Cyber Essentials Advisory
Cyber Essentials is the UK government-backed scheme that defines a baseline set of technical controls against the most common cyber threats. For many education and public sector organisations, certification is a condition of funding, a requirement in public contracts, or a sensible starting point for building a defensible security posture.
The scheme is more demanding in practice than it appears. The five technical areas firewalls, secure settings, user access control, malware protection, and patch management must be genuinely in place and evidenced accurately. If the controls do not meet the standard as written, the assessment fails. If they are self-certified inaccurately, the liability sits with the organisation.
Clark & Company provides advisory support through the Cyber Essentials and Cyber Essentials Plus certification process, ensuring that controls are genuinely in place before you present for assessment.
Note: Clark & Company is not a recognised Cyber Essentials certification body. The advisory service prepares you for assessment by a certifying body of your choice. Certification is obtained through that body, not through Clark & Company.
Pricing
| Service | Published Price |
|---|---|
| Cyber Essentials advisory | £950 + VAT |
| Cyber Essentials Plus advisory | £1,200 + VAT |
When Advisory Support Applies
Many organisations attempt Cyber Essentials without advisory support and fail at self-assessment or technical verification. The failure is usually not a failure of intent. It is a failure of interpretation.
First-time certification. You are going through Cyber Essentials for the first time and want to be sure your controls genuinely meet the standard before assessment.
Failed assessment. You have attempted certification and failed or received feedback that is not clear. Advisory support identifies the gap and what needs to change before you resubmit.
Certificate renewal. Your certificate is approaching renewal. The IT environment has changed since your last assessment, and you want confirmation that controls are still compliant before you resubmit.
Cyber Essentials Plus. You hold Cyber Essentials and are preparing for the Plus assessment, which requires independent technical verification rather than self-assessment.
Funding or contract deadline. Certification is required as a condition of a contract or grant and you need to get through the process accurately under time pressure.
What is Included
Gap assessment. A structured review of your current technical controls against all five Cyber Essentials technical areas. We identify what is in place, what is not, and where the standard requires a specific interpretation.
Control mapping. Your current arrangements mapped against the Cyber Essentials requirements for each technical area, with specific remediation actions identified before assessment.
Remediation guidance. Where controls need to change, specific practical guidance on what needs to change and why, reflecting your actual environment rather than a checklist.
Self-assessment review. Before you submit your Cyber Essentials self-assessment, we review your responses against the control evidence. Inaccurate self-certification carries risk. A pre-submission review reduces it.
Technical verification preparation. For Plus assessments, we prepare you for the independent technical verification — scope confirmed, controls in place, evidence base ready before the assessor engages.
Scoping guidance. Many failures result from scope errors. We confirm the scope of your assessment before you begin.
Frequently Asked Questions
Does Clark & Company certify us?
No. The advisory service prepares you for assessment by a recognised certifying body. You select the certifying body. We make sure you are ready before you present to them.
What is the difference between Cyber Essentials and Cyber Essentials Plus?
Cyber Essentials is a self-assessment verified by your certifying body. Cyber Essentials Plus requires independent technical verification, including direct checks of the controls in place. Plus is required by some contracts and funding bodies.
How long does the advisory take?
Most engagements are completed within two to three weeks, depending on the IT environment and the remediation required. Where a deadline is driving the timeline, we will work to it if it is achievable.
What if we have a complex IT environment?
Multi-site, mixed device ownership, shared services, cloud platforms, and legacy infrastructure are common in the sector. Scope definition is particularly important in these cases and is a significant part of the advisory.
Can you recommend a certifying body?
We can provide guidance on selecting an NCSC-approved certifying body appropriate for your organisation. We have no commercial relationship with any certifying body and make no recommendation on that basis.