With sensitive client information, hybrid working and increasing security requirements from larger clients, the firm chose Cyber Essentials Plus to independently verify its existing protections.
Intouch Tech helped the organisation prepare for the technical assessment, identify gaps and resolve them before the formal audit.
Service
Cyber Essentials Plus
Industry
Legal Services
Environment
Microsoft 365, Windows laptops, hybrid working and multiple offices
Organisation size
Approximately 100 employees
Key focus
Certification readiness, patching, endpoint protection, access control and secure configuration
The firm already held Cyber Essentials and had a number of established security controls in place.
However, larger clients were increasingly asking for stronger evidence during supplier reviews and due-diligence processes.
Cyber Essentials Plus offered that additional level of assurance, but it also meant the organisation's controls would be independently tested rather than assessed through self-certification alone.
With employees working across offices and remotely, the firm needed to make sure devices, user accounts and security settings were consistently configured before the assessment.
The priority was to identify any issues early and resolve them without creating unnecessary disruption for fee earners.
Intouch Tech carried out a Cyber Essentials Plus readiness review across the organisation's in-scope environment.
We first established which users, devices and systems would fall within the certification scope.
This provided a clear picture of the environment that would be assessed and helped identify configuration inconsistencies before formal testing began.
A representative sample of endpoints was reviewed against Cyber Essentials Plus requirements.
This included checking:
The review identified a small number of devices that required further updates, alongside inconsistencies in user permissions and security configuration.
Intouch worked with the firm to resolve these issues ahead of the formal assessment.
Administrative access was tightened, outstanding updates were applied and device configurations were standardised across the relevant users.
Once remediation was complete, Intouch carried out a final readiness check to make sure the organisation was prepared for the Cyber Essentials Plus assessment.
This reduced the risk of unexpected issues appearing during the audit and gave the firm greater confidence going into the testing process.
All issues found during the pre-assessment review were addressed before independent testing.
Assessed endpoints were aligned across patching, malware protection, access controls and secure configuration.
The firm successfully completed the independent technical assessment.
The organisation progressed from Cyber Essentials self-assessment to independently verified Cyber Essentials Plus controls.
Cyber Essentials Plus gave the organisation more than another certificate.
The readiness process created a clearer understanding of which controls needed to remain consistent across users and devices, helping the firm maintain a stronger security baseline as the business continued to grow.
It also provided the organisation with independent evidence that its key protections were operating effectively, supporting conversations with clients where cyber security and supplier assurance formed part of the procurement process.
The CHALLENGE
The solution
The results
Ongoing IMpact
Cyber Essentials Plus gave the organisation more than another certificate. The readiness process created a clearer understanding of which controls needed to remain consistent across users and devices, helping the firm maintain a stronger security baseline as the business continued to grow. It also provided the organisation with independent evidence that its key protections were operating effectively, supporting conversations with clients where cyber security and supplier assurance formed part of the procurement process.
Mon-Fri 8am-5pm · 24/7 for managed clients
Response within 1 business day, guaranteed
UK-based team, since 2012