Intouch Tech helped the business identify gaps, strengthen key controls and achieve certification within the required timeframe.
Service
Cyber Essentials certification and remediation
Industry
Accountancy and Business Advisory
Environment
Microsoft 365, Windows laptops, cloud accounting platforms and hybrid working
Organisation size
Approximately 45 employees
Key focus
Device management, MFA, administrator access, patching and certification readiness
The firm was in the final stages of onboarding with a larger corporate client when Cyber Essentials was raised as part of the supplier security requirements.
The business already used Microsoft 365, multi-factor authentication and managed antivirus, so the leadership team initially expected the certification process to be straightforward.
A readiness review showed that the core protections were there, but they were not being applied consistently across the whole environment.
Several laptops were running older software versions, administrator rights had accumulated as employees changed roles, and the organisation did not have a single reliable record of every device accessing company systems.
Some older accounts also needed reviewing before they could be included confidently within the certification scope.
With a client onboarding deadline approaching, the firm needed to address the issues without disrupting day-to-day work for its accounting and payroll teams.
Intouch Tech worked through the Cyber Essentials requirements with the firm and created a clear remediation plan around the areas that needed attention.
We first identified the users, devices, cloud services and internet-facing systems that needed to be included.
This gave the firm a clearer view of its technology environment and removed uncertainty around what the certification assessment would cover.
Company laptops were checked for supported operating systems, outstanding security updates and software that was no longer required.
Older applications were updated or removed, and devices that no longer met the required standard were addressed before submission.
User and administrator privileges were reviewed across the business.
Employees who no longer required elevated access were moved back to standard user accounts, helping reduce unnecessary exposure while keeping administrator access available where genuinely required.
MFA coverage was reviewed across Microsoft 365 and other relevant cloud services to make sure access controls were applied consistently.
Any gaps identified during the review were corrected before the assessment.
Once the technical remediation was complete, Intouch helped the firm work through the certification questionnaire and make sure the answers accurately reflected the controls that were in place.
This gave the business confidence that the submission matched the environment being assessed.
Every device included within the certification scope was checked against the required security baseline.
Authentication controls were standardised across the services included within the assessment.
Elevated permissions were reduced where they were no longer required.
The firm completed certification in time to support the new client onboarding process.
What began as a client requirement also gave the firm a clearer baseline for managing its technology.
The business now had a more accurate understanding of its devices, users and access permissions, along with a stronger process for keeping those controls consistent as employees joined, left or changed roles.
Cyber Essentials also gave the firm a recognised way to demonstrate its approach to cyber security when responding to future client questionnaires, tenders and supplier assessments.
The CHALLENGE
The solution
The results
Ongoing IMpact
What began as a client requirement also gave the firm a clearer baseline for managing its technology. The business now had a more accurate understanding of its devices, users and access permissions, along with a stronger process for keeping those controls consistent as employees joined, left or changed roles. Cyber Essentials also gave the firm a recognised way to demonstrate its approach to cyber security when responding to future client questionnaires, tenders and supplier assessments.
Mon-Fri 8am-5pm · 24/7 for managed clients
Response within 1 business day, guaranteed
UK-based team, since 2012