Cybersecurity Consultants near you

Cyber Essentials answers a narrow question well: are five specific technical controls in place across the organisation. It is a good floor, it is widely recognised by UK buyers and insurers, and the Plus variant is verified by independent technical testing rather than a questionnaire. It says nothing about whether your staff would notice a fraudulent invoice, whether your backups survive ransomware, or whether your supplier has your customer database.

An assessment asks the wider question and produces a ranked list of things to fix, usually with owners and dates. It has no certificate at the end, which makes it harder to sell internally and easier to ignore. The sensible sequence for most organisations is certification first because it is bounded and demonstrable, then an assessment once the obvious gaps are closed.

The NCSC describes the Cyber Assessment Framework as a tool for assessing and improving cyber security and resilience and for protecting essential services. It is built around objectives, principles, outcomes and indicators of good practice, and it publishes two profiles: a basic profile setting a baseline against common attacks, and an enhanced profile for organisations facing sophisticated, well-resourced attackers.

The framework matters most to organisations captured by the Network and Information Systems Regulations 2018. Those regulations apply to operators of essential services across sectors including electricity, oil and gas, air, rail, water and road transport, healthcare, drinking water supply and digital infrastructure, and separately to relevant digital service providers, which register with the Information Commissioner. Operators carry security duties and a duty to notify incidents, and the regulations provide for information notices, inspections, enforcement notices and penalties.

If you are in scope, say so in the first conversation. A consultant scoping a generic penetration test for an organisation with CAF obligations is solving a smaller problem than the one you have.

Under section 1 of the Computer Misuse Act 1990 it is an offence to cause a computer to perform a function intending to secure access to programs or data where the access is unauthorised and the person knows it is unauthorised. Testing that you have properly authorised is not unauthorised access. Testing that nobody in your organisation approved may be.

So the authorisation letter needs to name the systems, the IP ranges and domains in scope, the window in which testing may happen, the techniques permitted, and the person signing who has authority to give that permission. Where a system is hosted by someone else, the hosting provider's own terms may require notice as well, and that is your job to establish, not the tester's assumption.

During an incident the technical work and the regulatory work run in parallel. If personal data is involved and the breach is notifiable, the ICO expects a report without undue delay and no later than 72 hours after you become aware, with phased detail permitted where the investigation is incomplete. Individuals must be told directly and without undue delay where the breach is likely to result in a high risk to their rights and freedoms. Every breach must be documented internally whether or not it is reported.

A retainer is mostly about not making those decisions from scratch at two in the morning. What it should include is a named contact, an agreed response time, pre-signed authorisation so the responder can act on your systems lawfully, and clarity about who drafts the regulatory notification and who signs it. Organisations under the NIS Regulations have a separate incident notification duty to their competent authority as well.