Cyber Essentials Terms

Cyber Essentials, Cyber Essentials Plus and Cyber Advisory Terms and Conditions

IQ in IT Ltd – Cyber Essentials, Cyber Essentials Plus & Cyber Advisory Terms
These terms explain how IQ in IT Ltd (“IQ in IT”, “we”, “us”) delivers Cyber Essentials (CE), Cyber Essentials Plus (CE+), and Cyber Advisory services, and how responsibilities are shared with you as the client (“you”, “the Client”).

1. IQ in IT’s Role
IQ in IT delivers Cyber Essentials and Cyber Essentials Plus assessments and associated services as a Certification Body / Assured Service Provider within the IASME framework for Cyber Essentials and Cyber Advisory certified by the NCSC.

2. Definitions
Cyber Essentials (CE) – A self assessment certification. You answer a structured questionnaire on your cyber security controls; an independent marking process determines whether you meet the scheme requirements. Passing is not guaranteed.
Cyber Essentials Plus (CE+) – An audited technical assessment that tests whether your systems actually match what you declared in the CE self assessment. Passing is not guaranteed.
Cyber Advisory / Cyber Advisor – Advisory services delivered by an IQ in IT Cyber Advisor who has passed the Cyber Advisor (Cyber Essentials) exam and assessment centre, giving you expert guidance on how to meet Cyber Essentials requirements.
Assessment Window – The time period allowed by the scheme to complete CE and CE+.
Certification Body – An organisation licensed to deliver CE/CE+ assessments and issue results. IQ in IT acts in this capacity within the IASME framework together with partners to deliver independent assessments.

3. Cyber Essentials (CE)

3.1 Nature of CE
CE is always a self assessment. You complete the questionnaire; Qualified assessor at IQ in IT marks it according to the scheme rules. Passing is not guaranteed. You will be able to address any clarifications and shortcomings and re-submit.

3.2 What IQ in IT does for CE
IQ in IT will:
Provide access to the CE portal.
Mark your submission in line with the official CE marking scheme and assessor guidance.
Provide general guidance on how to interpret the questions and what the scheme expects at a high level.

3.3 What you do for CE
You are responsible for:
Completing the self assessment honestly and accurately.
Providing complete and truthful information about your systems, staff and suppliers.
Making any changes needed to meet the CE requirements (for example: secure configuration, patching, user access control, malware protection and firewalls).
Maintaining your compliance after certification.

3.4 CE with IQ in IT as your MSP
Where CE is included as part of IQ in IT’s managed services:
IQ in IT will align the technical controls within our MSP scope (e.g. managed devices, patching, security tools) with CE requirements as far as reasonably possible.
IQ in IT will align approval processes to keep with CE requirements
You remain responsible for policies, business processes and staff practices (for example, password policies, acceptable use, supplier processes, HR procedures).

3.5 CE resubmission
If your self assessment does not initially meet the CE standard, IQ in IT will explain the non compliances.
You may fix the issues and resubmit within the CE assessment window permitted by the scheme rules.

4. Cyber Essentials Plus (CE+)

4.1 Nature of CE+
CE+ is a hands on technical audit that validates your CE answers by testing a sample of your systems.
Even if you have passed CE, CE+ is not guaranteed.

4.2 What IQ in IT does for CE+
IQ in IT will:
Coordinate CE+ assessment with an independent Certification Body to ensure a fully impartial audit process.
Review your IT asset list and select a representative sample of user devices and systems in scope.
Perform technical tests such as vulnerability scanning and other checks defined in the CE+ test specification (for example, patching status, malware protection and secure configuration).
Provide you with a report explaining any failures or non compliances.

4.3 What you do for CE+
You are responsible for:
Ensuring the systems in scope are available for testing and are up to date.
Implementing any changes needed to fix issues found in CE+ testing (such as applying patches, changing configurations or updating tools).

4.4 Time limit and remediation
CE+ must be completed within 3 months of your CE certificate issue date.
If non compliances are found, you will be given an opportunity to remediate within the allowed timeframe and, where the scheme permits, to undergo retesting.
4.5 Technical remediation not included
Fixing the issues identified (for example, making configuration changes or completing large scale patching) is not included in CE+.
Any such remedial work can be provided by IQ in IT as a separate, project based engagement.

