Cyber Essentials support
Practical help preparing for Cyber Essentials certification
JM Restart can help a small business understand the scope, record its systems, implement the required controls, work through the questionnaire and prepare evidence for formal assessment.
A recognised security baseline
Useful for tenders, supply chains and day-to-day protection
Cyber Essentials is an annually renewable UK certification scheme built around five technical controls that help protect organisations from common internet-based attacks.
The certification can help demonstrate that important security basics are in place. Some customers, contracts and tender processes ask for a current certificate. It is not a promise that an organisation cannot suffer a cyber incident, and it does not replace wider risk management, backup, staff awareness or incident planning. Our broader cyber security service covers the connected protection, monitoring and planning that sit outside certification alone.
Current requirements are published by the National Cyber Security Centre. The formal scheme is managed by IASME, the NCSC’s Cyber Essentials Delivery Partner.
JM Restart’s role
JM Restart helps customers prepare, remediate and maintain the technical environment. We are not an IASME Certification Body, Cyber Essentials Assessor, NCSC-assured Cyber Advisor or CyberSmart delivery partner.
The formal assessment and certification are completed through the chosen certification route. Where a customer wants JM Restart to coordinate the whole journey, we currently use CyberSmart and can invoice for the agreed certification route as part of the project.
Preparation and remediation
Turn questionnaire answers into real technical controls
The work starts with what the organisation actually uses, who has access and how the systems are configured.
Scope, assets and answers
Define the organisation and systems in scope, record devices and services, prepare a working copy of the questionnaire and identify gaps before formal submission.
Technical remediation
Help configure firewalls, routers, switches and wireless access points; change and document factory credentials; review remote management, virtual private network access and open ports; harden devices; disable AutoPlay where required; and enable suitable device encryption such as BitLocker.
Accounts and people
Review user and administrator access, multi-factor authentication, joiner and leaver processes, account removal, staff responsibilities, security policies and practical training material.
Security services
Provide and manage appropriate endpoint and email security using current JM Restart-supported services, including selected Bitdefender and Trend Micro options. Product choice depends on the customer’s environment and agreed scope.
Policies and evidence
Prepare agreed policy material, configuration records and an evidence pack that supports accurate answers. The customer remains responsible for confirming that its formal declaration is true.
Renewal readiness
Review changes, flagged issues and recurring control work before renewal rather than treating certification day as the end of the security process.
The five controls
A plain-English view of the Cyber Essentials baseline
Firewalls
Control connections between the organisation’s devices, services and the internet, including any deliberately published service or remote-management route.
Secure configuration
Remove unnecessary accounts, software and services, replace default credentials and configure devices for the work they need to do.
Security updates
Use supported software and apply required security updates within the scheme’s current timescales.
User access control
Give people the access they need, protect authentication and restrict administrative rights rather than using them for routine work.
Malware protection
Use a suitable method to stop untrusted software or code running, supported by safe configuration and user behaviour.
A coordinated route
CyberSmart certification and ongoing security options
CyberSmart is JM Restart’s current route when a customer wants us to coordinate the preparation and certification journey from one project.
Cyber Essentials
JM Restart helps complete the working questionnaire and remediate the environment. CyberSmart reviews the answers through its certification process before the submission is assessed. JM Restart does not mark or award the certificate.
Cyber Essentials Plus
Plus uses the same controls but adds an independent technical audit. For a complete JM Restart-led project, we currently require the CyberSmart route. We can also assist with specific remediation work when a customer has chosen another authorised certification provider.
CyberSmart products
JM Restart can quote for and support CyberSmart Active Protect, Vulnerability Management and Security Awareness Training. Cyber insurance may also be available, subject to the insurer’s current eligibility, application and policy terms. JM Restart is not the insurer or insurance broker.
Read more about the current Cyber Essentials scheme through IASME or review CyberSmart Active Protect. External product and scheme information can change and will be checked again when a quotation is prepared.
Common questions
Planning the certification project
Pricing is by quotation because scope, device count, existing gaps, certification route and remediation work vary.
What can the quotation include?
The agreed scope can include a gap review, asset and scope record, questionnaire working copy, technical remediation, policies, evidence pack, submission support and a renewal review. Certification fees and ongoing products are itemised according to the chosen route.
Can JM Restart guarantee that we will pass?
No. We can help the organisation understand and implement the requirements, identify evidence and answer accurately. The customer must confirm its declaration, and the authorised assessor or certification route makes the formal decision.
Can we use another certification provider?
Yes. JM Restart can assist with specific technical gaps or ongoing control work when a customer uses another authorised provider. For a fully coordinated Cyber Essentials Plus project led through JM Restart, the current route is CyberSmart.
What happens after certification?
Cyber Essentials is renewed annually. Systems, users and software continue changing between assessments, so ongoing monitoring, updates, access reviews, training and recorded processes remain important.
Need Cyber Essentials for a tender, customer or security programme?
Tell us your deadline, organisation size, locations, devices, cloud services and whether you need Cyber Essentials or Plus. We can define the next sensible step and prepare a quotation.
