Can an organisation complete Cyber Essentials certification without a consultant?

An organisation can manage its own Cyber Essentials application, provided it understands the requirements, has authority over the systems in scope and can give accurate answers about how those systems are protected. A consultant is optional; the certificate is issued through the relevant certification process rather than by the consultant themselves.

The organisation remains responsible for the accuracy of its submission. Cyber Essentials is not simply a policy exercise or a declaration that security controls exist. The answers should describe the technical arrangements actually in use on the assessment date, including any limitations, exceptions or systems that fall outside the chosen scope.

A practical self-managed process usually includes the following stages:

1. Assign ownership. Nominate someone who can coordinate the application, obtain information from technical staff and approve the final answers. This may be an IT manager, security lead, operations manager or business owner, depending on the organisation’s structure.
2. Define the assessment scope. Record which users, locations, networks, devices, servers, cloud services and other infrastructure are included. The scope should be clear enough that the organisation can identify what is protected by the controls and what is excluded. An overly narrow scope may not represent the organisation’s real business environment.
3. Build an accurate asset picture. Identify laptops, desktops, mobile devices where relevant, servers, network equipment, virtual machines and services that support the scoped operation. Include equipment used by home or travelling workers if it connects to the systems being assessed.
4. Compare the environment with the five core control areas. These cover firewalls, secure configuration, security update management, user access control and malware protection. The comparison should consider both the technology and the way it is administered.
5. Correct deficiencies before submission. Typical issues include unsupported software, excessive administrator access, inconsistent device settings, unmanaged equipment and unclear arrangements for applying security updates. Remediation should be completed and checked rather than described as planned work.
6. Complete the questionnaire carefully. Responses should be consistent with the defined scope and supported by the organisation’s own records and configuration information. Where a question does not apply, the reason should be understood and recorded rather than assumed.
7. Submit through the certification route. The completed assessment is submitted to the selected certification body or scheme platform in accordance with its process. The organisation should retain its scope statement, asset information and working notes so that answers can be reviewed internally.

The five control areas require more than a high-level statement that security software or a firewall is present. For example, access control involves considering which accounts have administrative privileges, how users authenticate and whether former users or unnecessary accounts are removed. Secure configuration involves reducing avoidable exposure, not merely installing a standard operating system. Update management requires a dependable method for identifying and applying security fixes within the scheme’s requirements.

Scope decisions deserve particular attention. An organisation may have separate offices, hosted services, outsourced infrastructure, shared platforms or a mixture of corporate and personally owned devices. Each arrangement needs to be considered in relation to the systems included in the application. If an external provider manages part of the environment, the organisation still needs to understand which responsibility remains with it and what assurance is available from the provider.

Internal completion is often manageable where the organisation has a well-maintained asset register, consistent device management, documented access procedures and someone with sufficient technical knowledge to interpret the questions. It is less straightforward where systems have grown without central oversight, several parties manage different parts of the environment, or the business cannot establish which devices and services are in scope.

Consultant support can be used in different ways. An adviser may help establish the scope, review the questionnaire, test the organisation’s interpretation of the controls or identify remediation work before submission. This can reduce the risk of overlooking an unmanaged device or treating a written policy as proof that a technical control operates. However, external assistance does not transfer accountability: the organisation must still confirm that the answers are complete and accurate.

Before deciding to proceed without a consultant, management should be able to answer three questions: who owns the application, what exactly is in scope and how will each answer be verified? If those points are documented and the technical controls are consistently managed, a self-managed application may be appropriate. If they cannot be established confidently, obtaining a structured review before submission is a sensible way to clarify the position.