The short answer
A Cyber Essentials certified MSP is a managed service provider that holds its own current Cyber Essentials or Cyber Essentials Plus certificate, renewed every 12 months. Sovereign Secure, an IASME-licensed certification body, certifies MSPs and IT providers, then works with Cyber Essentials certified IT providers to certify their clients, run Cyber Essentials Plus audits remotely and keep renewals on time.
On this page
- What is a Cyber Essentials certified MSP?
- How do you check that an MSP is Cyber Essentials certified?
- How does the Cyber Essentials partner programme work?
- What changes in scope when an MSP manages the IT?
- How does a remote Cyber Essentials Plus audit work with the MSP on hand?
- How do you keep client renewals on track?
- How does the assessment stay independent?
- Why Sovereign Secure
- Talk to us about partnering
A Cyber Essentials certified MSP holds its own current Cyber Essentials or Cyber Essentials Plus certificate, and the NCSC’s guidance on choosing a provider names Cyber Essentials Plus as a certification to look for. Sovereign Secure is an IASME-licensed Cyber Essentials certification body. We certify MSPs and IT providers, then work with them to certify their clients, run Cyber Essentials Plus audits remotely with the MSP’s engineers on hand and keep renewals on schedule. Partner terms are agreed with each MSP. Talk to us about partnering.
What is a Cyber Essentials certified MSP?
It is a managed service provider whose own organisation has passed Cyber Essentials, or the audited Cyber Essentials Plus, in the last 12 months. The NCSC’s guidance on choosing a managed service provider (November 2025) recommends MSPs with recognised certifications such as Cyber Essentials Plus. Buyers check the claim on the NCSC certificate search run by IASME.
Regulation is heading the same way: the Cyber Security and Resilience Bill, still before Parliament, would bring medium and large managed service providers under the UK’s NIS regime, with a 24-hour incident notification duty.
Two points often get confused:
- Your certificate covers your business only. It does not certify any client you manage.
- Your clients need their own certificates. The NCSC’s guidance makes the same point: each service a client uses still has to be configured securely, whoever supplies it.
For Cyber Essentials certified IT providers, the next step is certifying the clients you already look after.
How do you check that an MSP is Cyber Essentials certified?
Search the MSP’s registered company name on the free IASME certificate search, the official register for the NCSC scheme, then confirm the level (Cyber Essentials or Cyber Essentials Plus), an expiry date in the future and a scope that covers the service you are buying. Our guide on how to check a Cyber Essentials certificate explains each field on the register, and the NCSC’s guidance on choosing a managed service provider ends with a due diligence checklist of questions to ask before you sign.
How does the Cyber Essentials partner programme work?
You know each client’s estate, the client owns the application, and we assess and certify:
| Stage | MSP or IT provider | Client (the applicant) | Sovereign Secure |
|---|---|---|---|
| Scope | Lists devices, operating system versions, cloud services and remote access | Confirms the legal entity and what is in scope | Answers scope questions and quotes |
| Answers | Drafts the technical answers | A board member or equivalent approves the declaration | Pre-assessment check before submission |
| Assessment | Handles assessor queries on configuration | Stays the certificate holder | Marks the answers and issues the certificate |
| Cyber Essentials Plus | Hosts the remote session and shares device screens | Makes staff and devices available | Tests the device sample, external IP addresses and cloud accounts |
| Fixes | Applies updates and configuration changes | Approves changes | Retests failed items |
| Renewal | Updates the asset list ahead of expiry | Approves the new declaration | Assesses the renewal and issues the new certificate |
Ways MSPs work with us:
| What you want | How it works |
|---|---|
| Certify your own business | We assess and issue your Cyber Essentials, then Cyber Essentials Plus, the level the NCSC’s MSP guidance names |
| Certify a client | The client is the applicant; you prepare the answers with our pre-assessment check and a support call of up to an hour |
| Cyber Essentials Plus for a client | A remote audit run with your engineer on the call |
| Renewals across your client base | We agree how expiry dates are tracked and who starts each renewal |
| Needs beyond Cyber Essentials | Penetration testing, PCI DSS assessments, ISO 27001 and ISO 20000 support from the same company |
Your clients’ Cyber Essentials packages follow our published Cyber Essentials price list, from £320 + VAT.
What changes in scope when an MSP manages the IT?
