Cyber Essentials for UK financial services firms Certified by Fig Group.

The FCA does not impose Cyber Essentials as a universal certification requirement. It expects firms to manage cyber and operational-resilience risk, and has identified Cyber Essentials as a useful baseline for smaller firms. Certification supports that work but does not replace the wider FCA rules and guidance that apply to the firm.

SJP has publicly described mandatory Cyber Essentials Plus accreditation for Partner Practices or use of its Device as a Service solution. Partner Practices should confirm their current route and reporting instructions with SJP. See /blog/cyber-essentials-for-sjp-partners for practical certification guidance.

Start with the devices, networks, cloud services, and users that access organisational data or services. Include the CRM, back-office and financial-planning tools, document signing, client portals, remote working, administrator accounts, and any personally owned devices that fall within scope.

No. DORA covers a much broader set of ICT risk and resilience obligations for entities within its scope. Cyber Essentials can support basic control evidence, but certification does not establish DORA compliance or determine whether the regulation applies to your firm.

Include production cloud services used for organisational data or services, as well as corporate devices and accounts. ISO 27001 or SOC 2 assurance does not create an automatic Cyber Essentials exclusion. Document shared responsibilities and agree any justified subset boundary with the assessor.

It depends on staff. A typical fintech with 40 staff falls into CE Small (10-49) at £399.99 + VAT, or CE Plus Small at £1,999.99 + VAT for insurer / enterprise-client use.