Scope statement
The people, offices, devices, and cloud services in scope, written the way the assessor expects to read it.
The Problem
Your Customer Wants the Certificate and the Questions Look Simple
It shows up when a tender or contract asks for Cyber Essentials, and the question set seems easy until you count every laptop, phone, and cloud account.
01 · MFA
Cloud logins still work with only a password.
MFA is switched on for every cloud service in scope before you submit.
02 · Patching
Critical updates sit uninstalled for weeks on old laptops.
A patch routine installs critical and high-risk fixes inside the 14-day window.
03 · Admin accounts
Staff browse and email from administrator accounts every day.
Admin rights move to separate accounts used only for admin tasks.
04 · Old software
An unsupported Windows version still runs the reception PC.
Unsupported systems are upgraded or removed before the assessment starts.
Your customer's tender asks for Cyber Essentials, so someone downloads the questions on a Friday afternoon. They look like yes or no answers. Then you count devices: two old Windows laptops nobody updates, phones on personal plans, a router with its default password, and a dozen cloud apps. Half the cloud logins have no MFA, and under the April 2026 rules that alone fails the assessment. Nobody knows which answers are true.
We start by agreeing the scope, then check every device and cloud service against the five control themes and the current question set. Fails get fixed before anyone pays the scheme fee: MFA switched on, unsupported software removed, patches brought inside 14 days. Then we review each answer with you. Your answers describe the setup you actually run, not the one you hope you have.
Every control pre-checked
Firewalls, configuration, patching, access, and malware protection checked on your real devices.
Every device counted
Laptops, phones, servers, routers, and cloud services in scope listed before any answer.
Answers that match reality
Each answer reviewed against what's really configured before you submit it.
Our Cyber Essentials Certification Support Process
From Device Count to a Confident Submission in Five Clear Steps
You approve the scope statement, every change to your devices and accounts, and each answer before anything goes to your certification body.
We ask how many people, devices, and cloud services you run, and whether a contract needs Cyber Essentials or Plus. You get a scope statement and a fixed price. If you can pass alone with the published questions, we'll tell you before we quote.
What's Included
What You Get With Cyber Essentials Support
Each engagement covers the scope statement, a pre-assessment against the current questions, MFA and access fixes, patching and configuration fixes, submission support, and Plus readiness.
Compare Options
DeveloperLook vs DIY questionnaire vs Certification body
Answering the questions yourself is the cheapest route, and only a certification body can award the certificate. Some call it cyber essentials accreditation, but either way, here is where each option fits.
| Feature | DeveloperLookBest fit | DIY questionnaire | Certification body |
|---|---|---|---|
| Scoping | Scope statement agreed first | Your own reading | Checked at assessment |
| Question set | Mapped to the current version | Read from the guidance | Marked, not explained |
| Fixes | MFA, patching, and configs fixed | Left to you | Not part of the assessment |
| Before filing | Every answer reviewed with you | Filed as written | Not applicable |
| Certificate | Prepared for your assessor | Issued if answers pass | Yes, awards it |
| Plus readiness | Scans and sample tests first | Not included | The audit itself |
| Support | 30 days after you submit | Published guidance | During the assessment |
| Cost | Fixed fee from $450 | Scheme fee only | Scheme fee or Plus quote |
DeveloperLook
DIY questionnaire
- Scoping
- DeveloperLook: Scope statement agreed firstDIY questionnaire: Your own reading
- Question set
- DeveloperLook: Mapped to the current versionDIY questionnaire: Read from the guidance
- Fixes
- DeveloperLook: MFA, patching, and configs fixedDIY questionnaire: Left to you
- Before filing
- DeveloperLook: Every answer reviewed with youDIY questionnaire: Filed as written
- Certificate
- DeveloperLook: Prepared for your assessorDIY questionnaire: Issued if answers pass
- Plus readiness
- DeveloperLook: Scans and sample tests firstDIY questionnaire: Not included
- Support
- DeveloperLook: 30 days after you submitDIY questionnaire: Published guidance
- Cost
- DeveloperLook: Fixed fee from $450DIY questionnaire: Scheme fee only
Projects We've Built
Finance and Business Websites We Have Built
Finance, consulting, and HR websites and apps we designed and built. Businesses like these hold client data and often need Cyber Essentials for their contracts.
