Cyber Essentials before a tender deadline: the two-week checklist

You are bidding for work and the tender asks for Cyber Essentials. The certificate can be turned around quickly, but only if you prepare in the right order. Start with scope, not the questionnaire.

Days one and two: list every cloud service and device your organisation uses. Pull the list from card statements and your identity provider, not from memory — a missing service is the most common reason submissions come back.

Days three to five: fix the obvious gaps. Individual accounts for everyone, multi-factor authentication on everywhere it is offered, unsupported software removed or updated, and automatic updates enabled on every device.

Week two: write or adapt the policies, have a director review and sign the declaration, then submit the questionnaire to your chosen certification body. Answer every question against your register, not from recollection.

If the deadline is truly immovable, tell the buyer you are in process and give a date. Many buyers accept a committed date with evidence of preparation over silence.

After the deadline passes, keep the routine going. Kept's reminders and evidence register mean the next tender — or the renewal — never becomes a two-week scramble again.