Cyber Essentials in Liverpool, Chester and Cheshire: getting certified, step by step

Short answer: Cyber Essentials is the UK government-backed scheme that certifies a business has five basic security controls in place. For a small business in Liverpool, Chester or anywhere in Cheshire, getting it is usually a few weeks of fixing gaps and then an online assessment, marked by an accredited certification body. The certificate lasts a year. Most of the work is in the fixing, not the form.

Cyber Essentials in Liverpool and across Cheshire tends to come up for one of three reasons: a client’s supplier questionnaire, a public-sector contract that requires it, or an insurer asking whether you hold it. This guide covers what the scheme checks, the difference between Cyber Essentials and Cyber Essentials Plus, the steps to getting certified, and where the time actually goes.

Need Cyber Essentials for a contract or a client? Ring 0151 452 3060 and a person picks up. Or see IT support run to Cyber Essentials standards, from £55 a person a month.

A note on who does what. The certificate is issued by a certification body licensed by IASME, the NCSC’s delivery partner for the scheme. We’re an IT and cyber security provider: we run to Cyber Essentials standards, and we get businesses ready by fixing what would fail. You then submit the assessment to a certification body of your choice.

What Cyber Essentials checks

Cyber Essentials covers five technical controls. They’re deliberately basic, because they’re the ones that stop the most common attacks.

1. Firewalls. Every device that connects to the internet sits behind a properly configured firewall, including laptops used at home. Default settings and default admin passwords on routers don’t pass.

2. Secure configuration. Unused software removed, default passwords changed, and auto-run switched off. Fewer ways in means fewer things to defend.

3. Security update management. Critical and high-risk updates applied within 14 days of release, on every device in scope, and nothing running past its end of support. It’s the easiest control to fail by accident, because one forgotten laptop or old server is enough.

4. User access control. Staff have the access their job needs and no more. Administrator accounts are separate, few and not used for everyday work, and leavers lose access promptly. Multi-factor sign-in is expected on cloud services such as Microsoft 365 wherever it’s available.

5. Malware protection. Antimalware on every device, kept up to date, or controls that stop unapproved software from running at all.

None of that needs expensive products. It needs the settings right on every device, and someone checking they stay right. DSIT’s 2025 survey found 43% of UK businesses reported a breach or attack in the previous year, and 85% of those started with phishing. The Cyber Essentials controls are what limit the damage when someone clicks.

Cyber Essentials vs Cyber Essentials Plus

Cyber Essentials is a self-assessment. You answer an online questionnaire about your setup, a director signs it off as accurate, and a certification body’s assessor marks it. It’s the right level for most small businesses in Liverpool and the North West, and for most supplier requirements.

Cyber Essentials Plus covers the same five controls, but an assessor tests them: they check a sample of your devices, scan for vulnerabilities and try to get test malware through email and the web. You need the basic certificate first, and the Plus audit has to follow within a set window. Firms in Liverpool and Cheshire usually go for Plus when a contract, a public-sector buyer or a larger client asks for it by name.

If nobody’s asked for Plus, start with Cyber Essentials. If somebody has, the preparation is the same. Plus just means the settings are checked rather than described.

Getting Cyber Essentials certification in Liverpool and Cheshire, step by step

1. Decide the scope. Usually the whole business, and it’s wider than most people expect. Every laptop and PC used for work. Every phone or tablet that gets business email, including staff’s personal phones. And every cloud service that holds business data: Microsoft 365, Xero, your CRM, the practice management system. Certifying only part of the business is allowed but rarely what a client or insurer wants.

2. Find the gaps. Go through the five controls device by device. The usual finds are a laptop that hasn’t updated in months, an old version of Windows or Office, admin rights on everyday accounts, a shared login, and multi-factor sign-in missing on one or two accounts.

3. Fix them. This is where the time goes. Most small offices, in Liverpool or anywhere else, need somewhere between a few days and a few weeks, depending on how many devices there are and whether anything needs replacing.

4. Submit the assessment. Choose a certification body, answer the questionnaire honestly, and a director signs it. There’s no need to pick one based in Liverpool or Cheshire; the assessment is done online. Fees are set by IASME according to the size of your organisation and published on their site.

5. Keep it true. The certificate is valid for twelve months, and the controls have to stay in place between renewals. Our guide to Cyber Essentials recertification covers what changes at renewal time.

Want the gaps found and fixed for you? We go through the five controls on every device, fix what would fail, and hand you back a setup that’s ready to submit. Fixed price, quoted first. Ring 0151 452 3060 or see managed cyber security.

Getting to Cyber Essentials from a managed setup vs a DIY one

How much work Cyber Essentials takes depends less on the size of the business than on how its IT is run.

If your IT is already managed properly, most of the controls are in place and enforced centrally. Devices are enrolled in Microsoft Intune, updates are pushed on a schedule, multi-factor sign-in is required by policy, and antimalware reports in to one place. Getting certified is mostly a matter of closing a few gaps and writing down what’s already there. That’s how we run IT support: to Cyber Essentials standards month to month, so certification is a short step rather than a project.

