Scope and evidence preparation
Yes, within the agreed small-business scope
Protect your business
Prepare for Cyber Essentials with a clear plan.
A customer has asked for certification, a tender includes a security requirement, or you want a more structured baseline for your business. The next step is to understand what the scheme requires and what your current environment can demonstrate.
Oblyx helps you organise that preparation: agree the environment to review, gather evidence, identify gaps and plan the practical work needed before independent assessment.
£695 for the standard small-business readiness package. VAT applies where applicable. Implementation and certification fees are separate.
What Cyber Essentials covers
Cyber Essentials is a government-backed certification scheme addressing five technical areas:
- Firewalls.
- Secure configuration.
- Security update management.
- User access control.
- Malware protection.
The certification uses a self-assessment verified by an independent Certification Body. Cyber Essentials Plus addresses the same controls with additional independent technical testing. Your customer's requirement should determine which route you need.
Readiness work helps you prepare; it does not issue a certificate or replace the assessor's decision.
What the £695 package includes
The standard package is for one business with a straightforward environment: up to 10 users and 10 devices, one Microsoft 365 tenant and one office network. We confirm fit before booking. Other business cloud services, remote working and personal devices must be disclosed during scoping; relevant systems cannot be ignored to fit a fixed-price package.
You receive:
- An agreed preparation scope and a record of the systems and services considered.
- A tailored evidence checklist for the applicable scheme requirements.
- A requirement-by-requirement gap register showing what is evidenced, what needs work and what remains unverified.
- A preparation workbook to help you organise accurate questionnaire responses.
- A prioritised improvement plan with clear responsibilities.
- One follow-up session of up to 45 minutes to discuss the findings and remaining questions.
The package includes one review cycle of the evidence supplied. Further evidence rounds, material scope changes or support beyond the included follow-up are quoted separately.
Use the right requirements from the start
For new assessment purchases from 27 April 2026, IASME identifies the Danzell question set and the current IT infrastructure requirements are version 3.3. We check the applicable version at the start rather than relying on an old checklist.
Scope needs particular care. Cloud services used for business data must be accounted for, and relevant end-user devices, including remote or personal devices, need appropriate treatment. The certification scope is agreed with the Certification Body. Our commercial package limits the size and complexity of the work; it does not redefine the scheme's scope.
Backups and continuity are important to running the business, but they are not an additional Cyber Essentials technical control. If you need a broader view of recovery and incident arrangements, consider the Business Cyber Review.
Read the official scheme information · See IASME's current question sets
How preparation works
1. Understand the requirement. Tell us what prompted certification, which level has been requested, any deadline and whether an assessment account has already been purchased.
2. Confirm suitability and scope. We establish your users, devices, networks, cloud services, remote work and existing IT responsibilities. We agree the readiness deliverables and identify any scope question that needs the Certification Body's confirmation.
3. Gather evidence and review the gaps. We compare the supplied information with the applicable requirements. We help organise responses but do not invent evidence or treat planned changes as completed controls.
4. Agree the improvement work. Your existing provider can implement the changes, or Oblyx can quote suitable work separately. Any required licences, replacement devices or additional support are explained before a purchase or change.
5. Move to independent assessment. Your authorised senior representative remains responsible for accurate answers and sign-off. The Certification Body assesses the submission and determines whether certification can be awarded.
What we need from you
Nominate a business owner and a technical contact or existing IT provider. We will ask for an accurate asset and software list, cloud-service details, network and remote-working information, relevant account and MFA settings, update/protection evidence and any certification request from your customer.
Evidence can be reviewed through an agreed screen-sharing session or temporary access appropriate to the work. We agree collection and transfer arrangements before starting. Do not email passwords, MFA recovery codes, confidential client records or unnecessary personal information.
A realistic schedule depends on evidence availability and how much remediation is needed. We agree dates after discovery; we do not promise a pass or a fixed certification turnaround.
Preparation, improvements and certification are separate
Gap register and preparation workbook
Yes
Prioritised improvement plan and one follow-up
Yes
Configuration changes or replacement equipment
No — separately scoped and agreed
Licences, subscriptions or certification fees
No
Independent assessment or Cyber Essentials Plus testing
No — arranged with a Certification Body
Unlimited resubmission or ongoing monitoring
No
Oblyx provides preparation support; an independent IASME-licensed Certification Body makes the certification decision.
Frequently asked questions
Do I have to buy a review first?
No. If your objective is Cyber Essentials and the environment fits, you can start directly with readiness support. We will recommend a different scope only where it addresses a real need.
Does £695 include the certificate?
No. The fee covers the preparation package described above. The independent assessment fee is separate, as are implementation, additional licences and any Plus testing. Confirm the current assessment price and any funding eligibility before buying.
Can we get funding?
Government or scheme funding may be available subject to eligibility, deadlines and remaining funds. We can signpost the official information during discovery. Funding is not guaranteed, and support available through another programme may differ from this package.
Do you complete the questionnaire for us?
We help organise the evidence and prepare accurate responses. Your business retains responsibility for the answers, required senior sign-off and submission. Questions affecting interpretation or certification scope are referred to the Certification Body.
What if we have other cloud applications or personal devices?
Tell us during discovery. Relevant business cloud services and devices must be considered under the scheme's rules. If that adds complexity beyond the standard package, we agree a revised scope and price before work starts.
Does readiness support guarantee a pass?
No. Certification depends on meeting the requirements and the independent assessment. Our work identifies preparation gaps and helps you plan the next steps; incomplete evidence or unresolved controls remain open.
Can you help prepare for Cyber Essentials Plus?
Tell us at discovery if Plus is required. Its technical testing needs separate planning with a Certification Body. Plus preparation and testing are not included in the standard £695 package.
Will certification cover all security and compliance obligations?
Cyber Essentials is a defined technical baseline. It does not replace business continuity planning, legal or regulatory advice, or additional controls needed for your particular business and contracts.
Start with the requirement you need to meet
Tell us your business size, the customer requirement or objective, and any deadline. We will establish whether this package fits and what should happen next.
Cybersecurity & resilience · Business Cyber Review · Microsoft 365 support
Speak with Oblyx
Make protection part of a better working business.
Tell us what has prompted your enquiry. We will agree the right starting point with you.