Cyber Essentials & Plus
Help to put the five Cyber Essentials controls in place and get certified through an IASME-licensed certification body.
Cyber security & backup
Cyber security and backup that fit a small business
From getting Cyber Essentials certified to making sure you can recover if the worst happens, we help businesses across Manchester, Bury and the North West put sensible protection in place – explained in plain English, by people you can meet face to face.
What’s included
Six ways we help keep your business safe
Security audits
A clear look at how your devices, accounts, Microsoft 365 and network are set up, with fixes in priority order.
Penetration testing
Independent, authorised testing of your systems, arranged and managed by us – from agreeing the scope to fixing what’s found.
Managed EDR
Endpoint detection and response on your computers and servers, monitored 24/7 and managed by us.
Remote offsite backups
Encrypted backups stored offsite in the UK, including Microsoft 365 and Teams, with restores tested every month.
Regulations & compliance
Clear advice on data protection, UK GDPR and sensible IT controls, so you can answer customer and insurer questions with confidence.
Cyber Essentials
Cyber Essentials and Cyber Essentials Plus
Cyber Essentials is the UK Government-backed scheme, developed by the National Cyber Security Centre (NCSC), that sets a minimum standard of cyber security for organisations of any size. It focuses on five technical controls that protect against the most common internet-based attacks, and a growing number of customers and contracts ask suppliers to hold it.
Cyber Essentials is a verified self-assessment: you answer an online question set, a senior person signs it off and a qualified assessor from a certification body reviews it. Cyber Essentials Plus checks the same five controls but adds an independent, hands-on technical audit of your systems – including a sample of user devices, your internet connections and any internet-facing servers. You need Cyber Essentials first, and both are renewed every year.
We’re not a certification body or assessor. Our job is to get you ready: we check where you stand, fix the gaps on your devices, accounts and network, help you prepare your answers and support you through the assessment with an IASME-licensed certification body.
Ask about Cyber EssentialsThe five Cyber Essentials controls
- Firewalls a security barrier between the internet and your network
- Secure configuration devices and software set up to reduce the ways in
- Security update management software and devices kept patched
- User access control the right people with the right level of access
- Malware protection stopping viruses and other malicious software
Source: NCSC and IASME, the NCSC’s Cyber Essentials Delivery Partner.
Security audits
Security audits
A security audit is a structured review of how your IT is set up today, so you know where the real risks are before someone else finds them. We look at the weak spots attackers most often take advantage of, then give you a plain-English report with fixes in priority order – and we can make the changes for you.
It’s a good starting point before Cyber Essentials, after a scare, when you take on new staff or systems, or when a customer or insurer asks about your security. Our free IT review is a lighter first look; a full audit goes deeper.
Book a security auditWhat we typically look at
- Microsoft 365 security settings, multi-factor authentication and admin access
- Who has access to what, including accounts of people who have left
- Updates and patching on computers, servers and network devices
- Antivirus and endpoint protection coverage
- Firewall, router and Wi-Fi settings
- Backups – what’s covered, where they’re kept and whether they restore
Penetration testing
Penetration testing
A penetration test (or ‘pen test’) is an authorised, simulated attack on your systems by qualified security testers, using the same tools and techniques a real attacker might. It shows whether weaknesses can actually be exploited at the time of the test.
Every test starts with an agreed scope: what will be tested – for example your website, internet-facing systems, internal network or Microsoft 365 – how, and when, so there are no surprises. You then get a report that rates each issue found and explains how to fix it.
We arrange and manage the test for you with an independent, specialist testing provider. We help agree the scope, act as your technical contact, explain the report in plain English and fix the issues afterwards.
Ask about penetration testingWhen a pen test makes sense
- A customer, insurer or contract asks for one
- You’ve launched a new website, portal or internet-facing system
- You’ve made big changes to your network or cloud set-up
- You want independent evidence that earlier fixes have worked
A test only shows what can be found on the day, so it works best alongside regular updates and audits, not instead of them (NCSC guidance).
Managed EDR
Managed endpoint detection and response (EDR)
Traditional antivirus looks for known threats. Endpoint detection and response (EDR) goes further: it watches for suspicious behaviour on your computers and servers – such as ransomware starting to encrypt files – and can isolate a device or stop a process before the problem spreads.
EDR is only useful if someone acts on the alerts. With our managed service, your EDR is monitored 24/7 and managed by us: we set it up, keep it up to date, investigate alerts and take action, contacting you when anything needs your attention. We’ll agree response arrangements with you in writing.
Ask about managed EDRWhat’s included
- Deployment to your computers and servers
- Central security policies and ongoing updates
- 24/7 monitoring of alerts
- Alerts investigated and acted on
- Isolating affected devices and cleaning up
- Regular plain-English reports
- Supports the malware protection control in Cyber Essentials
Remote offsite backups
Remote offsite backups, including Microsoft 365
If ransomware, a hardware failure, theft, fire or a simple mistake wipes out your data, a good backup is what gets you working again. The NCSC advises keeping a backup separate from your main systems, so an attack on your network can’t reach it too.
