail, from out-of-date software to missing multi-factor authentication.
Assessment
You complete the questionnaire in CyberSmart's online portal, with our help, and it's reviewed by an IASME-assured assessor.
Certified
You receive your Cyber Essentials certificate and badge, and we help you stay compliant all year ready for renewal.
What's changed in the latest requirements
The current Cyber Essentials question set, known as Danzell, keeps the same five controls but puts more weight on preparation and staying compliant all year round. In particular:
- Multi-factor authentication must be on for every cloud service that offers it.
- Vulnerabilities must be found and fixed within set timeframes.
- Scope is defined more strictly, so your certificate reflects your real setup.
- Year-round compliance: your declaration confirms you stay compliant every day, not just on assessment day.
- Cyber Essentials before Plus: any Cyber Essentials issues must be resolved before a Cyber Essentials Plus audit.
That makes being properly prepared before you start more important than ever, and it's exactly where we can help.
Funding for small businesses
Through the government's Cyber Essentials First Step Fund, eligible micro, small and medium-sized organisations can get a 75% discount on a new Cyber Essentials certificate until the end of March 2027, or until the funding runs out. Ask us whether your business qualifies.
Cyber Essentials Plus
Cyber Essentials Plus builds on the standard certificate with a hands-on technical audit of your systems by an assessor, giving you and your customers a higher level of assurance. Once you're Cyber Essentials certified, we can help you prepare for Plus too.
Frequently asked questions
Is Cyber Essentials difficult?
Not with the right preparation. Most businesses fail on a handful of common issues, such as unsupported software, missing updates or admin rights that are too widely shared. We find and fix these before you submit, and if anything does need changing you can resubmit as many times as you need at no extra cost.
How long does certification last?
A Cyber Essentials certificate is valid for 12 months. Certification is an annual subscription, so you won't miss your renewal, and we'll help you get ready for it.
Can organisations outside the UK get certified?
Yes. Any organisation doing business in the UK can certify, and many UK contracts require it.
Are there any downsides?
None. Cyber Essentials works alongside other standards. For extra assurance we'd recommend going on to Cyber Essentials Plus.
Get Cyber Essentials certified
Talk to our friendly team about getting your business ready and certified.