# Cyber Essentials Readiness Support

Source: https://dijitulsupport.co.uk/cyber-essentials-readiness/
Updated: 2026-10-10

> dijitul support helps UK businesses get ready for Cyber Essentials. We check your devices, accounts, firewall and cloud services against the current v3.3 (Danzell) question set and fix the gaps, such as missing MFA or late patches, before you apply. We are not a certification body. Readiness work is £45 an hour + VAT, or quoted for larger estates.

## Common symptoms

- A customer or tender requires Cyber Essentials and you have a deadline
- You opened the question set and did not understand half of it
- Some staff use personal phones for work email
- You still have a Windows 10 PC or an old server in the corner
- You failed a previous attempt and need the gaps fixed
- Your router still has the password printed on the sticker

## Key facts

- We prepare you and fix gaps; the certificate comes from an IASME-licensed certification body, not dijitul
- From 27 April 2026, new assessments use requirements v3.3 and the Danzell question set
- Five technical controls: firewalls, secure configuration, security update management, user access control, malware protection
- IASME lists Cyber Essentials at £320 + VAT for micro organisations (0 to 9 staff), rising to £600 + VAT for 250+ staff
- Under Danzell, missing MFA on a cloud service that supports it is an automatic fail
- High and critical updates must be installed within 14 days of release
- Readiness work: £45 an hour + VAT, or quoted for larger or mixed estates

## What we do, and what we do not do

Cyber Essentials is the UK Government-backed baseline scheme run by the National Cyber Security Centre (NCSC), with IASME as the delivery partner that licenses certification bodies. You complete a self-assessment questionnaire, a certification body marks it, and if you pass you are certified for 12 months.

dijitul support is **not** a certification body and we do not issue Cyber Essentials certificates. What we do is the part most small businesses struggle with: making your actual IT match what the questions require. We work through your devices, cloud services and network, fix what fails, and help you understand each question so your answers are accurate. You then apply to a certification body of your choice.

That separation is healthy. The people marking your answers should not be the people who configured your systems.

## The current standard: v3.3 and the Danzell question set

According to the NCSC's *Cyber Essentials: Requirements for IT infrastructure v3.3*, from 27 April 2026 all new assessments use the v3.3 requirements and the question set IASME calls Danzell. The five technical controls are unchanged:

- **Firewalls**: boundary firewalls or routers protecting every device, with default admin passwords changed and unnecessary inbound services closed.
- **Secure configuration**: unused software and accounts removed, auto-run disabled, device locking with a PIN or password.
- **Security update management**: supported software only, with high and critical updates installed within 14 days of release.
- **User access control**: separate admin accounts, least privilege, MFA on cloud services, prompt removal of leavers.
- **Malware protection**: anti-malware or application allow-listing on every in-scope device.

Danzell tightens the marking. IASME has said MFA is mandatory for every cloud service where it is available, and failing to use it is an automatic fail. Security update questions became automatic-fail questions too, so a single unpatched critical vulnerability older than 14 days can sink the application. Cloud services that hold your data can no longer be left out of scope.

## The gaps we fix most often

- **MFA not enforced** on Microsoft 365, Xero, your website admin, your domain registrar or a CRM. We switch it on and check every service on your list. See [password and MFA setup](https://dijitulsupport.co.uk/password-mfa-setup/).
- **Unsupported operating systems**, most commonly Windows 10 PCs and old Windows Server versions. These must be upgraded, replaced or taken out of scope.
- **Personal phones** accessing work email with no screen lock or an old Android version. We set minimum requirements, often through [Intune](https://dijitulsupport.co.uk/device-management-intune/).
- **Everyday admin rights**. We create separate admin accounts and remove local admin from daily logins.
- **Router and firewall defaults**: factory passwords, remote management open to the internet, old firmware. See [firewall support](https://dijitulsupport.co.uk/firewall-support/).
- **Patching that relies on luck**. We set Windows Update for Business or Intune update rings so the 14-day rule is met reliably, including browsers and apps like Adobe Reader and Zoom.