Our remote offsite backups copy your important data automatically to secure, UK-based storage away from your premises, encrypted in transit and at rest. We check that backups complete, follow up any failures and test restores on a set schedule – because a backup is only useful if it actually restores.
Microsoft keeps Microsoft 365 running, but deleted emails and files are only recoverable for a limited time. We back up Exchange Online email, OneDrive, SharePoint and Teams data so you can get back what you need.
Ask about offsite backupsWhat you get
- Automatic backups of servers, computers and key files
- Microsoft 365 backup: email, OneDrive, SharePoint and Teams
- Encrypted copies stored offsite in UK-based storage
- Backups checked, with failures followed up
- Monthly spot-check restores of sample files and a mailbox
- Quarterly full test restore of a server or a whole Microsoft 365 user
- Restore results recorded and shared on request
- Help with a simple recovery plan
Our restore schedule: each month we restore sample files and one mailbox for every client, and each quarter we do a full test restore of a server or a whole Microsoft 365 user.
Who it’s for
Ideal if any of these sound familiar
- A customer or tender has asked whether you have Cyber Essentials
- You’re not sure your backups would actually restore
- You rely on Microsoft 365 and don’t know what happens if emails or files are deleted
- Your cyber insurer has asked about multi-factor authentication, backups or endpoint protection
- You’ve had a phishing email or a scare and want to know where you stand
How we work
A simple, clear process
Free IT review
We talk through your set-up, concerns and any customer or insurer requirements.
Audit & plan
We check where you stand and agree a prioritised plan with a clear written quote.
Fix & protect
We close the gaps and set up EDR and offsite backups where they’re needed.
Certify, test & look after
We support your Cyber Essentials assessment, arrange testing if needed and keep things up to date.
Why MicroConnect
Security without the scare tactics
- Plain English. We explain risks and options clearly, and won’t sell you more than you need.
- Face-to-face and local. We visit businesses across Manchester, Bury and the North West and get to know how you work.
- 25+ years’ experience. Practical experience of keeping small business IT running and safe.
- Independent. We recommend the tools and specialist partners that fit your business.
- Joined up. Security, backups, Microsoft 365 and day-to-day support handled by one team.
FAQs
Frequently asked questions
Is MicroConnect a Cyber Essentials certification body?
No. Certification is carried out by certification bodies licensed by IASME, the NCSC’s Cyber Essentials Delivery Partner. We help you prepare, put the controls in place and support you through the assessment, and we can help you choose a certification body.
What’s the difference between Cyber Essentials and Cyber Essentials Plus?
Both cover the same five technical controls. Cyber Essentials is a verified self-assessment that is reviewed by a qualified assessor. Cyber Essentials Plus adds an independent technical audit of your systems to check the controls are working in practice. You need Cyber Essentials first.
How long does Cyber Essentials certification last?
Certification is valid for 12 months, so it needs renewing every year. We can keep your systems in line with the requirements in between, so renewal is straightforward.
How much does it cost?
Certification fees are set by the certification body and depend on the size of your organisation (and, for Cyber Essentials Plus, how complex your network is). For our part – preparation, audits, EDR, backups or arranging a penetration test – we give you a clear written quote after a free, no-obligation conversation.
Do you carry out penetration tests yourselves?
We arrange and manage penetration tests with independent specialist testers, and look after the scoping, coordination and fixing of anything found. If a contract asks for a tester with a particular accreditation, we’ll make sure that’s part of the brief.
Is a penetration test the same as a security audit?
No. An audit reviews how your systems are set up against good practice. A penetration test tries to break in, within an agreed scope. Many small businesses start with an audit, fix the basics and then test.
Doesn’t Microsoft back up my Microsoft 365 data?
Microsoft keeps the service running, but deleted emails and files are only recoverable for a limited time. Our Microsoft 365 backup covers Exchange Online email, OneDrive, SharePoint and Teams, so you can restore data long after it has gone, or after an account is compromised.
Where are my backups stored, and are they encrypted?
Your backups are encrypted in transit and at rest and kept offsite in UK-based storage, away from your premises and your main network.
How do you know the backups will restore?
We test them. Every month we do a spot-check restore of sample files and one mailbox for each client, and every quarter a full test restore of a server or a whole Microsoft 365 user. We record the results and share them with you on request.
Is EDR the same as antivirus?
EDR includes antivirus-style protection, but it also watches for suspicious behaviour, records what happened and lets us isolate a device remotely. With managed EDR, alerts are monitored 24/7 and we act on them, so it isn’t left to your team. We’ll agree response arrangements with you in writing.
Will this help with cyber insurance?
Insurers commonly ask about multi-factor authentication, backups, updates and endpoint protection, and we can help you answer accurately and close any gaps. The NCSC also notes that UK organisations with a turnover under £20m that certify their whole organisation for Cyber Essentials are entitled to cyber liability insurance arranged by IASME – check the current terms with IASME.
Not sure where you stand?
Start with a free, no-obligation IT review. We’ll look at your security and backups and give you plain-English next steps.