Armada AG Fiduciary and Consulting Services Website
- Finance
- Business
- Website
Finto Corporate Website Design & Development
- Finance
- Dashboard
- Website
Moneywish Finance App Design & Development
- Finance
- Dashboard
- Mobile App
Herile HR and Project Management Platform Website
- Business
- Dashboard
- SaaS Platform
What Our Clients Say
What Clients Say After Launch
Feedback from teams we have built websites, apps, and platforms for.
We had a pretty specific idea of what we wanted our website to become, but I wasn’t sure how easily we could explain all of it to a development team. There were quite a few moving parts, and we were working toward a deadline, so I expected a few things to get lost along the way. That never really happened. They understood what we were trying to achieve, kept us updated throughout the process, and got everything ready within the agreed timeline. The final site feels much easier to navigate, works beautifully on mobile, and is noticeably smoother for our customers. It was a huge relief seeing the original idea actually turn into the website we had in mind.
The mobile experience is probably my favourite part of the new site. We had spent a lot of time making sure the desktop version looked right, and the team kept pushing us to think about how everything would actually feel on a phone too. They were right. The navigation is clean, the interactions feel natural, and everything we’ve tested so far works exactly as it should. They also went through the links, forms, integrations, and other details more than once before launch, which I really appreciated. And even after going live, we could still reach out when something came up. The whole process felt friendly, organised, and surprisingly straightforward.
What I appreciate most is that the website is actually easy for us to manage now. We can update content ourselves instead of sending a developer a message every time we need to change something small. They also paid attention to the technical SEO side, which mattered to us because we didn’t want a new website to create problems for the traffic we already had. I’ve probably asked more questions than I should have since launch, but every question has been handled patiently and without any fuss. The team is easy to work with, they explain things clearly, and when we need something changed, they focus on getting it done rather than making the process complicated.
1,250+
Projects shipped
10+
Years of experience
Top 3%
Upwork Top Rated Plus
5 stars
Average review score
Want results like these?
Tell us what you are building. You get a reply within 24 hours on business days, then a written estimate.
Work Culture
Why UK Businesses Trust Us With Their Certification
Certification asks you to state facts about every device you own. These habits keep those answers true and keep your staff working while the fixes go in.
Answers you can stand behind
We never suggest an answer that isn't true today. Your customers rely on the certificate meaning something, and a false answer puts it at risk.
Fixes outside working hours
Updates and setting changes that could interrupt work go out in the evening or at weekends. Your team keeps working while devices get fixed.
Honest advice on Plus
If basic Cyber Essentials meets your contract, we won't push you to Plus. When a contract does require Plus, we'll say so early.
Clear about our role
We're not a certification body and never mark our own work. An IASME-licensed body assesses you, and you'll always know who does what.
Your IT person stays in charge
We work alongside whoever runs your IT and explain each change. They keep the admin access and the know-how after we leave.
A renewal you won't miss
Certificates expire after 12 months. We hand over a renewal date and a short checklist, so next year's renewal takes days, not weeks.
Overview
What does Cyber Essentials certification support include?
DeveloperLook provides Cyber Essentials certification support for UK businesses that need the certificate for a contract or tender. We scope your devices and cloud services, pre-check every control against the current question set, fix the fails, and review your answers. Projects start at $450 and take 1 to 6 weeks, with the scheme fee paid separately.
