Inspizer helps organisations achieve Cyber Essentials and Cyber Essentials Plus certification — assessing your current environment against all five controls, remediating what needs fixing, and supporting you through the assessment submission so there are no surprises on the day.
We hold the certification ourselves. We know what the assessor checks in your Microsoft 365 environment — and how to fix it.
Cyber Essentials is a UK government-backed cybersecurity certification scheme, developed by the National Cyber Security Centre (NCSC). It defines a baseline of five technical security controls that protect organisations against the most common cyber attacks.
The scheme was introduced because the majority of successful cyber attacks — phishing, ransomware, credential theft, and exploitation of unpatched software — succeed not because they are sophisticated, but because the basics were missing. Cyber Essentials defines what those basics are and provides a framework for verifying that they are in place.
For many organisations, Cyber Essentials certification is not optional. It is a requirement for bidding on UK government contracts, a condition of cyber insurance policies, and an expectation in NHS supply chains, MOD procurement, and other regulated sectors. For others, it is the most credible signal they can send to clients and partners that their security posture has been independently assessed.
There are two levels of certification:
Cyber Essentials — A self-assessed questionnaire, verified by an external certifying body. The organisation answers questions about how the five controls are implemented; a qualified assessor reviews the answers and issues the certificate if the requirements are met.
Cyber Essentials Plus — Everything in Cyber Essentials, plus an independent technical audit. An assessor connects to your environment and verifies the controls are actually in place — not just documented. This is the level required for government contracts above certain thresholds and for MOD supply chain inclusion.
Inspizer supports both levels — and the work required to achieve them is largely the same. The difference is in how you are assessed, not what you need to have in place.
Any organisation bidding for UK government contracts that involve the handling of certain sensitive information or the provision of certain technical services is required to hold Cyber Essentials certification. This applies to central government, local authorities, and arm's length bodies.
NHS suppliers and healthcare technology providers are increasingly required to demonstrate Cyber Essentials as part of procurement and supply chain security requirements. The NHS Data Security and Protection Toolkit references the Cyber Essentials controls directly.
The Ministry of Defence requires Cyber Essentials Plus certification for suppliers handling personal data or sensitive information as part of the Cyber Security Model (CSM). Defence contractors and subcontractors at all tiers are affected.
An increasing number of cyber insurance policies require or incentivise Cyber Essentials certification. Insurers recognise that organisations with the five controls in place are materially less likely to experience an insurable cyber incident.
Enterprise clients and large organisations routinely ask smaller suppliers to demonstrate security credentials as part of vendor onboarding. Cyber Essentials is the most widely recognised baseline standard in the UK and the most practical to achieve.
For organisations without a specific external requirement, Cyber Essentials provides a structured framework for implementing the controls that matter most — and independent verification that they are working. It is the most practical starting point for any organisation's security programme.
Cyber Essentials is built around five technical controls. Each one targets a category of attack that accounts for a significant proportion of real-world cyber incidents. All five must be in place to achieve certification.
Boundary firewalls and internet gateways must be in place and configured to block unauthorised access. In a Microsoft 365 environment this includes Windows Firewall configuration on all devices, Intune device compliance policies, and network-level controls. The assessment checks that no unnecessary ports or services are exposed to the internet.
Computers and network devices must be configured securely — default passwords changed, unnecessary accounts removed, unnecessary software uninstalled. In Microsoft 365 environments this means Intune compliance baselines, Microsoft Secure Score configurations, and Entra ID settings that prevent misconfigured defaults from creating exposure.
User accounts must have only the access they need and no more. Standard users should not have administrative rights on their devices. Administrative accounts should only be used for administrative tasks. In Microsoft 365 this maps directly to Entra ID role assignments, Conditional Access policies, and Privileged Identity Management — controls Inspizer implements as part of standard security engagements.
All devices must be protected against malware — antivirus running and up to date, or application control preventing execution of untrusted software. In Microsoft 365 environments this means Microsoft Defender for Business or Defender for Endpoint, configured through Intune, with real-time protection enabled and definitions current on all managed devices.
Software must be kept up to date — operating systems and applications patched within 14 days of a critical or high-severity update being released. In Microsoft 365 environments this means Windows Update for Business policies deployed through Intune, Microsoft 365 Apps update channels configured to receive updates promptly, and a clear process for managing third-party software patching.
We don't hand you a questionnaire and wish you luck. We work through the five controls with you, fix what needs fixing, and make sure the submission reflects what is actually in place — because submissions that describe a better environment than the real one fail assessment.
We assess your current environment against all five Cyber Essentials controls — what is in place, what is partially in place, and what is missing entirely. The output is a written gap report with a clear red/amber/green status against each requirement and a prioritised list of remediation tasks.
We implement the changes required to meet the controls that are currently failing. For Microsoft 365 environments — Entra ID, Intune, Defender, Conditional Access, Windows Update policies — this is work Inspizer does every day. We do not leave you with a to-do list and a deadline.
Before you submit the questionnaire, we review your answers against what is actually in your environment. Cyber Essentials assessors reject submissions that claim controls are in place that are not correctly configured. The pre-submission review is where those discrepancies are caught.
