What’s your Cyber Essentials score?

From score to certificate, step by step

Your score is stage one. These are the stages that follow — what to do at each one, and what to keep as proof. Times are typical for a small firm, not a promise.

1. Get ready

   • Decide why, and what is in scope

     Most small firms certify the whole organisation — it is simpler and customers prefer it. Write down which offices, devices and cloud services are covered.

     What to do:

     1. Write one sentence on why you are doing this — for example, a customer asked for it.
     2. List every office, laptop, phone and cloud service your business uses.
     3. Decide whether the certificate covers the whole business (simplest) or a named part.
     4. Show the list to whoever runs the business and get them to agree it.

     Keep as proof: A short scope note: what is covered, agreed by whoever signs things off.

     Typical: A dayRead the free guides first

   • Check where you stand

     Answer the ten questions in the free readiness check and get a score out of 100. The gaps it lists are your starting to-do list.

     What to do:

     1. Open the free readiness check using the link below.
     2. Answer each question honestly — “not sure” is fine, it still counts.
     3. Read your score and the list of gaps it gives you.
     4. Save or screenshot the result so you can compare it later.

     Keep as proof: A printout or screenshot of your score and gap list, dated.

     Typical: Five minutesFree readiness check

   • Name one person to own it

     One named person chases the fixes, keeps the evidence and answers the assessor's questions. In a small firm that is usually the owner or the office manager.

     What to do:

     1. Pick one person — usually the owner or office manager.
     2. Tell them they own this: the fixes, the evidence, the assessor's questions.
     3. Write their name at the top of your scope note.
     4. Put a monthly half-hour in their diary to keep things moving.

     Keep as proof: The name of the person responsible, written into your scope note.

     Typical: A conversationSee how Kept helps them

2. Close the gaps

   • Work through the five controls

     Firewalls, secure configuration, security updates, user access control and malware protection. The checklist in your Kept workspace tracks each one with notes on what you have done.

     What to do:

     1. Open your controls checklist using the link below (sign in if asked).
     2. Start with the first control and read what it asks for.
     3. Fix what you can, or ask your IT support to fix it.
     4. Tick the control off and add a short note on what you did.
     5. Repeat until all five controls are ticked.

     Keep as proof: Every control marked in place, with a note on where the proof lives.

     Typical: Two to six weeks, depending on the gapsYour controls checklist

   • Write the policies

     Short, honest policies beat long ones nobody reads. Start from the free templates and adjust them to what you actually do.

     What to do:

     1. Open the free policy templates using the link below.
     2. Download each template and fill in your company name and details.
     3. Delete anything that does not apply to you — honest beats long.
     4. Get the owner to sign and date each one.

     Keep as proof: Signed, dated policies that match what your business really does.

     Typical: A weekFree policy templates

   • Gather the evidence as you go

     Screenshots of settings, lists of devices, update records. Snapshots in your Kept workspace freeze today's position so you can show it later.

     What to do:

     1. Each time you fix something, take a screenshot of the setting.
     2. Open your evidence page using the link below.
     3. Save the screenshot or note against the right control.
     4. Check each control has at least one piece of proof attached.

     Keep as proof: An evidence snapshot for each control, dated.

     Typical: Alongside the fixesEvidence snapshots

3. Apply

   • Choose a certification body

     Cyber Essentials is assessed through IASME and its network of certification bodies. Get a quote, check what is included, and ask how quickly they mark assessments.

     What to do:

     1. Search for IASME's list of certification bodies online.
     2. Pick two or three and ask each for a written quote.
     3. Ask how quickly they mark assessments and what help is included.
     4. Choose one and keep the quote you accepted.

     Keep as proof: The quote you accepted and the name of your certification body.

     Typical: A weekRead what the assessment involves

   • Complete the self-assessment questionnaire

     You answer questions about your scope, devices and the five controls. Answer honestly and in plain words — your checklist notes and evidence make this far quicker.

     What to do:

     1. Log in to your certification body's portal and open the questionnaire.
     2. Keep your Kept checklist and evidence open in another tab.
     3. Answer each question in plain words, copying from your notes where you can.
     4. Read every answer once more, then submit and save a copy.

     Keep as proof: Your submitted questionnaire, saved as a copy.

     Typical: A day or two if your evidence is readyOpen your evidence

   • Answer the assessor's questions

     An assessor marks your answers and may come back with questions. Reply promptly and fix anything they flag — most small firms pass within a round or two.

     What to do:

     1. Watch your email for the assessor's questions.
     2. For each question, find the answer in your checklist notes or evidence.
     3. If they flag a problem, fix it, take a screenshot, and send it back.
     4. Reply within a day or two — quick replies keep the process moving.

     Keep as proof: The assessor's feedback and your replies.

     Typical: A few days to a few weeksOpen your evidence

4. Keep it

   • Certificate issued — now keep it alive

     Certificates last twelve months. The controls must stay in place the whole year, not just at assessment time. Keep the dates in your Kept workspace and we will remind you well before renewal.

     What to do:

     1. Save the certificate PDF somewhere safe and share it with anyone who asked for it.
     2. Open your renewals page using the link below.
     3. Enter the expiry date from the certificate.
     4. Kept emails you well before renewal — act on the first reminder, not the last.

     Keep as proof: The certificate itself, plus your renewal date.

     Typical: A twelve-month cycleRenewal reminders

   • Review little and often

     Check the controls when things change — new starters, new laptops, new cloud services. Small regular checks make the annual renewal a formality instead of a scramble.

     What to do:

     1. Once a month, open your controls checklist using the link below.
     2. Ask: any new starters, new devices or new cloud services this month?
     3. If yes, check the affected controls still hold and update your notes.
     4. Refresh the evidence for anything that changed.

     Keep as proof: Reviewed checklist notes with recent dates.

     Typical: An hour a monthYour controls checklist

With a Kept account you can tick these off as you go, with your controls checklist, evidence and renewal reminders alongside them. See the plans.