Firewalls
Review agreed internet boundaries and firewall settings against the current scheme requirements.
Security services A stronger security baseline.
SPECIALIST SECURITY / IT MOUNTAIN
A stronger security baseline.
A clearer path to assessment.
Prepare your organisation for Cyber Essentials with a defined scope, a practical gap review and evidence that reflects the controls you actually have in place.
Defined scopePractical supportClear responsibilities
THE SERVICE IN PRACTICE
A clearer scope.
A stronger next step.
Choose the activities that address your actual risks. Your service schedule confirms the supported estate, deliverables and responsibilities.
Secure configuration
Check supported devices and software are configured to reduce unnecessary exposure.
User access control
Review user accounts, administrative privileges and authentication arrangements.
Malware protection
Check the protection methods used across the scoped estate.
Security update management
Review supported software and how security updates are applied within the scheme requirements.
Assessment preparation
Document scope, resolve gaps and coordinate submission to the appointed certification body.
A baseline, independently assessed.
Cyber Essentials covers five technical control areas: firewalls, secure configuration, user access, malware protection and security updates. Cyber Essentials Plus adds independent technical verification. Your appointed certification body confirms the current requirements, applicable scope and assessment route.
Plan my readiness review
BUILT AROUND YOUR BUSINESS
Useful outcomes.
Understood responsibilities.
Start with the concern you want to address. Then agree the systems, people and evidence that belong in scope, including any specialist delivery needed.
Define scope
Agree the organisation, locations, devices and services to be assessed.
Review gaps
Compare the estate with the current requirements and organise evidence.
Remediate
Assign changes, check completion and prepare accurate assessment answers.
A PLANNED START
From first conversation.
To a service you understand.
Define scope
Agree the organisation, locations, devices and services to be assessed.
Review gaps
Compare the estate with the current requirements and organise evidence.
Remediate
Assign changes, check completion and prepare accurate assessment answers.
Arrange assessment
Confirm the independent certification route and any technical verification requirements.
A CONTRACT YOU CAN UNDERSTAND
Know who acts.
Know what is included.
Your named delivery model
IT Mountain coordinates the agreed service. Specialist assessment or security operations may be delivered by an appointed provider. The proposal identifies responsibilities, access and the route to support.
Your agreed service schedule
Define supported users, devices and systems, monitoring hours, response commitments and approval points. Licences, testing, major changes and specialist recovery are itemised where separately scoped.
Your next improvement
Keep findings, action owners and unresolved risks visible. Agree a review cadence so the service follows changes in your organisation rather than standing still.
Start with your business, not a product list.
Build my security brief Tell us what needs protecting and what a better service would look like.
TECHNOLOGY WITH A PURPOSE
Protection you can understand.
Capabilities that fit your business.
Explore what each capability does and where it could help. We’ll confirm the selected technology, licensing, delivery team and support responsibilities in your proposal.
Specialist delivery
Connected security operations
Bring security monitoring, testing and reporting into one practical plan.
Explore this capability
Connected security operations
Connect several security activities around a shared view of your business. Your scope defines the monitored systems, specialist delivery, reporting and the handover to your IT support.
Coordinated security operationsTesting and assessment optionsA connected reporting rhythm
Discuss this capability Security assessment & assurance
Find gaps across networks and applications, then plan improvements.
Explore this capability
Security assessment & assurance
Use targeted assessment to understand where your business is exposed. The engagement sets out the systems to review, the evidence to collect and the actions your team can take after the findings.
Network, application and API assessmentVulnerability and exposure reviewReadiness and awareness support
Discuss this capability Specialist protection services
Add specialist security skills where your business needs them.
Explore this capability
Specialist protection services
Build specialist assessments and protection into your wider IT plan. Agree which experts deliver the work, how results are communicated and who owns the next improvements.
Scoped security servicesPenetration testing optionsVulnerability assessment and follow-up
Discuss this capability Exposure & certification readiness
Understand technical exposure and prepare the evidence for assessment.
Explore this capability
Exposure & certification readiness
Connect testing and exposure reviews with the controls your organisation needs to demonstrate. Certification support prepares you for the agreed assessment; certification is awarded independently.
Authorised technical testingCertification readiness supportManaged exposure reviews
Discuss this capability Capabilities are selected and scoped for your environment. Your agreement identifies the appointed technology and delivery providers before the service begins.
YOUR QUESTIONS
Clear answers.
Before you choose.
Does IT Mountain award the certificate?
No. An authorised certification body assesses and awards certification. Our proposed role is readiness support and coordination; assessor availability and fees are confirmed separately.
What is the difference between Cyber Essentials and Plus?
Cyber Essentials uses an assessed self-assessment against the scheme requirements. Cyber Essentials Plus adds independent technical verification. The certification body confirms the assessment approach and eligibility.
Does certification guarantee we cannot be attacked?
No. Certification demonstrates an assessed baseline within a defined scope. It complements monitoring, staff awareness, risk management and recovery planning.
Which version of the requirements applies?
The NCSC updates the scheme requirements. We confirm the applicable current version and assessment window with the certification body rather than relying on an old checklist.