Cybersecurity
Cyber Essentials certification has become the de facto standard for UK businesses serious about demonstrating their information security credentials. Whether you're a London law firm handling sensitive client data, a financial advisory practice managing investment portfolios, or a growing professional services consultancy, achieving this certification signals genuine commitment to cyber defence—not just to clients, but to your own team and stakeholders. A Cyber Essentials readiness checklist is your practical first step toward understanding exactly where your organisation stands, what gaps exist, and how much work lies ahead before you're ready to certify.
The UK government's Cyber Essentials scheme, managed through the National Cyber Security Centre (NCSC), establishes five fundamental technical controls that any organisation should implement. It's not just another compliance tick-box; it's a proven baseline that prevents approximately 80% of common cyber attacks. For SMBs in London's professional services sector, this matters because your clients increasingly make supplier selection decisions based partly on your security posture.
Cyber Essentials comes in two flavours: the standard certification (self-assessed) and Cyber Essentials Plus (third-party audited). Most organisations begin with the standard version before progressing to Plus if their risk profile or client requirements demand it. The five core technical controls cover:
These sound straightforward until you start mapping them against your actual infrastructure. Many London firms we speak with at VantagePoint Networks discover that their current approach to these areas is fragmented, undocumented, or partially implemented—precisely why a readiness checklist is invaluable.
Your perimeter defence is your first line. Ask yourself: Do you have documented firewall policies? Are they reviewed and updated at least annually? Can you demonstrate that your boundary devices (firewalls, proxies, routers) are configured to block unauthorised inbound and outbound connections? For remote-working organisations—increasingly common in London—this extends to VPN access controls and secure remote desktop configurations.
Action items to check:
This control ensures that every desktop, laptop, server, and mobile device in your organisation is hardened against attack. The NCSC provides detailed secure configuration guides for Windows, macOS, and Linux environments. The practical challenge: do your IT processes enforce these configurations consistently?
Key items to verify:
Many professional services firms underestimate how manual this work feels initially, especially if configuration management tools haven't been implemented. The good news: once you establish baseline configurations and deploy them through group policy or mobile device management (MDM), maintenance becomes routine.
Who can access what, and why? This control demands that you implement the principle of least privilege—users and services should have the minimum access rights necessary to perform their role. For legal and financial practices, this is particularly critical given the sensitive nature of client and customer information.
Readiness checklist items:
For many organisations, discovering that they lack a formal user access policy or haven't performed an access review in years is a sobering moment. This control often requires cultural change as well as technical implementation.
Antivirus and anti-malware solutions must be deployed across all devices, kept up to date, and monitored for effectiveness. This isn't about buying the most expensive endpoint protection available; it's about consistent deployment and verification.
Verification steps:
Security patches for operating systems, applications, and firmware must be applied promptly. The NCSC recommends applying patches within 14 days of release for standard vulnerabilities; critical zero-day exploits demand faster action. For many organisations, this is where the readiness gap shows up most visibly.
Checklist items:
Cyber Essentials assessors will scrutinise not just your technical controls, but the processes and policies that govern them. You'll need documented evidence that your approach is deliberate, not accidental. This includes:
For organisations working with VantagePoint Networks or similar security consultants, this documentation work often happens in parallel with technical remediation. Don't leave it to the last moment; documentation is easier to maintain incrementally than to reconstruct retroactively.
Start your checklist immediately, but be realistic about timelines. Most London SMBs require between four and twelve weeks to move from readiness assessment to certification-ready status, depending on starting point and resource availability. Begin by assigning ownership of each control to specific team members or departments, establish a shared checklist document, and schedule regular check-ins to track progress. Document everything as you go—evidence of controls isn't something to scramble for during the assessment window; it should be maintained continuously as part of normal operations. The organisations that certify most smoothly are those that build cybersecurity discipline into their day-to-day IT practices, not those that treat it as a one-off project.
VP Audit asks 15 questions across 5 security domains and scores your network 0–100 with specific findings. 100% in-browser — no data sent anywhere.
Audit your network →