Cyber Essentials readiness review
We review your current setup against the main Cyber Essentials control areas, including devices, users, cloud services, access control, malware protection, patching and secure configuration.
Cyber Essentials readiness for small businesses
Cyber Essentials Made Easy: identity and access reviewed properly
Practical Cyber Essentials preparation for small and local businesses that want clear answers before they submit.
We review your readiness, look closely at your identity and access setup, identify gaps and give you a clear action plan so you know what needs fixing.
Plain-English support. Clear report. Practical action plan. No jargon-heavy security theatre.
Cyber Essentials Readiness
Identity & Access Review
Readiness snapshot
Clear next steps
Built around identity, access and practical security.
VertIAM is a specialist identity and access consultancy. This Cyber Essentials readiness service applies the same structured thinking to smaller businesses that need a practical path towards certification.
Identity and access focused
Microsoft 365 and cloud-aware
Practical policy templates
Clear gap report
Guided assessment support
Optional remediation support
Cyber Essentials is simple in principle. The tricky part is knowing whether your setup is ready.
For many small businesses, the challenge is not only completing the assessment. The challenge is knowing whether the answers are accurate, defensible and supported by real working practices.
Are administrator accounts properly controlled?
Is multi-factor authentication enabled where it should be?
Are leavers removed quickly enough?
Are shared accounts or generic logins being used?
Are devices patched, supported and tracked?
Are cloud services included in the assessment scope?
Are firewall, malware protection and update controls documented?
Do policies reflect how the business actually works?
What you get
The service gives you a clear view of where you stand, what needs fixing and what to do next.
Identity and access health check
We look closely at users, administrators, MFA, shared accounts, leavers, third-party access and cloud sign-in risks.
Gap report
You receive a plain-English report showing what looks ready, what needs attention and what may create problems during assessment.
Prioritised action plan
We turn findings into practical next steps, prioritised by risk, effort and certification impact.
Policy starter pack
Lightweight policy templates and checklists that small businesses can adapt and use.
Guided assessment support
Where required, we help you prepare accurate answers for the Cyber Essentials online assessment.
Why identity matters
Cyber Essentials is not just antivirus, firewalls and software updates.
For many modern small businesses, the biggest security risks sit around cloud accounts, email, administrator access, weak authentication, unmanaged devices and old user accounts that should no longer exist.
Who has access to your business systems?
Who has administrator rights?
Are privileged accounts protected properly?
Are users required to use multi-factor authentication?
Are leavers removed from systems consistently?
Are suppliers, contractors and external users managed?
What we review
The exact scope depends on your business, but a typical review includes these areas.
Business and assessment scope
Business structure, users, locations, remote working, key systems, cloud services, devices and whether the whole organisation or a defined subset is in scope.
Identity and access
Microsoft 365, Google Workspace or equivalent cloud identity, user accounts, administrators, MFA, shared mailboxes, leavers, external users and privileged access risks.
Devices and software
Laptops, desktops, mobile devices where relevant, supported operating systems, updates, local admin rights, device ownership and anti-malware controls.
Cloud and business systems
Email, file storage, collaboration tools, CRM, accounting systems, SaaS administrator access and access from unmanaged or personal devices.
Policies and procedures
Access control, password and MFA, device use, software updates, acceptable use, leavers, incident reporting and asset register templates.
Assessment preparation
Review of likely answers, supporting evidence, unclear areas and practical changes to make before submitting.
Your deliverables
At the end of the review, you receive a practical pack that can be used immediately.
Cyber Essentials readiness report
Identity and access findings
Prioritised action plan
Policy and checklist pack
Assessment preparation notes
Optional remediation support
How it works
A contained process designed for busy small businesses.
Initial readiness call
We discuss your business, systems, current IT support, certification deadline and why you need Cyber Essentials.
Information gathering
You receive a simple checklist covering users, devices, cloud services, admin accounts, policies and any answers you have already drafted.
Review workshop
We run a structured review covering Cyber Essentials readiness and your identity and access setup. This can usually be done remotely.