## What it costs

There are two separate costs. The certification fee is paid to your certification body. At the time of writing, IASME's Cyber Essentials page lists the self-assessment at £320 + VAT for micro organisations (0 to 9 employees), £440 + VAT for small (10 to 49), £500 + VAT for medium (50 to 249) and £600 + VAT for large (250+). Check IASME's site for the current fee before you budget.

Our readiness work is charged at £45 an hour + VAT. A tidy five-person office on Microsoft 365 often needs only a few hours. A business with mixed devices, an on-site server and no MFA anywhere will take longer, and we will give you a quote once we have seen the estate. If you are on our [Complete plan](https://dijitulsupport.co.uk/pricing/) at £99 a month + VAT, the 3 included hours can go towards readiness work.

IASME also states that UK organisations with turnover under £20m that certify their whole organisation can opt in to cyber liability insurance included with the certificate. Read the terms on IASME's site.

## How a readiness project runs

- **Scope:** we list every device, user, cloud service and network connection that touches company data.
- **Gap check:** we compare each against the v3.3 requirements and give you a fix list with time estimates.
- **Fix:** we do the work remotely: MFA, update policies, admin rights, firewall settings, malware protection.
- **Walk-through:** we go through the question set with you so you can answer accurately.
- **Apply:** you submit to the certification body. If they come back with queries, we help you deal with them.

After certification, the controls need to stay in place for renewal in 12 months. Our [ongoing cyber security support](https://dijitulsupport.co.uk/cyber-security-support/) keeps patching and accounts in line all year.

## FAQs

### Can dijitul certify us for Cyber Essentials?

No. dijitul is not a certification body and does not issue certificates. We get your IT ready and fix the gaps the question set will find. You then apply to a certification body licensed by IASME, which marks your self-assessment and issues the certificate if you pass.

### How much does Cyber Essentials cost in 2026?

IASME lists the self-assessment fee at £320 + VAT for micro organisations, £440 + VAT for small, £500 + VAT for medium and £600 + VAT for large. That is paid to the certification body. dijitul's readiness work is separate, at £45 an hour + VAT or a fixed quote for larger estates.

### What changed with the Danzell question set?

Danzell accompanies requirements v3.3, used for new assessments from 27 April 2026. The five controls stayed the same, but marking tightened: missing MFA on a cloud service that supports it is an automatic fail, unpatched high or critical updates older than 14 days can fail you, and cloud services holding your data must be in scope.

### Will our Windows 10 PCs fail Cyber Essentials?

Software that no longer receives security updates is not allowed in scope. Windows 10 reached end of support in October 2025, so unless a device is covered by Extended Security Updates it needs upgrading to Windows 11, replacing, or removing from scope. dijitul can check which PCs are eligible to upgrade.

### How long does it take to get ready?

A small office already using Microsoft 365 with modern laptops can often be ready within a week or two of work. Businesses with old servers, unsupported devices or no MFA take longer, mainly because hardware may need replacing. dijitul gives you a fix list and estimate after the first review.

### What is the difference between Cyber Essentials and Cyber Essentials Plus?

Cyber Essentials is a verified self-assessment. Cyber Essentials Plus adds hands-on technical testing of a sample of your devices by an assessor. Plus must follow a basic Cyber Essentials certificate within a set window. dijitul can help prepare devices for both, but does not perform the assessment.

## Pricing and contact

Support plans from £25 a month + VAT, or £45 an hour + VAT for one-off fixes. Plans: Essential £25/month + VAT (Website software updates (core, plugins, themes) applied and checked, Daily backups, Uptime monitoring, Security monitoring); Business £50/month + VAT (Everything in Essential, 1 hour of fixes or changes every month, Priority support); Complete £99/month + VAT (Everything in Business, 3 hours of fixes or changes every month, IT and Microsoft 365 helpdesk for your team). Ad-hoc support is £45 an hour + VAT. The first 30 minutes are the minimum charge, then we bill in 15-minute blocks. Contact: 01623 650333, support@dijitul.uk, https://dijitulsupport.co.uk/contact/