100%
Readiness
Audit-day readiness, on the record
By the time the independent assessor arrives, every control has already been tested in a mock. Hover the dial to see it fill.
UK Cyber Essentials Plus Specialists
Cyber Essentials Plus.
Certified first time.
Self-assessment does not survive an independent technical test. One unpatched device or one unapproved admin account is enough to lose a public tender or NHS framework contract. Freshcyber gets your business certified first time, with continuous year-round scanning so renewal is never a scramble.
100% pass rate across every CE and CE+ engagement we have delivered.
PASS RATE 100%
Audit Simulation
Cyber Essentials Plus
Firewalls
Verified100%
Secure Configuration
Hardened100%
Security Update Management
Compliant100%
User Access
Enforced100%
Malware Protection
Active100%
Independent Assessor Readiness: Ready for Test
Regulated UK organisations trusting Freshcyber to certify and stay compliant
MWMeridian West
Cyber Essentials PlusOCOdiliaClark
External Network PentestEDEndocare Diagnostics
Cyber Essentials PlusCFHawthorn School
Cyber Essentials & 24/7 MDRTETalent Equation
Internal Network PentestMGMYGEEX
MSP Security PartnerMWMeridian West
Cyber Essentials PlusOCOdiliaClark
External Network PentestEDEndocare Diagnostics
Cyber Essentials PlusCFHawthorn School
Cyber Essentials & 24/7 MDRTETalent Equation
Internal Network PentestMGMYGEEX
MSP Security Partner100%Pass rate across every CE+ engagement
14–21Working days, gap analysis to certified
12 moContinuous vulnerability management
10–250Employee range we certify, regulated SMEs
The problem
It feels safe until the tester finds the one thing you missed.
The consequences of getting Cyber Essentials Plus wrong arrive in your inbox. Here is what that actually looks like. Tap between the three.
Inbox
procurement@nhs-supplychain.exampleFri 14:02
Tender withdrawn — missing Cyber Essentials Plus evidence
BID LOSTPR
procurement@nhs-supplychain.exampleto you
Dear supplier,
Thank you for your submission to the framework. Your technical response scored well and your pricing was competitive. However, your submission listed Cyber Essentials (self-assessed) rather than the independently verified Cyber Essentials Plus certificate the framework mandates at qualification stage.
As certification status is a pass/fail qualifying requirement, we are unable to progress your bid to evaluation. The contract has been awarded to a supplier that held valid CE+ certification at the point of submission.
Tenders are lost at the final procurement stage because certification was not sorted in time. The work was good enough, the paperwork was not.
The outcome
What it looks like once this is handled properly.
Certified first time
The five technical controls are properly in place before the assessor arrives, not patched in a panic on the day.
A written gap analysis you can act on
Show your customer or insurer exactly where you stand and what's being fixed, or work through it with us. Either way you have evidence, not a guess.
Continuous monitoring, not a scramble
Our platform scans year-round, so renewal is never a last-minute fire drill. Nothing drifts out of compliance between audits.
A named point of contact
You talk to the person running your certification, not a support ticket queue. One number, one owner, accountability built in.
Continuous tooling
Live compliance, not audit-day guesswork.
Most competitors run a one-off scan and vanish. Our platform continuously scans your infrastructure using industry-standard vulnerability management tooling, the exact class of tooling CE+ assessors run against you.
freshcyber-platform :: uk-south-cluster
SYSTEM HEALTHY
// Target: 84 endpoints, 4 subnets, 12 cloud tenants
$freshcyber scan --scope=cyber-essentials-plus --continuous
✓ Control: Firewalls — boundary rules verified (0 exposed ports detected)
✓ Control: Secure Configuration — benchmark at 100% policy compliance
✓ Control: Security Update Management — patches applied within 14 days
✓ Control: User Access — MFA enforced, admin privileges segregated
✓ Control: Malware Protection — active across macOS and Windows nodes
Latest scan completed: 4 minutes ago100% CE+ Readiness Score
Two views, one outcome
Built for the IT Manager who gets blamed, and the owner who loses revenue.
Same engagement, two lenses. The IT Manager sees zero panic on audit day. The Business Owner secures the tender revenue. Switch between them.