If your IT has grown up DIY, with laptops bought and set up one at a time, a mix of personal and work phones, and settings nobody’s checked since they were first switched on, the path is longer. Devices need enrolling and configuring (and consumer laptops on Windows 11 Home are worth upgrading to Pro, so they can be fully managed through Intune), accounts need tidying, and anything that can’t meet the controls needs replacing or taking out of scope. It’s very doable, but it’s a one-off project with a set-up cost, and it costs more than for a business that’s already on managed devices.

Either way, we’ll look at what you’ve got and give you a fixed price to get you ready before anything starts.

Who’s asking for Cyber Essentials in Liverpool and Cheshire

Public-sector contracts. Central government requires Cyber Essentials for contracts that handle certain kinds of personal information and ICT services, and many other public bodies ask for it in their supplier checks.

Larger clients. Supplier security questionnaires often ask “do you hold Cyber Essentials?” early on. If you supply a bigger firm in Liverpool, Chester or Warrington, it’s often the fastest way to answer twenty questions at once.

Insurers. Many cyber insurance proposal forms ask whether you hold it. It isn’t usually a condition of cover, but the questions on the form line up closely with the five controls. Our guide to cyber insurance requirements goes through them.

Regulated sectors. Law firms under the SRA, accountants under AML supervision, financial advisers under the FCA and schools under the DfE’s cyber security standards all have to show they manage cyber risk. Cyber Essentials is a recognised way to evidence the basics, though it doesn’t cover everything a regulator expects.

Cyber Essentials across Liverpool, the Wirral, Chester and the North West

The preparation for Cyber Essentials is almost entirely remote work: checking settings, applying updates, switching on multi-factor sign-in, tidying admin accounts. So it’s the same job for a firm in Liverpool city centre as for one in Chester, Warrington, Crewe, Birkenhead or anywhere else in Merseyside and Cheshire. If a device needs replacing or a router needs swapping, that visit is booked in.

We’re on the Wirral, between Liverpool and Chester. For the wider picture of keeping a small business secure beyond the certificate, see our cyber security guide for small businesses, or the local pages for cyber security in Liverpool and cyber security in Cheshire.

A five-minute Cyber Essentials check

• Is every device used for work running a supported version of Windows, macOS, iOS or Android?
• Have critical updates gone on every device within the last 14 days?
• Is multi-factor sign-in on for every Microsoft 365 or Google Workspace account?
• Does anyone use an administrator account for everyday work?
• Is antimalware running and up to date on every laptop and PC?
• Has the default admin password on the office router been changed?
• Is every phone that gets business email, including personal ones, locked with a PIN and up to date?
• Did the last person to leave lose access the day they left?

Eight yeses and you’re close to ready. Each no is a specific fix, and most of them take less time than the assessment form.

Cyber Essentials: the questions small businesses ask

We still have Windows 10. Can we get Cyber Essentials?

Not with Windows 10 machines in scope. Windows 10 reached end of support in October 2025, and Cyber Essentials needs every device in scope to be running supported software that’s getting security updates. Plan on every work machine being on Windows 11: upgrade the ones that can run it and replace the ones that can’t. We can tell you which of your machines can upgrade and which can’t.

We’ve got laptops with Windows 11 Home. Is that a problem?

It can work, but it’s not what we’d recommend. Under our managed service, Home machines still get their updates and remote management, so the basics are covered. What Home can’t do is join your business Microsoft account or be fully managed through Microsoft Intune, so things like encryption, sign-in rules and security settings can’t be enforced centrally. For the most complete coverage, we recommend Windows 11 Pro with Microsoft 365 Business Premium. Upgrading Home to Pro is a licence, not a new laptop.

We’ve only got a handful of users. Is Cyber Essentials worth it?

Often, yes, and it’s easier for a small business than a big one. Fewer devices means fewer things to fix, and the assessment fee is lower for smaller organisations. If a client, contract or insurer is asking for it, the size of your team doesn’t change the answer. If nobody’s asking, running to the standard without certifying still gets you most of the benefit.

Do staff mobile phones count, including personal ones?

Yes. Any phone or tablet that accesses business email or data is in scope, whoever paid for it. That means it needs a supported operating system, current updates, and a screen lock. The exception is a phone used only for calls, texts and a multi-factor sign-in app. For most businesses, the easy answer is to manage business email on phones through Microsoft 365, so the controls apply whoever owns the handset.

Are cloud services like Microsoft 365 and Xero in scope?

Yes. Any cloud service that holds business data is in scope: Microsoft 365, Google Workspace, Xero, your CRM, practice or case management software, file sharing. The main requirement is that access is properly controlled, and multi-factor sign-in is expected on every one of them where it’s available. A list of every cloud service the business uses is one of the first things to put together.

We run our own IT. Do we need a provider to get Cyber Essentials?

No. Plenty of businesses get certified on their own. It’s more work from a DIY setup, because the controls have to be put in place device by device and then evidenced. A provider running your IT to Cyber Essentials standards makes it much quicker, and a one-off readiness project is the middle ground if you’d rather keep running things yourself afterwards.

Got a deadline? Ring Eric this week with the date and the number of devices, and you’ll know how long getting ready will take and what it’ll cost before you commit. Ring 0151 452 3060 and a person picks up.