5. Cyber Advisory and NCSC Cyber Advisor

5.1 What Cyber Advisory is:
Cyber Advisory is a guidance only service that helps you understand what you need to do to meet Cyber Essentials requirements.
It does not automatically include implementation work; it focuses on advice, planning and prioritisation.
5.2 NCSC Cyber Advisor within IQ in IT
IQ in IT’s Cyber Advisory services are delivered by a Cyber Advisor (Cyber Essentials) who has passed the Cyber Advisor exam and assessment centre and holds a Cyber Advisor certificate from NCSC.
This means the advice you receive is delivered by an NCSC aligned Cyber Advisor operating within IQ in IT.
5.3 What IQ in IT does in Cyber Advisory
IQ in IT will:
Review your cyber posture against the Cyber Essentials requirements.
Identify gaps and non compliances (technical, policy and process).
Provide clear recommendations and a practical roadmap towards compliance.
5.4 What you do in Cyber Advisory
You are responsible for:
Deciding which recommendations to implement and when.
Updating your policies, processes, supplier arrangements and systems to reflect the agreed actions.
5.5 Optional technical implementation
If your own IT team lacks capacity or capability to implement the recommended changes, IQ in IT can provide technical project work or remediation as a separate, chargeable service.

6. Shared Responsibilities

6.1 Your responsibilities
You agree to:
Provide accurate, complete and timely information.
Implement the changes needed to meet CE and CE+ requirements (technical and non technical).
Maintain your security posture and compliance after certification.
6.2 IQ in IT’s responsibilities
IQ in IT will:
Deliver services with reasonable skill and care.
Provide guidance and assessments in line with CE/CE+ scheme rules and assessor guidance.
Use independent, structured assessment processes for CE+ testing.
Keep your information confidential, subject to legal obligations.

7. Typical Engagement Flow (Example)
A typical CE + CE+ and Advisory engagement with IQ in IT may look like this:
Initial CE review – IQ in IT’s Cyber Advisor reviews your current posture against CE requirements.
CE self assessment – You complete the CE questionnaire with Cyber Advisors guidance from IQ in IT.
Non compliances identified – IQ in IT explains where you do not yet meet CE.
Remediation – You update policies, processes, supplier expectations and technology as required.
CE submission and marking – IQ in IT marks your submission as a Certification Body.
Move to CE+ – Once CE is achieved, IQ in IT plans CE+ testing.
CE+ technical testing – IQ in IT and independent Certification Body selects a sample of devices, runs vulnerability scans and other tests, and feeds back results.
CE+ remediation and retest (if required) – You fix any issues followed by retests within the allowed window.

8. Timeframes
CE – Must be completed within the CE assessment window defined by the scheme (up to 6 months in IQ in IT’s CE Terms).
CE+ – Must be completed within 3 months of your CE certificate issue date
Cyber Advisory – Advisory engagements packages need to be used within 3 months from purchase, after which further advisory work may require a new agreement.

9. Technical Implementation & Extra Work
CE, CE+ and Cyber Advisory do not include general technical implementation or remediation work.
Where project work is required (e.g. major patching, network redesign, policy roll out), IQ in IT will scope and price this separately.

10. Fees & Payment
Fees for CE, CE+ and Cyber Advisory are payable for the work carried out, not the certification outcome.
Additional tests, retests or work outside the agreed scope may incur separate charges.

11. Limitations & Disclaimers
IQ in IT cannot guarantee that you will pass CE or CE+. Decisions are made under the scheme rules and marking guidance.
Having CE or CE+ does not guarantee that you will not suffer a cyber-attack or security incident.
Cyber Advisory provides recommendations; you remain responsible for implementation and ongoing risk management.

12. Qualifications, Assurance & Insurance
In line with IASME Assured Service Provider and Cyber Advisor onboarding:
IQ in IT holds security certifications such as Cyber Essentials, Cyber Essentials Plus and information security standard ISO 27001
IQ in IT holds quality management certification ISO 9001in line with IASME quality requirements.
IQ in IT maintains Professional Indemnity Insurance of at least £1 million

13. Confidentiality & Data Protection
IQ in IT handles your information in line with its confidentiality commitments and applicable data protection law.
You are responsible for ensuring that providing data and access for CE/CE+/Advisory is compatible with your own legal and contractual duties.

14. Governing Law
These terms are governed by the laws of England and Wales, unless we agree otherwise in writing.