Pre-Audit Mock Technical TestSIMULATION
Control: Firewalls (external perimeter scan) PASS
Control: Secure Configuration (hardening) PASS
Control: Security Update Management (<14 days) PASS
Control: User Access (MFA & privilege separation) PASS
Control: Malware Protection (execution control) PASS
Ready for IASME certification upload, zero blocking findings.
Zero panic on audit day
We simulate the exact technical checks the independent assessor will run, before they ever arrive. If there is a missing patch, you fix it with us in private, not on the audit record. You are not the person explaining a failed test to the board.
Who this is for
The regulated sectors that end up at our door.
NHS Supply Chain
Healthcare and care providers
NHS Supply Chain now mandates CE+ for all in-scope suppliers, alongside an annual DSPT self-assessment deadline of 30 June.
Insurer requirement
Legal and financial services
Client confidentiality obligations and insurer requirements increasingly name CE+ explicitly as a condition of cover and of the engagement.
MOD / Public sector
Manufacturing and engineering
MOD and public sector supply chain tenders name CE+ as a qualifying requirement before you can even bid, never mind win.
Supply chain mandate
Professional and technology services
Corporate clients are pushing CE+ down their own supply chain as a condition of doing business, so your contract depends on it.
How it works
A short, credible path from gap to certified.
01
Gap analysis
We assess where you stand against all five technical controls, today.
02
Remediation
We work the findings with you, closing every gap before the real audit.
03
Independent certification
The assessor tests your environment. You pass, first time, on the record.
04
Ongoing monitoring
Our platform scans year-round so the certificate stays valid until renewal.
Free 3-minute check
Would your business pass Cyber Essentials right now?
Answer 15 quick questions across the five official controls and get your readiness score straight away, with a full breakdown by control area. No account needed, no technical knowledge required.
About three minutesAligned to the five NCSC controls
Pricing
Three ways to work with us.
The numbers are visible on purpose. If the scope or budget isn't a fit, you'll know before you take a call slot.
Readiness Assessment
£2,500one-off
For finding out exactly where you stand before committing to certification. One-off engagement, no ongoing commitment.
- Full gap analysis against all five technical controls
- A written gap analysis report you can act on or share with whoever asked for it
- SAQ preparation and review support
This is the assessment on its own, no certification fees, ongoing platform fees, or vulnerability scanning bundled in. No pressure to continue afterwards, the report is yours either way.
Managed Cyber Essentials Plus
From £575/mo
100% pass rate across every certification we have delivered.
For businesses that want certification handled end to end, then kept current so renewal is never a scramble.
- You're not the one chasing paperwork or the certification body, we are
- Audit fees included, no surprise costs
- Find out about a failure before the real assessor does, with our pre-audit mock technical assessment
- Continuous vulnerability scanning year-round
- Self-serve NCSC framework assessment (CAF Lite) included
- Remediation support throughout, we work the findings with you
- Renewal isn't a scramble you have to remember, it's already handled
CAF Roadmap
Monthly, on requestManaged CE+ add-on
For existing Managed CE+ clients under real pressure to prove genuine alignment with the NCSC Cyber Assessment Framework, not just a starting point.
- Everything in Managed CE+
- A tailored, prioritised roadmap, not generic self-serve advice
- Every action tracked with an owner, target date, and evidence
- Reviewed with you at quarterly check-ins
- A monthly fee scoped to the work involved
FAQ
The quick answers.
Yes, and most clients do. Nothing has to be redone from scratch, the gap analysis carries straight through into the remediation and certification work.
If a tender names "Cyber Essentials," check the wording. Most NHS and public sector frameworks mean CE+ specifically, and we will confirm which one actually applies. We run the same gap analysis and remediation work either way, so the Managed Package always delivers the fully verified CE+ certificate, never just your own word for it.
The Readiness Assessment is a fixed £2,500 one-off. The Managed Package starts from £575/mo and scales with your device count. A 15-minute call gives you a clear number, sized to you.
If your business is UK-domiciled with turnover under £20m and you certify your whole organisation, you are automatically entitled to Cyber Liability Insurance up to £25,000, arranged via IASME and underwritten by AIG. You opt in at no extra cost.
Yes. UK nationwide, remote-first with occasional onsite when it matters, for example on audit day or for certain network assessments.
One call. We will tell you exactly what you need and what it will cost.
A straight fifteen-minute conversation, no forms to fill in first, no hard sell. You come away with a clear picture, even if you never book us.