Cyber Essentials for msps and it providers
Who asks msps and it providers for the certificate, which level to choose, what to gather first, the scope problems the sector brings and the questions it commonly fails.
- Mandated by
- No formal mandate; customer and funder requirements
- Common fails
- A7.7A7.16AUTO-FAILA2.9
- Typical scope
- Engineers' devices with access to many clients, RMM and PSA platforms, Shared admin credentials, Lab and test equipment
- Cyber Essentials
- From £1,500, 1 to 2 weeks, IASME fee included
- Cyber Essentials Plus
- From £3,000, 2 to 5 weeks
No law yet requires managed service providers to hold Cyber Essentials, and the Cyber Security and Resilience Bill would regulate medium and large MSPs without mandating the certificate. Clients ask for it because they must vouch for third-party administrators, and the NHS toolkit and DfE school standards both tell customers to check their IT provider's certification.
Do MSPs and IT providers need Cyber Essentials?
Not formally. Not mandated today. Client contracts, NHS DSPT supplier checks and the DfE school standards drive demand, and proposed legislation would bring medium and large MSPs into the NIS regime.
UK Parliament (Cyber Security and Resilience Bill)
Source checkedThe Cyber Security and Resilience (Network and Information Systems) Bill would bring medium and large managed service providers that meet the 'relevant managed service provider' definition into the NIS Regulations 2018. It completed its House of Lords third reading on 2 November 2026 and had not received Royal Assent when checked on 3 November 2026. It does not require Cyber Essentials.
Source: UK Parliament, Cyber Security and Resilience (Network and Information Systems) Bill
NHS England (DSPT)
Source checkedHealth and care organisations must confirm their IT suppliers and IT support company hold appropriate certification (evidence item 10.2.1), and the guidance names Cyber Essentials, ideally Plus. An IT supplier completing the toolkit itself gets 26 of its 102 mandatory evidence items exempted by a current Plus certificate (2026-27, checked 3 November 2026).
Source: NHS England, DSPT 2026-27 version 9 assertions and evidence items
Department for Education
Source checkedThe cyber security standards for schools and colleges suggest that schools with outsourced IT support ask the provider whether it holds Cyber Essentials or Cyber Essentials Plus (checked 3 November 2026).
Source: DfE, cyber security standards for schools and colleges
Clients' own Cyber Essentials assessments
Source checkedEvery account a client owns is in scope even when an MSP uses it, and a client using externally managed services must be able to confirm the technical controls are met, which puts the MSP's practices under review.
Source: NCSC, Requirements for IT Infrastructure v3.3, section D(v)
Whatever the source, the contract, grant or tender is what binds you. Read it for the level it names, the scope it expects and the date the certificate must be in place, and record the reason at A1.10 when you apply.
Do MSPs and IT providers need Cyber Essentials or Cyber Essentials Plus?
Cyber Essentials Plus is the credible level for a provider with administrative access to client systems: it is the level the DSPT guidance prefers, and it exempts 26 DSPT evidence items for IT suppliers.
Both levels use the same five controls and the same question set. Plus adds an independent audit of a sample of devices and cloud accounts, on the same scope as a valid Cyber Essentials certificate. Compare the two levels.
What should MSPs and IT providers gather before starting?
Most of the self-assessment is describing your estate accurately. Have these to hand before you open the question set and the answers take hours, not weeks.
- Every SaaS console the business uses, including RMM, PSA, documentation, password vault, backup and remote-access tools, not only the client-facing ones (A2.9).
- A register of every technician's standard and administrative identities, in your own tenant and in each client tenant (A7.6, A7.8).
- Evidence that MFA is enforced on every administrator account in those consoles (A7.16).
- Engineer laptop builds, operating system versions and the patch report for the last month (A2.6, A6.4).
- Lab or test equipment, and how it is segregated from the production network (A2.2.2, A6.7).
What scope problems do MSPs and IT providers bring?
Scope must cover every device and cloud service that reaches organisational data, or a sub-set segregated by a firewall or VLAN that you can justify. These are the boundaries this sector tends to get wrong.
Engineers' devices with access to many clients
Every engineer laptop is in your own scope in full. Clients cannot assess it, because MSP administrator devices are out of a client's scope under v3.3.
