Cyber Essentials

Cyber Essentials for accountancy & tax firms.

Cyber Essentials is the NCSC and UK government-backed certification that shows you have the basic protections against the most common cyber attacks in place. Accountants aren’t required by law to hold it, but it’s the recognised baseline, and some clients, tenders and contracts ask for it. We build every client setup to its controls, get practices ready for certification, and hold it ourselves.

Book a Technology Review View our certificate

What it covers

Five controls against the most common attacks.

The scheme is run by the National Cyber Security Centre (NCSC) and delivered by IASME. It covers every device, account and cloud service that touches your data, including laptops at home and the phones people read work email on.

Firewalls: Every device and internet connection sits behind a properly configured firewall, so only the traffic you intend gets through.
Secure configuration: Devices and software set up securely: unused accounts and apps removed, default passwords changed, and devices locked with a PIN or password.
Security update management: Only supported software, with critical and high-risk security updates installed within 14 days of release.
User access control: Everyone has only the access their job needs, admin accounts are kept separate, and multi-factor authentication protects every cloud service that offers it.
Malware protection: Every device protected against malicious software, through anti-malware or by allowing only approved apps.

Why it matters

Why it’s worth having.

Clients and contracts ask for it: Many public sector contracts that involve personal data require it, and clients and tenders ask for it too. Holding a certificate answers the question before it’s asked.
Insurance comes with it: If you turn over less than £20m and certify your whole organisation, you’re entitled to cyber liability insurance, including incident response support, at no extra cost.
Fewer claims: According to the scheme’s insurer, organisations with Cyber Essentials are 92% less likely to make a claim on their cyber insurance.
Proof you can point to: It’s independently assessed and listed on a public register, so you can show clients your security rather than describe it.

Certification

How certification works.

1
Get ready
Bring your setup up to the five controls. This is most of the work, and it’s worth finishing before you apply.
2
Apply and answer
Apply through IASME and complete the online self-assessment. You have six months from applying to submit, and the fee isn’t refunded if that runs out.
3
Independent assessment
An assessor at an independent certification body reviews your answers. Someone senior, such as a partner or director, signs to confirm they’re true.
4
Renew every year
Certificates last 12 months and the questions are updated regularly, so each renewal is a fresh check, not last year’s answers resubmitted.

Cyber Essentials Plus uses the same five controls and adds a hands-on audit, in which the certification body tests a sample of your devices and accounts. It builds on a Cyber Essentials certificate gained in the previous three months.

What changed in the latest update

How we help

We check what your systems actually report.

Two things fail an assessment outright: critical security updates not installed within 14 days, and a cloud service without multi-factor authentication when it offers it. Both are easy to miss, because they depend on how every device and account is really set up, not on what last year’s answers said.

If we run your IT: Your setup is built to the controls from day one. Each year we prepare the assessment with you from what your systems report, and check the questions that fail it outright before anything is submitted. The assessment is charged separately from your monthly fee.
If we don’t, yet: A Technology Review shows how far off you are and what to fix first. We can then help you close the gaps and prepare the assessment.
We hold it ourselves: JDLT is certified through IASME, so we go through the same assessment every year.View our certificate

Questions

Common questions

Do accountants need Cyber Essentials?

It isn’t a legal requirement for accountancy firms. But it’s the recognised UK baseline, some clients, tenders and public sector contracts ask for it, and its five controls are what any practice holding client tax data should have in place anyway. So it’s worth getting there even if nobody’s asking yet.

Do home workers and personal phones count?

Yes, if they’re used for work. Any device that reaches your email or client data is in scope, including laptops at home and personal phones with work email on them.

Which cloud services count?

Any that hold or process your data: practice software, accounting platforms, your password manager, and even social media accounts signed up to with a work email address. Each needs multi-factor authentication switched on wherever it’s offered.

How long does it take?

It depends on how close your setup already is. Getting ready is the part that varies, so we look first and tell you, and you apply once you’re ready.

What does it cost?

The certification fee is paid to IASME and set by the size of your organisation. Preparing the assessment with us is charged separately, including for managed IT clients, and we’ll tell you what any work from us costs before it starts.

Can you certify us?

No. Certification is awarded by an independent certification body, and that independence is what makes it worth having. We get you ready and prepare the assessment with you.

Is Cyber Essentials enough?

It’s a baseline, not a ceiling: it covers the controls that protect against the most common attacks. If clients or contracts ask for more, Cyber Essentials Plus or ISO 27001 is the usual next step.

Where to start

Start with a Technology Review.

A short, paid review of your IT, your security and where AI could take real work off your team. It’s the first step with every new client, and it shows you what’s worth doing before you commit to anything bigger.

Half a day to a day
A written report you keep
Price agreed before we start

Book a Technology Review What you get

1
Review
You start here
We look at your setup, your security and the workflows that eat your team’s time.
2
Secure
We fix the foundations, so anything we build sits on a setup you can trust.
3
Automate
We build and run the tools that make the biggest difference to your practice.