Cyber Essentials for IT and Software Companies

What is in scope, and what is not

• In scope: every device used to access organisational data, including developer laptops and personal devices used for work; cloud services you administer such as Microsoft 365, Google Workspace, AWS, Azure and GCP; your own SaaS product infrastructure where your staff administer it.
• Not in scope: your application source code as a subject of review, a client's own tenant where you are a guest with no administrative control, and third-party services you consume but do not administer.

Cyber Essentials is not a code security review or a penetration test. It assesses the five technical control areas over your organisational estate.

The five issues that come up in nearly every software company

1. Developer autonomy. Local admin rights are widespread. You need admin activity separated from day-to-day accounts, which usually means separate admin accounts rather than removing developer capability.
2. Cloud console access. MFA must be enforced on every AWS, Azure and GCP identity, including break-glass and long-lived programmatic access reviewed.
3. Linux and macOS estates. Both are fine, but you must evidence supported versions, patching within 14 days for high and critical fixes, and appropriate malware protection.
4. BYOD. Contractors using their own machines are in scope if they touch organisational data. See BYOD rules.
5. Unsupported build tooling. Old build servers and legacy test machines are the most common reason a software company fails.

Why software companies certify

• Enterprise and public sector customers require it at supplier onboarding.
• Framework eligibility, including G-Cloud – see G-Cloud 15 and GCA frameworks.
• It removes most of a customer security questionnaire – see handling supplier questionnaires.
• It is the prerequisite for IASME Cyber Assurance if buyers ask for governance evidence.

Managed service providers and IT support firms

If you administer client environments, expect buyers to ask for Cyber Essentials Plus. Privileged remote access into other organisations raises the assurance bar, and your own certificate is often the first thing a client's auditor asks to see.

Cost and timeline

• Cyber Essentials £320 + VAT, 24 to 48 hours when prepared.
• Cyber Essentials Plus £1,400 + VAT, one to three weeks, sampling a set of devices including cloud-managed endpoints.