Skip to content
Made in the UK

How do MSPs get and keep clients Cyber Essentials certified?

By , CEO, CybaVerse. Last reviewed

MSPs get clients Cyber Essentials certified by checking the five controls across the whole scope, closing gaps before the assessment, and keeping evidence ready. They keep clients certified by monitoring updates, MFA and device configuration all year, so the 14-day patch rule and MFA requirements are met every day, not just at renewal.

This guide is part of the CybaVerse Knowledge Hub.

What do Cyber Essentials and Cyber Essentials Plus require?

Cyber Essentials is a UK government-backed scheme covering five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. Cyber Essentials is a verified self-assessment. Cyber Essentials Plus covers the same controls but adds a technical audit by an assessor, including vulnerability scans and checks on sampled devices.

The requirements are set by the NCSC and the scheme is delivered by IASME. Version 3.3 of the requirements applies to assessment accounts created after 26 April 2026, according to IASME.

What changed in April 2026?

The April 2026 changes made several controls stricter. IASME reports that failing to use MFA on cloud services where it is available is now an automatic fail. Two update questions, covering operating systems, firmware and applications, also became automatic-fail questions if critical or high-risk updates are not installed within 14 days.

  • Cyber Essentials Plus retests. If the first sample fails on updates, the retest checks the original sample and a new random sample. A second failure revokes the self-assessment certificate.
  • No changes after testing. The self-assessment answers cannot be adjusted after Cyber Essentials Plus testing starts.
  • Clearer scope. Organisations describe excluded areas and list every legal entity in scope.

How should an MSP prepare a client?

Prepare in the same order every time, so nothing is missed and the client is not surprised on assessment day. The steps below suit most MSP clients and reflect the published NCSC requirements and IASME guidance. Start at least a month before the assessment for clients new to the scheme.

  1. Step 1: Agree the scope

    List every device, cloud service and legal entity in scope, and justify any exclusions.

  2. Step 2: Check MFA on every cloud service

    MFA must be on wherever the service offers it, free or paid.

  3. Step 3: Clear critical and high updates

    Apply all qualifying updates and remove unsupported software.

  4. Step 4: Review configuration and accounts

    Remove default passwords, unused accounts and unnecessary admin rights.

  5. Step 5: Collect evidence

    Gather screenshots and policy exports, including mobile device evidence for Cyber Essentials Plus.

  6. Step 6: Keep watching after certification

    Monitor updates and MFA continuously until the next renewal.

Which questions does this cluster answer?

The pages below answer the Cyber Essentials and Cyber Essentials Plus questions MSPs ask most, from failing on software updates to assessor evidence. Each one gives a direct answer and steps you can follow. Use the links to go straight to the question you need.

How does CybaVerse help with Cyber Essentials?

CybaVerse delivers Cyber Essentials and Cyber Essentials Plus certification as a service, run through the CybaOps platform. The aim is to keep clients ready all year, so certification is the natural result of an ongoing security service rather than a scramble in renewal week, with gaps found and fixed early.

  • CybaVerse delivers Cyber Essentials and Cyber Essentials Plus certification, run through the CybaOps platform.
  • CybaOps vulnerability scanning helps you find and fix CE+ failures before the assessment.
  • Cyber Essentials Plus works best as part of an ongoing security service, not a once-a-year exam.
  • CybaVerse holds Cyber Essentials and Cyber Essentials Plus itself.
  • Speak to us about how the certification service works for MSP clients.

Cyber Essentials

How MSPs get and keep clients Cyber Essentials certified

MSPs get clients Cyber Essentials certified by checking the five controls across the whole scope, closing gaps before the assessment, and keeping evidence ready.

01 Readiness checks

Multi-tenantPartner / MSP CustomerCustomerCustomer+
CybaOps by CybaVerse

Cyber Essentials

02 The 6-step path

  • Role-based access
  • UK-based analysts
  • ISO 27001

03 Outcomes

Explore

Hover or tap any part of the diagram to see what it does.

  • Delivered with
  • Cyber Essentials & CE+
  • CybaVM

What else do MSPs ask about Cyber Essentials?

These are the follow-up questions we hear most from MSPs supporting clients through certification.

Is MFA mandatory for Cyber Essentials now?

Yes, for cloud services where MFA is available. IASME reports that, from April 2026, failing to implement MFA on such services, whether free, included or paid, results in automatic failure of the assessment.

Can you complete Cyber Essentials Plus without Cyber Essentials?

No. Cyber Essentials Plus is built on a valid Cyber Essentials self-assessment, and the assessor checks that the scope matches it. Complete and finalise the self-assessment first, then book the technical audit.

How long does a certificate last?

Certificates are generally renewed every year. Check the current rules with IASME. The NCSC requirements also expect controls to be maintained throughout the certification period, not just on the day of assessment.

What should you do next?

See how the pieces fit together on the CybaOps platform page. MSPs can read about the CybaVerse partner model for MSPs.

See how CE+ preparation works with CybaOps scanning.

Book a CybaOps demo