Tenders and customers
Cyber Essentials is often the reason someone emails me.
A main contractor, an insurer, or a bid pack asked for it. That is a certification process. It is not the outside-in look, and the look does not award the badge.
What the look can establish
- Whether the public website and mail records look neglected
- Obvious remote logins or admin pages on the open internet
- Whether a first tidy-up is even justified before you spend on a questionnaire
What it cannot establish
- That you would pass. That needs the IASME / certification body process
- Patching on staff devices, firewall admin, or MFA on every mailbox
- Anything behind a login
If you only need the certificate, say so on the call. If you need to know whether the public surface is a mess first, authorise the look. I will not pretend the 15 minutes is the assessment.