100%
Readiness
Audit-day readiness, on the record
By the time the independent assessor arrives, every control has already been tested in a mock. Hover the dial to see it fill.
UK Cyber Essentials Plus Specialists
Cyber Essentials Plus.
Certified first time.
Self-assessment does not survive an independent technical test. One unpatched device or one unapproved admin account is enough to lose a public tender or NHS framework contract. Freshcyber gets your business certified first time, with continuous year-round scanning so renewal is never a scramble.
100% pass rate across every CE and CE+ engagement we have delivered.
PASS RATE 100%
Audit Simulation
Cyber Essentials Plus
AUDIT READY
Firewalls
Verified100%
Secure Configuration
Hardened100%
Security Update Management
Compliant100%
User Access
Enforced100%
Malware Protection
Active100%
Independent Assessor Readiness: Ready for Test
Companies of all sizes trust Freshcyber to achieve and maintain Cyber Essentials Plus.
Meridian WestCyber Essentials Plus
OdiliaClarkExternal Pen Test
Endocare DiagnosticsCyber Essentials Plus
Chalkhill FarmCyber Essentials & MDR
Talent EquationInternal Pen Test
MyGeexManaged MSP Partner
Meridian WestCyber Essentials Plus
OdiliaClarkExternal Pen Test
Endocare DiagnosticsCyber Essentials Plus
Chalkhill FarmCyber Essentials & MDR
Talent EquationInternal Pen Test
MyGeexManaged MSP Partner
100% First-Time Pass Rate
•NHS DSPT & Supply Chain Compliant
•Year-Round Continuous Scanning
The problem
It feels safe until the tester finds the one thing you missed.
The consequences of getting Cyber Essentials Plus wrong arrive in your inbox. Here is what that actually looks like. Tap between the three.
incoming-notice :: rejected-submissions
procurement@nhs-supplychain.exampleFri 14:02
Tender withdrawn — missing Cyber Essentials Plus evidence
BID LOSTPR
procurement@nhs-supplychain.exampleto you
Dear supplier,
Thank you for your submission to the framework. Your technical response scored well and your pricing was competitive. However, your submission listed Cyber Essentials (self-assessed) rather than the independently verified Cyber Essentials Plus certificate the framework mandates at qualification stage.
As certification status is a pass/fail qualifying requirement, we are unable to progress your bid to evaluation. The contract has been awarded to a supplier that held valid CE+ certification at the point of submission.
Tenders are lost at the final procurement stage because certification was not sorted in time. The work was good enough, the paperwork was not.
The outcome
What it looks like once this is handled properly.
Certified first time
The five technical controls are properly in place before the assessor arrives, not patched in a panic on the day.
A written gap analysis you can act on
Show your customer or insurer exactly where you stand and what's being fixed, or work through it with us. Either way you have evidence, not a guess.
Continuous monitoring, not a scramble
Our platform scans year-round, so renewal is never a last-minute fire drill. Nothing drifts out of compliance between audits.
A named point of contact
You talk to the person running your certification, not a support ticket queue. One number, one owner, accountability built in.
Continuous tooling
Live compliance, not audit-day guesswork.
Most competitors run a one-off scan and vanish. Our platform continuously scans your infrastructure using industry-standard vulnerability management tooling, the exact class of tooling CE+ assessors run against you.
freshcyber :: audit-telemetry
Delivered 200 OK
Deliveredaudit-bot@freshcyber.platform→eval@iasme.co.ukOct 02 11:24:00
// Real-time audit endpoint verification
await freshcyber.audit.verify({
scope: 'cyber-essentials-plus',
continuousScan: true,
autoRemediate: true
});
HTTP 200: { "status": "verified", "cveCount": 0 }4ms
HTTP 200: { "control": "firewalls", "ports": "hardened" }2ms
HTTP 200: { "mfaStatus": "enforced_all_admins" }3ms
Two views, one outcome
Built for the IT Manager who gets blamed, and the owner who loses revenue.
Same engagement, two lenses. The IT Manager sees zero panic on audit day. The Business Owner secures the tender revenue. Switch between them.
Pre-Audit Mock Technical TestSIMULATION
Control: Firewalls (external perimeter scan) PASS
Control: Secure Configuration (hardening) PASS
Control: Security Update Management (<14 days) PASS
Control: User Access (MFA & privilege separation) PASS
Control: Malware Protection (execution control) PASS
Ready for IASME certification upload, zero blocking findings.
Zero panic on audit day
We simulate the exact technical checks the independent assessor will run, before they ever arrive. If there is a missing patch, you fix it with us in private, not on the audit record. You are not the person explaining a failed test to the board.
Who this is for
The regulated sectors that end up at our door.
NHS Supply Chain
Healthcare and care providers
NHS Supply Chain now mandates CE+ for all in-scope suppliers, alongside an annual DSPT self-assessment deadline of 30 June.