DEVELOPERLOOK
Project facts · Cyber Essentials Certification Support
- Service
- Cyber Essentials certification support (scoping, pre-check, fixes, submission, Plus readiness)
- Typical timeline
- About 1 week for a pre-check, 2 to 6 weeks with fixes
- Platforms
- Microsoft 365, Google Workspace, Windows, macOS, iOS, and Android
- Built with
- Microsoft Intune, Defender, Entra ID, and Greenbone OpenVAS
- Experience
- 10+ years of development experience and 1,250+ shipped projects
- Post-launch support
- 30 days of support after you submit
- Communication
- Calls in US, UK, and AU business hours
- Starting price
- From $450 USD, fixed scope after a free scoping call
Reviewed 22 Oct 2026 by Saimul Islam
Good fit
UK small businesses bidding for contracts
Your customer's procurement form asks for a Cyber Essentials certificate, and the deadline is weeks away with nothing in place yet.
Teams whose last attempt failed
Your last submission came back with fails on MFA or patching, and you want them fixed properly before you pay to try again.
Suppliers to government and the MOD
Your contract falls under PPN 014 or the MOD's Cyber Security Model, and you need Cyber Essentials Plus lined up before the award.
Offices on Microsoft 365 or Google Workspace
Your staff use Microsoft 365 or Google Workspace on Windows, Mac, iPhone, and Android devices, and you need cyber essentials compliance across all of them.
MSPs and IT partners
Your clients keep asking for help with the scheme, and you need cyber essentials consultancy you can deliver under your own brand.
Not a fit
Need the certificate issued
You need the certificate itself. Only an IASME-licensed certification body can assess and certify you, so we get you ready and support your submission.
Need every flaw ranked
Your client wants a full vulnerability assessment with every finding ranked, not a scheme certificate. Our vulnerability assessment services cover that.
Patching is the real gap
Your main problem is keeping hundreds of devices patched every month, not the certificate. Our patch management services run that as an ongoing program.
Budget under $450
Your budget is under $450 and you run a few laptops on one cloud service. The NCSC's published requirements and IASME's question preview can get you there alone.
Not sure we're the right fit?
Book a free call or message us. We'll tell you honestly whether we're the right team.
Pricing
Transparent Starting Prices for Cyber Essentials Certification Support
These are starting points in USD. Your final price depends on your device count, your cloud services, and whether you need Plus, and you get a fixed proposal after a free scoping call.
For small UK businesses that want to know where they'd fail before paying the scheme fee.
$450one-time, USD
- Free scoping call and scope statement
- Pre-check against the current question set
- Device, account, and cloud service inventory
- Fix list for every likely fail
- Answer review before you submit
- 30 days of support after you submit
Recommended
For businesses of up to 50 devices that need the fails fixed before they submit.
$1,200one-time, USD
- Everything in Readiness Check
- MFA on every cloud service in scope
- Patch routine that meets the 14-day rule
- Admin account and default password fixes
- Firewall and router settings reviewed
For organizations of up to 250 devices going for Cyber Essentials Plus.
$2,600one-time, USD
- Everything in Fix and Certify
- Internal and external vulnerability scans
- Sample device checks that mirror the audit
- Fixes for anything the scans find
- Support during your Plus audit
- Renewal date and yearly checklist
For Agencies
White-Label Cyber Essentials Support for MSPs and IT Partners
You own the client relationship. We supply the pre-checks, fixes, and answer reviews under your brand, and join client calls only when you ask. Your clients get certification help without you hiring a compliance specialist.
How the partnership works
White label: your client only ever sees your brand
- Your client
- You, the agency
- DeveloperLook
Share the client brief
Send the client's headcount, devices, cloud services, and the contract asking for it.
- Client needs
- You share the details
- Details received
We scope and price
You get a draft scope statement and a fixed price per client.
- Scope and plan
- Proposal to resell
- Your quoteYOUR LOGO
Check, fix, review
We pre-check, fix the fails, and review answers before the client submits.
- Done by our team
- Your brand on it
- Handed to your clientDone
Partner with DeveloperLookDelivered under your brand
Stay client-facing
You present the results while we work quietly under your brand.
