Compliance, security, and AI insights.

Configure Microsoft 365 MFA for Cyber Essentials v3.3: Security Defaults and Conditional Access, current number matching, administrator recovery and evidence of enforcement.

Google Workspace 2-Step Verification for Cyber Essentials v3.3: enrolment, effective enforcement, administrator recovery and current OAuth client guidance.

Review Conditional Access for Cyber Essentials v3.3: effective MFA, location exclusions, authenticated sessions, device trust and safe administrator recovery.

v3.3 made cloud-service scoping explicit. IaaS, PaaS, and SaaS all need specific treatment in the self-assessment. This guide walks through how to describe each type and what the assessor expects.

Passwordless sign-in with FIDO2, Windows Hello, and mobile credentials is rising fast. This article explains how v3.3 treats passwordless authentication and what to declare in the self-assessment.

Device unlock for Cyber Essentials v3.3: six-character device-only passwords or PINs, brute-force protection, biometrics and credentials also used for authentication.

Cyber Essentials subset scope must be well-defined, separately managed and agreed with the certification body. Learn the firewall/VLAN boundary and stricter unsupported-software rule.

Individual administrator credentials, separate day and admin accounts, effective MFA and optional phishing-resistant authentication and emergency-access hardening.

Cyber Essentials scope for remote and hybrid teams: ordinary private home routers are excluded, organisation-supplied routers are included, and work devices and cloud services need applicable controls.

Yes - sole traders can get Cyber Essentials. A one-person business qualifies for Fig Group's Micro tier at £299.99 + VAT. Buyers still decide eligibility against their contract, entity and scope requirements.

Cyber Essentials is not a general UK legal requirement. Check the actual tender, MOD contract, insurer conditions and permitted equivalent controls.

Yes - Cyber Essentials explicitly covers cloud services under v3.3. Microsoft 365, Google Workspace, AWS, Azure, and any SaaS application holding organisational data are all in scope, with specific configuration expectations around MFA, tenant settings, and managed updates.

How to evidence Cyber Essentials v3.3 patching - 14-day SLA for high/critical CVEs, WSUS deployment patterns, Intune Update Rings, third-party patching (Action1, PDQ, NinjaOne), and the audit artefacts assessors want.

What MSPs can do with the Fig Group platform: manage client compliance, risk, monitoring and evidence, with separately licensed certification services.

Compare the investment banking term Financial Institutions Group with Fig Group, the UK cybersecurity and compliance business serving MSPs and other organisations.

If you need an MSP that is itself Cyber Essentials certified (and can help you achieve it), this guide explains what "CE-certified MSP" really means and how to evaluate one.

From readiness to certificate, how long does Cyber Essentials really take? This guide walks through every stage with realistic timelines and the factors that speed it up or slow it down.

Financial services firms face unique scrutiny on cyber controls. Where does Cyber Essentials fit alongside FCA SYSC, PRA SS1/21, and client due-diligence expectations?

There are dozens of IASME-licensed Cyber Essentials certification bodies. This guide compares them on price, turnaround, technology, and specialism to help you pick the right one.

The Bar Standards Board does not formally require Cyber Essentials. Solicitor firms, CPS counterparts, institutional lay clients, and insurers are increasingly asking for it. This guide covers how CE applies to a criminal barristers’ chambers in London and why the certification has become a practical necessity even without a formal mandate.

A supplier has sent you a PDF claiming to be their Cyber Essentials certificate. How do you confirm it is real, current, and issued to the organisation you are actually contracting with? This is the verification guide for procurement and tender-assessment teams.

Cyber Essentials applies to UK organisations of every size, from sole traders to enterprises. The scheme is tiered by headcount (Micro 1-9, Small 10-49, Medium 50-249, Large 250 - 9,999) and is most commonly required for SMEs bidding for procurement work or seeking cyber insurance.

No. Cyber Essentials does not mandate a VPN. Apply the scheme rules to each in-scope remote administration path, boundary firewall, account and cloud service; a VPN is one possible design.

Use password managers to support Cyber Essentials password controls: unique credentials, secure storage, MFA, breach monitoring, access management and useful evidence.

Security Update Management is the quietest-looking pillar of Cyber Essentials and the one organisations most often fail on at renewal. This guide covers every v3.3 requirement - the 14-day rule, supported OS versions, mobile and firmware, cloud-service patching - and the evidence an assessor will now accept.

Cyber Essentials Plus is needed when a tender, contract, framework, customer, or risk decision explicitly requires independently tested assurance. Contract value alone does not determine the level.

No - Cyber Essentials Plus requires a current Cyber Essentials certificate first, or both can be completed in a single engagement. The self-assessment is identical for both levels; Plus adds hands-on technical testing by an assessor.

Yes - Cyber Essentials is designed for UK small businesses. Fig Group prices the Micro tier for organisations with 1-9 staff at £299.99 + VAT. An eligible scheme-level cyber-liability benefit is arranged separately by IASME and its insurance partner.

Exactly how to configure Okta (Workforce Identity) to satisfy Cyber Essentials v3.3 - MFA policies, Authentication Policies, session lifetime, break-glass accounts, and evidence patterns.

Getting Cyber Essentials quickly comes down to two things: being properly prepared before you submit, and choosing a certification body that does not keep you waiting. This guide covers both.

User Access Control is the pillar of Cyber Essentials that catches the most UK organisations out at assessment. This guide walks through every v3.3 requirement - individual accounts, MFA, admin separation, joiner-mover-leaver, third-party access - and the exact evidence assessors now expect.

Yes - you can fail the Cyber Essentials self-assessment submission. Fig Group includes three free re-submissions; feedback helps you correct gaps, subject to the applicable assessment window.

No - Cyber Essentials does not cover GDPR. Cyber Essentials is a technical cybersecurity baseline; GDPR is a data-protection regulation covering lawful basis, rights, transfers, and accountability. They overlap at the technical-security boundary but neither replaces the other.

How ChromeOS maps to Cyber Essentials: supported updates, application controls, Google Admin policies and evidence. Chromebooks can be the easiest device class for a suitable managed fleet.

A straightforward comparison of IASME-licensed Cyber Essentials certification bodies in the UK. We look at published pricing, turnaround times, support, and what each body actually offers.

We compare published pricing from IASME-licensed certification bodies across all organisation sizes. The differences are larger than you might expect.