The client stays responsible for every control, including the ones you operate. Version 3.3 of the NCSC’s Cyber Essentials requirements for IT infrastructure, in force since April 2026, sets out how MSP access is treated:
| Item | In the client’s scope? | What it means for you |
|---|---|---|
| Client-owned laptop used by an MSP engineer | Yes | Patch, protect and configure it like any client device |
| MSP-owned device used to administer the client | No | Out of scope, but the client must still be sure it is configured correctly, so your own certificate helps |
| Client-owned accounts used by the MSP, such as Microsoft 365 or firewall admin accounts | Yes | MFA, separate admin accounts and least privilege apply to your access too |
| Remote administration and other managed services | Yes | The client must be able to confirm the controls are met and show it in its answers |
| Cloud services such as Microsoft 365 or Google Workspace | Yes, and they cannot be excluded | Enforce MFA on every service that offers it; a missing MFA setting is an automatic fail |
Be ready to tell each client how your access is secured: MFA on admin accounts, controlled remote sessions and high and critical updates applied within 14 days, as Cyber Essentials requires. Where your clients run Microsoft 365, our guide to Cyber Essentials for Microsoft 365 sets out the Entra ID and Intune settings an assessor expects, control by control.
How does a remote Cyber Essentials Plus audit work with the MSP on hand?
The audit must be completed within three months of the client’s basic Cyber Essentials certificate, so plan the dates together.
- Book the audit date before the client submits basic Cyber Essentials.
- Return the asset declaration at least two weeks before the audit.
- Submit basic Cyber Essentials at least one week before the audit.
- On the day, your engineer stays on the call, able to view or control every sample device at every site, with our scanning tool installed on one machine that can reach them.
- If a test fails, you fix it and we retest within a month. A remote retest of up to an hour within that month is free; other retests start at £400 + VAT.
The sample is set per operating system version, from one device up to five, so standardising builds before the audit reduces how many devices are tested. See the Cyber Essentials Plus requirements for the full sample table and the tests.
How do you keep client renewals on track?
Certificates last 12 months with no grace period, and renewing too early brings the next expiry date forward. Work back from each client’s expiry date:
| Weeks before expiry | MSP action |
|---|---|
| 8 | For Cyber Essentials Plus clients, plan the basic renewal and book the audit |
| 6 | Update the asset list: new devices, new cloud services, systems nearing end of support |
| 4 to 5 | Replace or remove unsupported software and switch on MFA wherever it is missing |
| 3 | Draft the answers and use the pre-assessment check |
| 1 to 2 | The client approves the declaration and you submit |
The question set usually changes in April, and renewals now use the Danzell question set (v3.3), so last year’s answers are only a starting point. See Cyber Essentials renewal for switching and lapsed certificates.
How does the assessment stay independent?
You prepare, the client declares and we assess. The client’s board member or equivalent confirms the answers are true, and our assessors mark them against the same NCSC requirements as any other applicant. A partnership changes the logistics, not the standard, and no one is promised a pass.
MSPs wanting to give formal Cyber Essentials advice can look at the NCSC-backed Cyber Advisor scheme run by IASME. Cyber Advisors give advice; certificates are issued only by IASME-licensed certification bodies. We explain how our own Cyber Essentials consultancy is kept separate from assessment before any advice starts.
Why Sovereign Secure
- We are the certification body. Sovereign Secure is IASME-licensed to issue Cyber Essentials and Cyber Essentials Plus certificates, so there is no reseller between you and the assessor.
- Support for every client. Each Cyber Essentials package includes a pre-assessment check, a support call of up to an hour and access to our guide. Gold packages are assessed within one working day.
- Room to grow with your clients. We are a PCI SSC Qualified Security Assessor (QSA) company, a member of the PCI SSC Global Executive Assessor Roundtable for 2026 to 2028 and ISO 27001 certified. We also deliver penetration testing.
- Established UK company. Sovereign Secure Ltd was incorporated in 2012 (Companies House 08334453) and is based at 16 Whalley Road, Accrington, Lancashire.
Talk to us about partnering
Tell us how many clients you support, how many need Cyber Essentials Plus and when their certificates expire, using the form below, or call +44 161 523 5276. We will agree how we work together, starting with your own Cyber Essentials certification if you don’t hold it yet. Have a client ready now? Send their details through the scoping questionnaire for a fixed quote.
Last reviewed October 2026 by the Sovereign Secure assessment team.
