Cyber Essentials and Cyber Essentials Plus, Done for You
We get you ready, fix anything that would fail and complete the questionnaire with you. Our certification partner, Citation, issues the certificate.
Indigo Unified Communications helps businesses and charities across Glasgow and Scotland get Cyber Essentials and Cyber Essentials Plus. We check your setup, fix anything that would fail and complete the self-assessment answers with you. Your director reviews and approves the answers. Our certification partner, Citation, assesses them, issues the certificate and carries out the Cyber Essentials Plus audit. Indigo holds both certificates itself, also certified through Citation. Start with a free readiness check, then get a fixed quote.
What are Cyber Essentials and Cyber Essentials Plus?
Cyber Essentials is the UK government-backed certification scheme, run by IASME for the National Cyber Security Centre (NCSC). Both levels check the same five controls: firewalls, secure configuration, security update management, user access control and malware protection. The difference is how they're checked.
| Cyber Essentials | Cyber Essentials Plus | |
|---|---|---|
| How it's checked | An online self-assessment questionnaire, marked by an assessor | A hands-on technical audit of a sample of your devices, plus an external scan |
| Who signs it off | A director or other board member declares the answers are true | The audit tests the controls directly |
| Who does what | We prepare you and complete the answers with you. Citation assesses and certifies | We prepare you and fix any gaps. Citation carries out the audit and certifies |
| Timing | Comes first | Must follow within 3 months of the basic certificate |
| Valid for | 12 months | 12 months |
Who needs Cyber Essentials?
It isn't a legal requirement, but buyers, insurers and funders increasingly expect it.
- Tenders. UK central government contracts that handle personal data or OFFICIAL information require it under PPN 014, which replaced PPN 09/23 in February 2025. Scottish public bodies decide case by case. Councils, housing associations and principal contractors often ask for it.
- Insurers. The NCSC reports that organisations with Cyber Essentials are 92% less likely to make a claim on their insurance. UK organisations with turnover under £20m that certify the whole organisation can opt in to £25,000 of free cyber liability cover for 12 months.
- Funders and customers use it to check their suppliers.
Few businesses have it yet. In the government's Cyber Security Breaches Survey 2025/2026, 17% of businesses had heard of Cyber Essentials and 5% held it (12% of small businesses). Yet 46% of small and 65% of medium businesses reported a breach or attack.
By sector:
- Construction: principal contractors ask for it at pre-qualification. A Central Scotland building firm of about 160 staff that we support has since achieved Cyber Essentials Plus. IT for construction →
- Charities: funders and trustees want proof that donor and beneficiary data is protected. IT for charities →
- Renewable energy: developers and utilities check suppliers before sharing project data. IT for renewable energy →
- Leisure and entertainment: venues hold card and customer data across sites. IT for leisure →
How does it work with Indigo?
- Free readiness check. Ten questions online, then a call to agree the scope: sites, devices, cloud services and legal entities.
- Fixed quote, then we fix it. We put right anything that would fail, such as multi-factor authentication that isn't switched on, missing updates, unsupported software and everyday accounts with admin rights.
- We complete the questionnaire with you. We draft the answers from what we've checked and go through them together. Your director reviews and approves them.
- Citation certifies. Our certification partner, Citation, assesses the answers and issues the certificate.
- Cyber Essentials Plus audit. Citation audits a sample of your devices within 3 months of the basic certificate. We prepare you and fix anything it finds.
- Annual renewal. Certificates last 12 months. We keep the controls in place and take you through renewal.
What changed in April 2026?
From 27 April 2026, Cyber Essentials moved to version 3.3 of the requirements and the Danzell question set. From late October 2026, when the six-month transition ends, everyone is on the new rules.
- Multi-factor authentication must be on for every cloud service that offers it, or you fail automatically.
- Critical and high-risk updates must be installed within 14 days, and two new questions on this now fail you automatically.
- Cloud services can't be left out of scope. Home laptops and personal phones used for work stay in scope too.
- Cyber Essentials Plus: if you fail and are retested, the retest checks different devices, and a second failure revokes the certificate.
What commonly fails?
| What fails | Why it matters | How we fix it |
|---|---|---|
| MFA off on a cloud service | Automatic failure since April 2026 | Turn it on everywhere, starting with Microsoft 365 and admin accounts |
| Updates older than 14 days | Automatic failure | Automatic patching with Datto RMM and Intune |
| Unsupported software | Windows 10 PCs outside paid Extended Security Updates count as unsupported | Enrol, upgrade or replace |
| Everyday accounts with admin rights | Fails user access control | Separate admin accounts for the few who need them |
| Router or firewall on default settings | Fails firewalls and secure configuration | Change passwords, close remote admin access |
| Unmanaged personal phones and home laptops | In scope, but often forgotten | Manage them in Intune or remove access |
Why choose Indigo for Cyber Essentials?
- We hold it ourselves. Indigo is Cyber Essentials certified (valid to 27 February 2027) and Cyber Essentials Plus certified (valid to 6 May 2027) through IASME. We were certified through Citation, the same partner we use for our clients.
- We fix as well as advise. Our engineers make the changes with Microsoft Intune, Datto RMM and Kaseya 365 Endpoint. We're also ISO 27001:2022 certified.
- No need to switch IT provider. It's included in our Platinum package, and any business can buy it on its own.
Frequently asked questions
Does Indigo issue the Cyber Essentials certificate?
No. Indigo prepares you, fixes anything that would fail and completes the self-assessment answers with you. Your director reviews and approves the answers. Our certification partner, Citation, assesses them, issues the certificate and carries out the Cyber Essentials Plus audit. The scheme keeps preparation and certification separate.
How much does Cyber Essentials cost?
IASME's certification fees run from £320 plus VAT for up to 9 staff to £600 for 250 or more. Cyber Essentials Plus is quoted on your devices and sites. Our work depends on how much needs fixing, so we start with a free readiness check, then give you one fixed quote that includes Citation's certification fee and, for Cyber Essentials Plus, the audit.
How long does it take to get Cyber Essentials?
It depends mostly on how much needs fixing first. From the readiness check to the certificate usually takes 4 to 8 weeks. Cyber Essentials Plus must then follow within 3 months of the basic certificate. The readiness check shows how much work there is before you commit.
Who signs the Cyber Essentials declaration?
A director or other board-level person must declare that the answers are true. We complete the answers with you and explain each one, but the declaration is your organisation's. That's why we check your setup first.
Do we have to switch IT provider?
No. Indigo offers Cyber Essentials and Cyber Essentials Plus preparation as a standalone service, and it's included in our Platinum managed IT package. We can work alongside your current IT provider.
Find out what would fail before you pay for an assessment
The readiness check takes 2 minutes and shows your biggest gaps.