Gap report and action plan
You receive a clear report showing what looks ready, what needs clarification and what should be fixed before submission.
Remediation support
You can fix actions yourself, ask your IT provider to implement them or ask VertIAM to support selected remediation tasks.
Assessment preparation
Once the main gaps are addressed, we help you prepare accurate responses for the online assessment.
Simple packages
Start with a readiness review and only add further support if needed.
Cyber Essentials Readiness Review
Best for businesses that want to understand where they stand before starting the assessment.
- Initial readiness call
- Scope review
- Cyber Essentials control review
- Identity and access health check
- Gap summary and action plan
- 30-minute follow-up call
Readiness Review + Policy Pack
Best for businesses that need technical clarity and basic documentation.
- Everything in the Readiness Review
- Access Control Policy template
- Password and MFA Policy template
- Acceptable Use Policy template
- Device and Patch Management Policy template
- Joiner, Mover and Leaver checklist
- Light tailoring guidance
Guided Readiness + Assessment Support
Best for businesses with a deadline, tender requirement or customer assurance need.
- Everything in the Readiness Review + Policy Pack
- Assessment answer preparation support
- Review of draft answers before submission
- Additional remediation planning session
- Support call during assessment completion
- Final readiness check
Optional add-ons
Microsoft 365 security configuration support
Leaver and access clean-up
Device and patching process support
Cyber Essentials Plus preparation
Who this is for
- Small businesses preparing for Cyber Essentials.
- Teams that need certification for a tender, client, insurer or supplier requirement.
- Businesses using Microsoft 365, Google Workspace or cloud-based systems.
- Organisations that want a clear action plan before submitting.
- Companies with basic IT support that want independent readiness guidance.
When it is not the right fit
- You need a company to issue the certification directly.
- You need a fully managed IT support provider.
- You need 24/7 security monitoring.
- You want deep penetration testing.
- You are a large enterprise needing a full identity transformation programme.
Local business support
Practical support for small businesses in the North West and beyond.
Many small businesses do not need a large cyber programme. They need someone to explain the requirements clearly, identify what is missing and help them take sensible steps towards certification.
VertIAM can work directly with your business or alongside your existing IT provider, including firms around Cheshire, Chester, Liverpool, Manchester and the wider North West.
Certification boundary
A clear note on certification
VertIAM helps you prepare for Cyber Essentials. We review readiness, identify gaps, provide policy templates, support remediation planning and help you prepare assessment answers.
Certification itself is completed through the official Cyber Essentials assessment process and assessed by an authorised certification route. We don't describe your organisation as certified until your certificate has been formally issued.
Need Cyber Essentials without the confusion?
Start with a short readiness call. We will discuss your business, your current setup, your deadline and whether this service is the right fit.
Frequently asked questions
Can VertIAM certify us for Cyber Essentials?
No. VertIAM provides readiness, review, policy and assessment preparation support. Certification is assessed and issued through the official Cyber Essentials certification process.
Can you complete the assessment for us?
We can support you in preparing your answers and guide you through the assessment process, but the answers must accurately reflect your organisation, systems, controls and working practices.
What if we already have an IT provider?
That is fine. VertIAM can provide the review, gap report and action plan while your IT provider implements some or all of the technical changes.
Do you support Microsoft 365 and Google Workspace?
Yes. We can review users, administrators, MFA, shared mailboxes or shared access, external access and related identity controls across Microsoft 365, Google Workspace or similar cloud services.
How long does it take?
For a small business with a straightforward setup, the readiness review can usually be completed with a small number of focused sessions. The certification timeline depends on how many gaps need to be fixed before submission.
Can you help us fix the gaps?
Yes. VertIAM can help with selected remediation tasks, especially around identity, access, MFA, administrator accounts, Microsoft 365 configuration, policy creation and process improvement.
Book a Cyber Essentials readiness call
Tell us a little about your business and what you need. We will respond to arrange a short call.
Email VertIAM