We support you through the submission process — answering questions from the certifying body, providing additional evidence where required, and managing any clarification requests. For CE Plus assessments, we prepare the environment for the technical audit and are available during the assessor's review.
Once the certificate is issued, we document the controls that are in place and the configuration decisions made during remediation. This documentation is essential for maintaining the controls going forward — and for annual recertification, which Cyber Essentials requires every twelve months.
Cyber Essentials certification expires after twelve months. We offer recertification support — reviewing what has changed in your environment over the past year, confirming the controls remain in place, and supporting the submission. Organisations that manage their environment consistently rarely fail recertification.
Inspizer is Cyber Essentials certified. We went through the same assessment process we are helping you navigate, in a real Microsoft 365 environment. That experience matters when the questions on the assessment aren't as clear as they should be — we know what the certifying body is actually looking for.
The five Cyber Essentials controls, in a Microsoft 365 environment, are implemented through Entra ID, Intune, Defender, Windows Update for Business, and Conditional Access. These are the tools Inspizer configures every day. We don't need to research how to implement the controls in your environment — we already know.
A gap analysis that identifies 12 remediation tasks and hands them back to you is not a Cyber Essentials engagement — it's a report. Inspizer does the remediation. The controls are in place when we hand over, not on a list of things your IT team needs to get around to.
| Cyber Essentials | Cyber Essentials Plus | |
|---|---|---|
| Assessment method | Self-assessment questionnaire reviewed by certifying body | Independent technical audit of your environment |
| Level of assurance | Controls documented and reviewed | Controls verified in your live environment |
| Government contracts | Required for most contracts | Required for higher-risk contracts |
| MOD supply chain | Not sufficient | Required |
| Typical timeline | 2–4 weeks (from gap analysis to certificate) | 4–8 weeks (includes technical audit scheduling) |
| Validity | 12 months | 12 months |
| Inspizer support | Gap analysis, remediation, submission support | Gap analysis, remediation, audit preparation, on-day support |
Not sure which level you need? We'll tell you on the readiness call — it depends on the contract or requirement you're trying to meet.
Five technically specific controls chosen because they address the most common attack vectors. Every control must pass before certification is awarded.
From the initial gap analysis to certificate issuance, most organisations achieve Cyber Essentials in two to four weeks. The timeline depends on how many remediation tasks are identified and how quickly they can be implemented. Cyber Essentials Plus takes longer — four to eight weeks is typical — because the technical audit needs to be scheduled with the certifying body and your environment needs to be in the correct state before the assessor connects. If you have a specific deadline (a contract bid, a procurement requirement), tell us on the readiness call and we will plan the timeline around it.
Failing a Cyber Essentials assessment happens when the questionnaire describes controls that are not correctly implemented in the actual environment, or when a CE Plus technical audit finds gaps between what was submitted and what is in place. Inspizer's pre-submission review is specifically designed to prevent this — we verify that the answers in your questionnaire match your actual configuration before you submit. If you are working with us from the gap analysis stage, a failed submission is an unusual outcome. If you approach us after a failed submission, we can review what went wrong and remediate for a resubmission.
Easier — provided your Microsoft 365 environment is correctly configured, which is where most organisations need help. Microsoft 365 provides the tools to meet all five Cyber Essentials controls natively: Defender for Business covers malware protection, Intune covers device configuration and update management, Entra ID covers user access control and MFA, and Windows Firewall managed through Intune covers the boundary firewall requirement. The challenge is that these tools need to be correctly configured — default settings are not sufficient for Cyber Essentials compliance. Inspizer configures these controls as part of the engagement, so your Microsoft 365 environment meets the requirements before you submit.
Yes — the updated Cyber Essentials requirements (from January 2022 onward) include cloud services. The boundary firewall control now covers cloud-based firewalls and security groups. User access control applies to cloud accounts and SaaS applications. Patch management applies to cloud-hosted software. The practical implication is that your Microsoft 365 configuration, your cloud infrastructure, and your SaaS applications are all in scope — not just your on-premises devices. Inspizer's gap analysis covers the full scope of the assessment, including cloud services.
Yes. Cyber Essentials certification expires after twelve months and must be renewed annually. The recertification process follows the same structure as the original certification, but the gap analysis focuses on what has changed in your environment over the past year — new devices, new cloud services, software changes, user access changes. Organisations that have maintained their controls consistently typically find recertification straightforward. We provide a lightweight recertification review to confirm everything is still in order before you resubmit.
It depends entirely on what you need the certification for. Basic Cyber Essentials is sufficient for the majority of UK government contracts and for most client and partner requirements. Cyber Essentials Plus is required for government contracts involving sensitive information above certain thresholds, for MOD supply chain inclusion, and for some higher-assurance procurement frameworks. If you tell us what you need the certification for — on the free readiness call — we will tell you which level applies and whether Plus is genuinely required or whether basic Cyber Essentials will serve your purpose.
No sales pitch. Just an honest conversation about what your Microsoft 365 environment needs and how we can help.