Cyber Essentials Milton Keynes: a practical certification guide

A technology pilot and a supported business service can have very different operating arrangements. For a Milton Keynes organisation preparing for Cyber Essentials, the first task is to establish what is in use today, who manages it and which organisation the certificate will represent.

Milton Keynes City Council’s digital innovation information describes the city’s role in trying emerging technologies in real settings. That is useful context for a certification guide about pilot environments. It is not evidence that every innovation participant must obtain CE or Plus.

Temporary services can become permanent without passing through the normal IT process. A trial dashboard, supplier account or connected device may still be operating long after the initial project ends. Before assessment, ask the business teams what they actually use rather than relying solely on the central purchasing list.

Imagine a Milton Keynes company that has completed a successful pilot and is offering the service commercially. It uses a supplier-hosted dashboard, staff laptops and an integration account that was created by the original project lead. This is a planning example, not a claim about a particular local initiative.

First, establish the ownership of each account and service. Confirm whether the business can administer users and whether the supplier or company is responsible for relevant settings. A supplier-operated service may still leave access decisions and endpoint management with the customer organisation.

Next, review the integration and support arrangements. Identify the people who can change configuration, the tools used for remote support and the process for removing access. Keep live credentials out of the assessment working file; record responsibility and configuration evidence through an appropriate secure process instead.

Ask the assessor how any specialist or connected equipment relates to the proposed scope. Do not assume it is excluded because it is not a laptop, or that certification amounts to a complete product-security assessment. Describe connectivity and business use accurately so the boundary can be agreed against the current scheme requirements.

A pilot may have depended on one technically experienced employee. Commercial delivery needs an organisation that can maintain the required controls when that person is absent or leaves. Identify who tracks software support, manages updates and approves administrator access for each relevant service.

If a control exists only in a planned service transition, record the work still needed. A signed project acceptance document does not prove that every technical setting is implemented. Complete remediation before the organisation approves answers that describe it as finished.

Cyber Essentials demonstrates a specified organisational technical baseline within scope. It does not certify that a connected product is safe, that every integration has been penetration tested or that a service will remain available without interruption. Keep those claims separate in proposals.

Ask the buyer which assurance it needs for the contract. It may request CE, Plus or additional testing. If a public-sector tender is involved, use that opportunity’s clarification process rather than assuming the city’s innovation strategy defines a universal procurement rule.

Bring the project owner, IT administrator and commercial contact together before completing the questionnaire. Agree the legal entity, systems in scope and evidence deadline. Identify dependencies on suppliers early enough to obtain factual answers from them.

The authorised representative should review the final submission against the operating service. Where an MSP prepares it, retain the business’s review and sign-off responsibility. Do not treat the assessment as a substitute for deciding who owns the service after the pilot team disperses.

After certification, maintain a short change record. Another integration, new customer deployment or replacement supplier may change the environment described in the original answers. Review those changes as part of service management and confirm that the certificate is used accurately in customer communications. A current scope explanation is more useful than a generic badge attached to every product the company sells.

Cyber Essentials is a UK government-backed scheme assessing five technical control areas: firewalls, secure configuration, security update management, user access control and malware protection. The requirements are national, not postcode-specific. Use IASME's current assessment questions and requirements for the version applicable to your assessment account.

Fig Group provides an online assessment service through Fig Compliance Ltd, its IASME-licensed certification body. There is no requirement to use a certification body with an office in your city. An MSP can prepare the assessment on your behalf; your organisation reviews and authorises the submission and provides the required portal sign-off. Answers must describe implemented controls, not planned improvements.

Fig Group’s fastest and cheapest Cyber Essentials claim is scoped to the UK providers and equivalent offers covered by its dated published comparison; it is not a claim about every possible promotion, subsidy or preparation timetable. Our published price evidence and six-working-hour commitment explain the comparison and terms. Three rounds of assessor feedback are included. Buy certification on its own or add the optional Fig Group platform; a technology subscription is not required.

Standalone Cyber Essentials starts at £299.99 + VAT. Select the size of the organisation being certified on the pricing page to see the applicable fee. Remediation effort and any separately scoped services are distinct from the certification assessment price. Fig Group's published six-working-hour assessment commitment applies to compliant Cyber Essentials submissions received before midday on a UK business day, not the time your organisation needs to become ready or complete a Plus audit. Only complete Basic submissions are covered by that commitment; certificate issuance requires a successful assessment. See the turnaround terms.

Start with the free readiness check, then choose your certification. If your scope or buyer requirement is unclear, discuss it with Fig Group before purchasing. The readiness check is an initial guide, not a certification decision. Cyber Essentials Plus adds independent technical verification of the same control areas; neither certificate replaces contractual, sector-specific or broader risk-management obligations.