RMM and PSA platforms
Cloud consoles with administrative reach into client estates are cloud services in scope and need MFA for every user.
Shared admin credentials
A single technician account per client tenant fails unique credentials and breaks the admin register.
Lab and test equipment
Old hardware kept for testing must be removed or placed in a sub-set with no internet access.
Which questions do MSPs and IT providers commonly fail?
Questions MSPs and IT providers commonly fail include A7.7, A7.16AUTO-FAIL and A2.9. This is a typical pattern from assessor experience, not a statistic, but it is worth planning around.
| Question | Why it fails | Fix |
|---|---|---|
| A7.7How does your organisation prevent administrator accounts from being used to carry out everyday tasks like browsing the web or accessing email? | MSP engineers habitually use highly privileged accounts for everything, including email. | Give each engineer a standard identity for email and browsing and a separate admin identity, and enforce it in your RMM and identity platform. |
| A7.16AUTO-FAILHas MFA been applied to all administrators of your cloud services, excluding any listed in A7.15 that do not provide it? | Administrator accounts on RMM, PSA or backup consoles without MFA are a common finding. | Enforce MFA on every administrator account in every console listed in A2.9, and remove accounts nobody uses. |
| A2.9Please list all the cloud services that are in use by your organisation and provided by a third party. Please note that cloud services cannot be excluded from the scope of Cyber Essentials. | The cloud service list is incomplete because tooling sprawls. | List every SaaS console the business uses, not just the ones used for clients. |
Frequently asked questions
Not by law, but it is the level clients can rely on. The DSPT guidance tells health and care organisations to look for Cyber Essentials, ideally Plus, from their IT support company, and the Plus audit tests your own devices and cloud consoles for patching, MFA and account separation.
The bill as introduced does not require the certificate. It would bring medium and large managed service providers that meet its definition into the NIS Regulations 2018, with security and incident-reporting duties. Check the bill's stage on the Parliament website: it had not received Royal Assent on 3 November 2026.
It covers every device, network, user account and cloud service that accesses your organisation's data or services, including staff-owned phones and laptops under BYOD. You can certify part of the organisation if the excluded networks are segregated by a firewall or VLAN (A2.1, A2.2.2), but the certificate then reads 'Partial Organisation', which a buyer may question.
Twelve months from certification, and buyers under PPN 014 expect it renewed every year of the contract. Renewal is a fresh self-assessment against the question set current at the time, so a certificate first issued under an older version is reassessed against v3.3 and the Danzell question set when it renews.
Related pages
- Microsoft 365 and Entra ID setupAdmin separation and MFA in client tenants
- Microsoft Intune setupStandard builds that keep Plus samples small
- Test 5: account separationWhat the Plus assessor checks on your engineers' devices
- User access controlThird-party accounts and admin rules
- Cyber Essentials for MSPs and IT providersThe deep page on this mandate.
- Who needs Cyber Essentials?Government, MoD, NHS and other mandates.
- Scope: what is in and outBYOD, home working, cloud and sub-sets.
- How much does it cost?Fixed prices and IASME fee bands.
- Check your readinessFree check against the 2026 question set.
- Cyber Essentials for recruitment
- Cyber Essentials for housing associations
- Cyber Essentials for local government suppliers
- NCSCNCSC, Cyber Essentials: Requirements for IT Infrastructure v3.3 · April 2026Read on ncsc.gov.uk (opens in a new tab)
- IASMEIASME, Cyber Essentials Danzell Question Set 2026Read on iasme.co.uk (opens in a new tab)
- bills.parliament.ukUK Parliament, Cyber Security and Resilience (Network and Information Systems) BillRead on bills.parliament.uk (opens in a new tab)
- dsptoolkit.nhs.ukNHS England, DSPT 2026-27 version 9 assertions and evidence itemsRead on dsptoolkit.nhs.uk (opens in a new tab)
- GOV.UKDfE, cyber security standards for schools and collegesRead on gov.uk (opens in a new tab)
Get certified at a fixed price
Precursor is an IASME Certification Body: Cyber Essentials from £1,500 and Cyber Essentials Plus from £3,000, with the IASME fee included, a free re-test if gaps are found and a written fixed price after a 20-minute scoping call.
- IASME Certification Body
- CREST accredited
- UK offices in Leeds, Newcastle, London and Edinburgh