From no formal IT to Cyber Essentials certified.

The challenge

The business ran on the sort of arrangement a lot of construction firms recognise. Things mostly worked, but there was no formal IT management behind them. No clear view of which devices were in use, no consistent patching, no written policies, and nothing that would stand up if a client or an insurer asked the firm to prove it took security seriously.

Increasingly, that proof was being asked for. Cyber Essentials had moved from a nice to have to a requirement for the work the firm wanted to win. The challenge was building the foundations that make certification meaningful, starting from very little, and doing it without disrupting a busy operation.

Our approach

We started by getting a clear picture of what the firm had, then put the basics in place in a sensible order. Device management came first, so every machine was known, controlled, and kept up to date rather than left to drift. We added a hosted VPN to give people a secure way of working wherever the job took them.

Alongside the technical work, we put the written policies in place that Cyber Essentials expects and that the firm benefits from having anyway, and we got patching onto a regular, managed footing rather than something that happened when someone remembered. With the controls in and holding, the firm went forward to formal assessment and achieved certification.

The outcome

The business went from no formal IT management to Cyber Essentials certified in eight weeks. The device management, the hosted VPN, the policies, and the patching are the day-to-day shape of a managed environment, and they keep doing their job long after the certificate is issued.

The firm can now answer the security questions its clients and insurers ask, with certification to back it up.

The client here is described by its sector rather than named. Why we describe our work that way.