We link to the original sources below. Sections labelled “Sandycroft analysis” contain our interpretation and practical suggestions. Product and service links are commercial suggestions from Sandycroft, separate from the source reporting.
SOURCED NEWS SUMMARY
The news
The Department for Digital, Culture, Media and Sport published its Cyber Essentials funding package on 3 November. The First Step Fund offers eligible micro, small and medium-sized organisations a 75% discount on a new Cyber Essentials certificate. The government says the discounted price can be as little as £80 and no more than £125 plus VAT, depending on organisation size. The offer is due to run until the end of March 2027 or until the allocated funding runs out.
Funding covers the assessment and, when the assessment is passed, certification; it does not guarantee a pass. A separate Cyber Essentials for Suppliers grant can provide selected SME suppliers with fully funded certification and tailored Cyber Advisor support, but those firms must be nominated through organisations signed to the Cyber Resilience Pledge. Do not assume the supplier grant is an open application or combine it with the general discount.
SANDYCROFT ANALYSIS
Start with the real digital boundary
List the business systems that handle orders, customer details, artwork, invoices and supplier records: desktops, laptops, phones, tablets, website administration, email, cloud storage, payment dashboards and any workshop equipment that connects to the network. Record the operating system, owner, administrator, update status, security software and whether the device still needs access.
Separate personal devices, shared workshop terminals and equipment that is not network connected. Confirm the assessment scope against the current Cyber Essentials requirements rather than guessing. A missing device or forgotten admin account can undermine the exercise even when the main office computer is well maintained.
SANDYCROFT ANALYSIS
Work through the five controls with evidence
The NCSC describes five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. Turn each one into an evidence request. Keep the firewall and router settings, remove unused software and default accounts, document supported operating systems and update dates, list who has administrator rights, and record the approved malware-protection method.
Give staff individual accounts where the system permits it and remove access promptly when a role changes. Protect website, domain, email, cloud and payment accounts with the strongest sign-in controls they support. Multi-factor authentication is a useful safeguard, but the certification answer must follow the current question set and technical requirements rather than a homemade checklist.
SANDYCROFT ANALYSIS
Protect artwork and production without slowing the job
A workwear, embroidery or printing order can move through email, artwork software, cloud folders, proofs, machine files, packing and dispatch. Use one approved location for the live job, restrict editing rights, name the approved proof clearly and archive or delete unnecessary copies under a documented retention rule. Do not leave customer address lists or payment information on a shared production terminal.
Printed job sheets and embroidery approvals can keep production moving during a temporary system outage, but minimise the personal data on them and store completed paperwork securely. A paper fallback is an operational control, not a substitute for backups, tested account recovery and secure digital access.
SANDYCROFT ANALYSIS
Apply only when the controls are ready
Use the free NCSC readiness material and current assessment questions to identify gaps before paying. Assign each action to a named person and keep dated proof of completion. If an external IT supplier manages part of the environment, obtain written confirmation of the relevant settings and responsibilities instead of assuming the supplier’s service automatically meets the requirement.
Treat certification as a verified baseline, not proof that every cyber risk has disappeared. Keep updates, account reviews, backups and incident contacts active after the certificate is issued. The useful business result is a safer, recoverable order workflow; the badge should reflect that work rather than lead it.
CHECK THE ORIGINAL REPORTING