Cyber Essentials Telford: a practical certification guide

Telford manufacturers should prepare for Cyber Essentials by bringing office IT and production-support responsibilities into the same scope discussion. A short questionnaire is only straightforward when the organisation knows which systems are used, who manages them and what the customer has requested.

Telford & Wrekin Council’s economic update identifies manufacturing and engineering as significant local activities. That provides a practical setting for this guide. It does not prove that every manufacturer or council supplier must hold CE or Plus.

Ask the buyer for its actual security requirement, including the certified entity, level and acceptance date. A certificate request should be separated from quality, production and safety conditions. Meeting a technical baseline is not the same as obtaining approval for every manufacturing process.

Consider a Telford business whose office uses managed laptops while production staff use shared terminals for schedules and job information. Equipment vendors also provide occasional remote support. This is a planning example, not a description of a named manufacturer or Fig customer.

Start by mapping the terminals’ connectivity and business use. Identify their operating systems, applications and administrator arrangements. Ask the assessor how the current scope requirements apply instead of assuming that shop-floor equipment is automatically excluded from an office-focused certificate.

Distinguish shared devices from shared accounts. Several workers may use the same terminal, but the organisation still needs to explain how access is controlled. Check what happens at shift changes and when temporary staff leave. A policy that describes only permanent office employees may miss the actual workflow.

Review the remote-support arrangement with the equipment owner and vendor. Establish who approves access, what tools remain installed and how the connection is managed after support ends. Do not assume that a vendor’s involvement means your own company has no responsibility for understanding the control.

Specialist production-support software may require compatibility testing before an update. Involve the operational owner early enough to plan compliant changes through the normal safe process. A certification deadline should not lead to untested changes on equipment, but a future maintenance booking is not proof of an implemented requirement either.

Keep the relevant support and version information in a record the business can maintain. A current licence for one application does not establish that the operating system and every supporting component remain supported.

Cyber Essentials does not certify product quality, machinery safety or every aspect of operational technology security. If a customer needs a specialist industrial review, scope it separately. Describe the certificate as evidence for the assessed organisation and systems rather than a guarantee about the whole factory.

Where the business is part of a group, confirm the legal entity and shared-service boundaries before submission. A parent company’s certificate or a common trading brand does not automatically provide coverage for every subsidiary.

Ask office IT, production support and the commercial owner to agree one factual account of the environment. The commercial team should supply the buyer’s wording; technical owners should confirm the controls; the authorised representative should review and approve the answers.

If a required control is incomplete, assign an action and confirm its completion before submission. Avoid using general statements about good practice where the question asks how a setting or process actually operates.

Use proportionate evidence that does not expose customer production records, confidential designs or live credentials unnecessarily. Agree an appropriate channel if detailed material is needed for clarification.

After certification, review the scope when a new production line, remote-support tool or business site is introduced. Keep the certificate and its explanation with supplier assurance material and check them against each new buyer request. That makes certification useful in day-to-day procurement without implying a universal requirement or broader industrial assurance than the scheme provides.

For shared terminals, confirm how staff changes reach the account administrator without relying solely on production supervisors remembering to notify IT.

Cyber Essentials is a UK government-backed scheme assessing five technical control areas: firewalls, secure configuration, security update management, user access control and malware protection. The requirements are national, not postcode-specific. Use IASME's current assessment questions and requirements for the version applicable to your assessment account.

Fig provides an online assessment service through Fig Compliance Ltd, its IASME-licensed certification body. There is no requirement to use a certification body with an office in your city. An MSP can prepare the assessment on your behalf; your organisation reviews and authorises the submission and provides the required portal sign-off. Answers must describe implemented controls, not planned improvements.

Fig Group is the fastest and cheapest Cyber Essentials certification provider in the UK. Our published price evidence and six-working-hour commitment explain the comparison and terms. Three rounds of assessor feedback are included. Buy certification on its own or add the optional Fig platform; a technology subscription is not required.

Standalone Cyber Essentials starts at £299.99 + VAT. Select the size of the organisation being certified on the pricing page to see the applicable fee. Remediation effort and any separately scoped services are distinct from the certification assessment price. Fig's published six-working-hour assessment commitment applies to compliant Cyber Essentials submissions, not the time your organisation needs to become ready or complete a Plus audit. See the turnaround terms.

Start with the free readiness check, then choose your certification. If your scope or buyer requirement is unclear, discuss it with Fig before purchasing. The readiness check is an initial guide, not a certification decision. Cyber Essentials Plus adds independent technical verification of the same control areas; neither certificate replaces contractual, sector-specific or broader risk-management obligations.