A UK government-backed scheme (developed by the NCSC) designed to protect organizations from the most common cyber attacks: the kind that look for "unlocked doors" like weak passwords or out-of-date software.
Certified organizations make 92% fewer insurance claims than those without it.
You're in the right place if…
We don't just get you certified; we keep you certified with ongoing monitoring, automated patching, and a clear upgrade path.
Marcus Atkins, Director of Compliance Services
The 3FACTOR approach
- We manage the complexity so your team stays focused on business operations.
- From mapping your scope to configuring advanced MFA, we ensure every technical requirement is met.
- Take a look at our 5-step process from scoping to certification.
Firewalls
Secure Configuration
User Access Control
Malware Protection
Security Update Management
The 5-Step Process
What we deliver
Certification as an operating model, not a one-time project. We operationalize technical controls, evidence collection, and ongoing compliance as part of business-as-usual.
Boundary Security & Hardening
- Firewall configuration review and remediation
- System hardening and secure configuration
- Network boundary documentation
- BYOD and cloud service scoping
Access Control & MFA
- User access control review and enforcement
- Mandatory MFA implementation
- Privileged access management
- Account lifecycle documentation
Malware & Patch Management
- Active scanning and application allow-listing
- 14-day critical patching cycle enforcement
- Automated patching where possible
- Vulnerability management cadence
Certification & Ongoing Compliance
- Self-assessment preparation and submission
- Plus: independent vulnerability scanning support
- NCSC certificate and digital badge
- Ongoing monitoring and recertification guidance
Essentials vs. Essentials Plus
Cyber Essentials
Verified self-assessment covering the 5 key technical controls. The foundation for demonstrating baseline security and winning UK Government tenders.
Essentials Plus
Adds independent technical testing including vulnerability scanning, authenticated scans, and malware verification. Enhanced supply chain assurance and full government contract eligibility.
Why organizations choose 3FACTOR
Complexity Managed
From mapping your "scope" to configuring advanced MFA, we ensure every technical requirement is met.
Pre-Audit Dry Runs
Before the official assessment, we perform simulated vulnerability scans and malware tests to guarantee a "Pass" result.
Continuous Compliance
We don't just get you certified; we keep you certified with ongoing monitoring and automated patching.
NCSC Expertise
Deep understanding of the NCSC scheme requirements and Version 16 (2026) standards.
Plus Readiness
We prepare you for Essentials Plus from day one, so upgrading is seamless.
Senior-Led Delivery
Practical decisions, fast progress. No template theatre.
How we help you avoid common Cyber Essentials pitfalls
Our approach solves the frequent industry traps that sink most compliance projects.
Our expert-led approach ensures your certification stays on track.
Common failure modes
Scope not properly defined
Without clear boundary mapping, devices and cloud services get missed or unnecessarily included.
MFA not enforced across all accounts
Partial MFA deployment is a common reason for failed assessments.
Patching cycles inconsistent
Missing the 14-day critical patching window leads to automatic failures.
No preparation for Plus testing
Organizations attempt Plus without simulated scans and fail the independent assessment.
How we solve it
Comprehensive scope mapping from day one
We identify all in-scope devices, cloud services, and BYOD before any technical work begins.
MFA enforcement across all user accounts
We verify MFA is correctly configured for every account, including cloud and remote access.
Automated patching and cadence monitoring
We establish the 14-day cycle and set up monitoring to prevent drift.
Pre-audit simulated testing before Plus submission
We run vulnerability scans and malware tests internally to guarantee a clean result.