Insurer requirement
Legal and financial services
Client confidentiality obligations and insurer requirements increasingly name CE+ explicitly as a condition of cover and of the engagement.
MOD / Public sector
Manufacturing and engineering
MOD and public sector supply chain tenders name CE+ as a qualifying requirement before you can even bid, never mind win.
Supply chain mandate
Professional and technology services
Corporate clients are pushing CE+ down their own supply chain as a condition of doing business, so your contract depends on it.
How it works
A short, credible path from gap to certified.
01
Gap analysis
We assess where you stand against all five technical controls, today.
02
Remediation
We work the findings with you, closing every gap before the real audit.
03
Independent certification
The assessor tests your environment. You pass, first time, on the record.
04
Ongoing monitoring
Our platform scans year-round so the certificate stays valid until renewal.
Free 3-minute check
Would your business pass Cyber Essentials right now?
Answer 15 quick questions across the five official controls and get your readiness score straight away, with a full breakdown by control area. No account needed, no technical knowledge required.
About three minutesAligned to the five NCSC controls
Pricing
Three ways to work with us.
The numbers are visible on purpose. If the scope or budget isn't a fit, you'll know before you take a call slot.
Cyber Awareness Month offer:50% off Readiness Assessment (£1,250, was £2,500). Limited to 10 places.
Readiness Assessment
Know where you stand before committing to certification.
50% off
£1,250one-off +VAT
£2,500Cyber Awareness Month: 50% off · Save £1,250
- Full gap analysis against all 5 technical controls
Firewalls, secure configuration, patch management, access control, malware.
- Written gap analysis report
Actionable findings you can work yourself or hand straight to an assessor.
- SAQ preparation and review support
Assistance verifying your self-assessment answers before formal submission.
- Pre-audit readiness score
Clear benchmark of pass probability prior to official audit booking.
Limited to 10 places in October. Assessment on its own; no certification or platform fees bundled in.
Managed Cyber Essentials Plus
End-to-end certification, kept current year-round.
Recommended
From£675/ mo
Billed monthly. Switch to yearly and save 20%.
100% pass rate across every certification we have delivered.
Everything in Readiness Assessment, plus:
- Audit fees included
No surprise assessor charges or hidden re-test fees.
- Paperwork & assessor chased for you
We handle the certification body directly so your team stays focused.
- Pre-audit mock technical assessment
Catch and fix failure points before the official auditor sees your network.
- Continuous vulnerability scanning
Year-round scans on industry-standard tooling, not just a one-off audit scan.
- Remediation guidance throughout
Prioritised step-by-step fixes for your team to action, not just a list of findings.
- Hands-on remediation available as an add-on (Managed Remediation Support)
Optional implementation support where our team works the fixes directly alongside yours.
- NCSC CAF Lite assessment includedNew
Self-serve Cyber Assessment Framework benchmark built into your dashboard.
- Automatic annual renewals
Your posture is kept in continuous compliance, so renewal is never a scramble.
CAF Roadmap
For regulated clients proving genuine NCSC alignment.
Managed CE+ Add-on
Custom/ monthly
Scoped to environment size & governance demands
Everything in Managed CE+, plus:
- Tailored prioritised CAF roadmap
Concrete actions mapped to the NCSC framework, not generic guidance.
- Owner, deadline & evidence tracking
Every control item logged with assigned stakeholder and proof of compliance.
- Quarterly executive check-ins
Structured reviews with Gary Sinnott to track progress and board reporting.
- Supply chain assurance support
Direct assistance completing rigorous enterprise & public sector questionnaires.
Add-on for Managed CE+ clients facing mandatory public sector or insurer CAF compliance.
FAQ
The quick answers.
Yes, and most clients do. Nothing has to be redone from scratch, the gap analysis carries straight through into the remediation and certification work.
If a tender names "Cyber Essentials," check the wording. Most NHS and public sector frameworks mean CE+ specifically, and we will confirm which one actually applies. We run the same gap analysis and remediation work either way, so the Managed Package always delivers the fully verified CE+ certificate, never just your own word for it.
The Readiness Assessment is a fixed £2,500 one-off, currently 50% off at £1,250 during October Cyber Awareness Month (limited to 10 places). The Managed Package starts from £675/mo, or from £540/mo when billed yearly (20% off), and scales with your device count. A 15-minute call gives you a clear number, sized to you.
If your business is UK-domiciled with turnover under £20m and you certify your whole organisation, you are automatically entitled to Cyber Liability Insurance up to £25,000, arranged via IASME and underwritten by AIG. You opt in at no extra cost.
Yes. UK nationwide, remote-first with occasional onsite when it matters, for example on audit day or for certain network assessments.
One call. We will tell you exactly what you need and what it will cost.
A straight fifteen-minute conversation, no forms to fill in first, no hard sell. You come away with a clear picture, even if you never book us.