Device-level fixes
MFA, patching, and configuration changes made across your clients' devices.
Your report format
Fail lists and scope statements written in your own template.
Renewals across clients
One client's certificate or yearly renewals for your whole client list.
The Right Technology for Your Project
Technology Stack
We fix controls inside the cloud and device tools UK businesses already use, and check them with open scanners before any assessor does.
- Microsoft 365
- Google Workspace
- Microsoft Entra ID
- Okta
- Microsoft Intune
- Jamf Pro
- Windows Update for Business
- Microsoft Defender
Cloudflare- pfSense
- Ubiquiti UniFi
- Nmap
- Greenbone OpenVAS
- Nuclei
Google Sheets
Loom
FAQ
Frequently Asked Questions
Straight answers on cost, scheme fees, timing, Plus, renewals, and whether your contract needs it.
Saimul IslamFounder & CEO, DeveloperLookStill have questions?
Send a message or book a call with the team.
Our Cyber Essentials certification support starts at $450 for a pre-check against the current question set with a fix list. Fixing the fails for up to 50 devices costs $1,200, and Plus readiness for up to 250 devices starts at $2,600. The scheme fee or Plus audit fee goes separately to your certification body.
IASME sets the Cyber Essentials fee by organization size, from £320 plus VAT for up to 9 employees. Firms of 10 to 49 pay £440, firms of 50 to 249 pay £500, and larger ones pay £600. Plus is quoted by each certification body, so your total cyber essentials certification cost is that fee plus any readiness help.
Most small businesses get Cyber Essentials certified within 2 to 6 weeks with our help. The pre-check takes about a week, and fixes take 1 to 3 weeks depending on device count. Your certification body then assesses the submission, and Plus adds its technical audit on top.
Cyber Essentials certification is a UK government-backed scheme that shows your business has basic controls against common internet attacks. The NCSC runs it with IASME as its delivery partner. It covers 5 control themes: firewalls, secure configuration, security update management, user access control, and malware protection.
You agree your scope, meet the requirements on every in-scope device and cloud service, and answer the self-assessment through an IASME-licensed certification body. The current requirements are version 3.3, with the Danzell question set, used from 27 April 2026. Fix every likely fail before you pay, because answers must match reality.
You need it if a customer or contract asks for it, and many UK public sector contracts do. Central government contracts handling personal data or OFFICIAL information require it under PPN 014, and MOD suppliers meet it through Defence Standard 05-138. Otherwise it's voluntary, though it gives buyers quick proof of basic security.
Cyber Essentials Plus certification adds a hands-on technical audit to the same requirements. A certification body tests a sample of your devices and runs internal and external vulnerability scans. If your basic certificate is under 3 months old when Plus starts, you don't need to repeat the self-assessment.
The main benefits are access to contracts, a sound security baseline, and included insurance for many small firms. You can bid for work that requires the certificate, and the controls block many common attacks. UK firms with turnover under £20 million that certify the whole business can opt in to the cyber liability cover.
A Cyber Essentials certificate expires 12 months after it's issued, so you renew every year to stay certified. Each renewal uses the requirements current at the time. Since 27 April 2026, missing MFA on a cloud service or critical updates left beyond 14 days are automatic fails, so keep those routines running all year.
Cyber Essentials Plus also expires after 12 months, the same as the basic certificate. Plus builds on the basic self-assessment, so plan both renewals together each year. Our top plan ends with a renewal date and a checklist, so next year's audit isn't a scramble.
Saimul IslamFounder & CEO, DeveloperLookStill have questions?
Send a message or book a call with the team.
Free 30-min callGoogle Meet
Book a call
Book a free 30-minute call
In 30 minutes on Google Meet we walk you through how we would build it, how long it takes and what it costs. Then you get a written estimate.
Calendar not showing? Book on cal.com or send a brief.