IT Security & Compliance
Cyber Essentials, without the guesswork.
Increasingly a condition of winning work — and more involved than the questionnaire makes it look.
I hold it myself.
It would be a strange thing to take you through a standard I hadn't met. Jonathan McHarg Consulting Ltd is Cyber Essentials certified across the whole organisation — not a single department or a carved-out scope.
- Certified by
- The IASME Consortium Ltd
- Scope
- Whole organisation
- Certified
- 9 October 2026
- Valid to
- 9 October 2027
Why businesses come to me for this
Usually one of three reasons:
- A customer or tender requires it, often with a deadline attached
- An insurer has asked, and the renewal depends on the answer
- Someone started the self-assessment, got partway through, and realised they couldn't honestly answer half of it
The last is the most common. The questionnaire looks straightforward until you reach a question about your device inventory or your patching timescales and realise nobody actually knows.
How it works
I prepare your business for certification and manage the process end to end; certification is issued through my accredited partner.
In practice:
- A gap analysis first — where you actually stand against the requirements, before anyone fills in a form. No surprises at assessment.
- The remediation work — the changes needed to pass, done properly rather than bodged to get through
- The submission — completed with you, so the answers are accurate and defensible
- Certification — issued by my partner
One point of contact throughout.
Cyber Essentials Plus
The same requirements, independently tested rather than self-assessed. If a customer has specified Plus, or you'd rather have the assurance, the preparation is more thorough and the gap analysis matters more.
What usually needs fixing first
From doing this repeatedly, the same handful of things come up:
- Two-step sign-in missing from some accounts — usually the ones nobody thinks of: shared mailboxes, old admin accounts, the director who found it annoying
- Devices running software past end of support — one machine in accounts running something unpatched will fail you
- Too many administrator accounts, often belonging to people who have left
- No reliable record of what devices exist, which makes every other question unanswerable
- Patching that happens when somebody remembers
None of these are hard to fix. They're just hard to find if you don't know where to look.
Staying certified
Certification lasts twelve months, and most businesses drift out of compliance within a few months of getting it — a new laptop, a new starter, an account that quietly gains admin rights.
My security monitoring checks the same things every night and tells you monthly if anything has slipped, so the next renewal isn't another scramble.
Got a deadline?
Tell me when it is and what's been asked for, and I'll tell you honestly whether it's achievable.