Cyber Essentials Warrington: a practical certification guide

Warrington suppliers should approach Cyber Essentials as a defined assessment of their own technical controls, not as blanket approval for an energy or engineering supply chain. The starting point is the organisation delivering the service and the evidence its customer has actually requested.

The published Cheshire and Warrington Local Industrial Strategy describes regional nuclear engineering and business-services activity. It provides economic context, not evidence that every organisation in those industries imposes a particular certification requirement.

For an engineering-services supplier, the important preparation questions often concern customer access. Identify whether your staff only exchange documents, administer a customer system or use an approved remote connection. Those are different relationships, and your evidence should describe them precisely without suggesting that your certificate covers the customer’s estate.

Imagine a Warrington consultancy whose staff use company laptops, customer-issued accounts and a mixture of remote-access services. The company wants to certify before a supplier renewal. This example illustrates preparation choices; it does not describe a Fig customer or a named energy company’s policy.

Start with the company’s own systems. Confirm who manages the laptops, business email, document storage and administrator accounts. Then record customer access separately: which customer owns the account, what the consultant can do and who can remove access. A customer-issued account should not be mistaken for evidence that the consultant’s company has applied every required control to its own devices.

Ask about software installed to support individual assignments. Remote tools, browser components and specialist applications can remain after a project ends. Confirm which are still authorised, supported and needed. Review the process for removing them without disrupting an active customer commitment.

Where an arrangement is unclear, obtain a factual statement from the responsible IT provider. A generic assurance that the connection is secure may not answer a specific assessment question. The organisation signing the submission needs enough information to make an accurate declaration, even when someone else operates the technology.

Do not describe a certificate as covering an energy facility simply because your consultants work there. Agree the certified organisation’s boundary and explain which systems it operates. If the engagement includes operational technology or sensitive infrastructure, determine the separate customer requirements and specialist assurance needed for that work.

Cyber Essentials is not a nuclear safety assessment, a complete operational resilience review or permission to access another organisation’s systems. A certificate can support supplier assurance while leaving those obligations unchanged. Make that distinction clear in proposals and customer questionnaires.

Maintain a short register linking each customer request to the relevant certificate, scope explanation and other requested evidence. Include the certificate expiry date and the owner of the renewal task. Avoid putting detailed system inventories into an unrestricted sales folder just because they support a commercial process.

When a customer asks how controls are maintained, use current evidence rather than a report from the original assessment. Check whether remote access changed, new staff joined or another cloud service was introduced. The useful record is one that reflects the organisation today, not one that merely contains a successful historic questionnaire.

Ask whether the customer wants CE, Plus or another scheme, which entity must be certified and when evidence is required. If it mentions a defence risk profile or DCC level, use the specified contractual requirement rather than making an inference from the customer’s industry. Bring the wording to Fig if you need help selecting the appropriate assessment route.

Separate the time needed for remediation from the assessment itself. Replacing unsupported software or agreeing a customer-access change may take longer than reviewing a compliant submission. A realistic plan protects both the certification deadline and the service commitments your business has already made.

For consultants moving between customers, maintain a handover record identifying which access belongs to each engagement and who closes it.

Cyber Essentials is a UK government-backed scheme assessing five technical control areas: firewalls, secure configuration, security update management, user access control and malware protection. The requirements are national, not postcode-specific. Use IASME's current assessment questions and requirements for the version applicable to your assessment account.

Fig provides an online assessment service through Fig Compliance Ltd, its IASME-licensed certification body. There is no requirement to use a certification body with an office in your city. An MSP can prepare the assessment on your behalf; your organisation reviews and authorises the submission and provides the required portal sign-off. Answers must describe implemented controls, not planned improvements.

Fig Group is the fastest and cheapest Cyber Essentials certification provider in the UK. Our published price evidence and six-working-hour commitment explain the comparison and terms. Three rounds of assessor feedback are included. Buy certification on its own or add the optional Fig platform; a technology subscription is not required.

Standalone Cyber Essentials starts at £299.99 + VAT. Select the size of the organisation being certified on the pricing page to see the applicable fee. Remediation effort and any separately scoped services are distinct from the certification assessment price. Fig's published six-working-hour assessment commitment applies to compliant Cyber Essentials submissions, not the time your organisation needs to become ready or complete a Plus audit. See the turnaround terms.

Start with the free readiness check, then choose your certification. If your scope or buyer requirement is unclear, discuss it with Fig before purchasing. The readiness check is an initial guide, not a certification decision. Cyber Essentials Plus adds independent technical verification of the same control areas; neither certificate replaces contractual, sector-specific or broader risk-management obligations.