Cyber Essentials Bristol: a practical certification guide

For a Bristol business, choosing Cyber Essentials starts with the service being delivered and the assurance a customer needs. An engineering supplier exchanging design files may face different contractual questions from a digital agency managing campaign assets, even though the national Cyber Essentials controls are the same.

The West of England’s growth plan describes advanced manufacturing, digital technology and creative industries as regional strengths. That supports an industry-focused preparation guide. It does not establish that every supplier to a named aerospace manufacturer must hold Cyber Essentials or Plus.

Read the actual security schedule before buying. Ask whether the requirement applies to the bidding entity, a delivery subcontractor or a defined service, and whether certification must be current at tender submission or contract start. The answer should come from the buyer, not from another supplier’s recollection of a different project.

Imagine an engineering consultancy supporting a Bristol-area manufacturing project. Designers use CAD workstations and a customer file portal; office staff use cloud email and finance software; a workshop has specialised equipment. This is a planning example, not a claim about an existing Fig engagement.

Start by mapping how information moves between those environments. A machine that appears isolated may receive files through an internet-connected workstation. An equipment vendor may have remote support access that the office IT team does not manage. Record the actual connections and ask the assessor to confirm their treatment within the proposed scope.

Do not treat an operational system as automatically excluded merely because it is expensive or difficult to update. Equally, avoid claiming that the certification is a complete industrial-control-system safety assessment. The relevant scheme requirements, the defined boundary and the customer’s wider engineering obligations need separate attention.

List the supported versions of design applications, plug-ins and operating systems. If an upgrade could disrupt a production workflow, involve the operational owner early enough to plan testing and implementation. A future upgrade booking is not proof that a required control has already been implemented. Record the completed change and any scope decision before the questionnaire is signed off.

Cyber Essentials, Cyber Essentials Plus and Defence Cyber Certification are not interchangeable labels. The MOD’s Cyber Security Model links supplier controls to the relevant cyber risk profile and contractual arrangements. A Bristol location, an aerospace customer or proximity to a defence site does not determine the applicable level.

If a contract mentions DCC, ask for its specified level and associated requirement. Review the Defence Cyber Certification guidance and discuss uncertainty before purchasing a CE-only assessment. Keep the contractual reference with the scope notes so future renewals do not rely on assumptions made by a previous bid team.

An assessor needs accurate control information, not a copy of your customer’s sensitive design material. Describe the system, account controls, software support and responsibility for updates without placing confidential engineering files in a general enquiry form. If further evidence is needed, agree an appropriate transfer method.

For shared customer portals, distinguish the controls operated by the customer from your responsibility for user accounts and the endpoints accessing them. A customer-managed portal does not make your own laptops managed, nor does your certificate certify the customer’s infrastructure.

Build a short sequence: confirm the requirement, settle the scope, check existing controls, complete remediation, then submit. Allow time for operational change approval and buyer clarification before the assessment deadline. Cyber Essentials Plus technical testing needs its own arrangements and should not be scheduled on the assumption that a self-assessment turnaround covers it.

The useful outcome is a certificate that accurately describes the organisation assessed, plus a clear record of who maintains the controls. This makes subsequent supplier reviews easier without implying that certification guarantees a contract, validates product security or replaces specialist testing.

Cyber Essentials is a UK government-backed scheme assessing five technical control areas: firewalls, secure configuration, security update management, user access control and malware protection. The requirements are national, not postcode-specific. Use IASME's current assessment questions and requirements for the version applicable to your assessment account.

Fig provides an online assessment service through Fig Compliance Ltd, its IASME-licensed certification body. There is no requirement to use a certification body with an office in your city. An MSP can prepare the assessment on your behalf; your organisation reviews and authorises the submission and provides the required portal sign-off. Answers must describe implemented controls, not planned improvements.

Fig Group is the fastest and cheapest Cyber Essentials certification provider in the UK. Our published price evidence and six-working-hour commitment explain the comparison and terms. Three rounds of assessor feedback are included. Buy certification on its own or add the optional Fig platform; a technology subscription is not required.

Standalone Cyber Essentials starts at £299.99 + VAT. Select the size of the organisation being certified on the pricing page to see the applicable fee. Remediation effort and any separately scoped services are distinct from the certification assessment price. Fig's published six-working-hour assessment commitment applies to compliant Cyber Essentials submissions, not the time your organisation needs to become ready or complete a Plus audit. See the turnaround terms.

Start with the free readiness check, then choose your certification. If your scope or buyer requirement is unclear, discuss it with Fig before purchasing. The readiness check is an initial guide, not a certification decision. Cyber Essentials Plus adds independent technical verification of the same control areas; neither certificate replaces contractual, sector-specific or broader risk-management obligations.