Why MSPs need Cyber Essentials differently
An MSP's Cyber Essentials scope is genuinely harder to draw than a typical end-customer's. Much of the infrastructure an MSP touches belongs to or is shared with its customers. The MSP's own corporate estate (the laptops the engineers use, the MSP's own email, the ticketing system, the RMM tooling, the monitoring stack) is unambiguously in scope. But what about the customer estates the MSP administers? If an engineer's credentials can access a customer domain controller, does the customer's domain controller need to pass Cyber Essentials?
Our approach is that the MSP's own estate is in scope; customer estates are out of scope for the MSP's own certificate unless the MSP owns the customer's devices outright. The MSP's administrative-access controls into customer environments (privileged access management, MFA on admin accounts, just-in-time access controls, tiered engineer access) are absolutely in scope because those controls sit on the MSP's own devices and accounts.
Enterprise, NHS and central-government procurement
For MSPs and other suppliers bidding on enterprise contracts, Cyber Essentials is the quickest line item to clear on a DDQ. Enterprise procurement teams across UK-listed organisations, NHS trusts and central-government departments now almost universally list Cyber Essentials (and increasingly Cyber Essentials Plus) as an explicit requirement. PPN 014/21 makes this explicit for central-government contracts that handle sensitive or personal information. The NHS Data Security and Protection Toolkit (DSPT) does not require Cyber Essentials directly but maps many of its evidence requirements to it.
The commercial implication is that an MSP that cannot evidence Cyber Essentials on the DDQ cover sheet is typically disqualified at stage one of the bid, before any technical response is read. Cyber Essentials Plus is the upgrade that wins - not just passes - the stage-two competition, because it demonstrates external verification rather than a self-assessment.
Working with Fig Group as an MSP
Fig Group has certified MSPs of every size - from two-person managed-service shops in north London to larger MSPs with multi-site operations. We apply the same published flat fee irrespective of the MSP's revenue or customer count. The six-hour turnaround for compliant Cyber Essentials submissions is especially valuable for MSPs under deadline pressure on a customer tender.
For MSPs considering Cyber Essentials Plus, the external vulnerability scan covers internet-facing infrastructure, and the sampled endpoint audit confirms that the five controls are enforced in practice on a representative sample of engineer workstations. Plus certificates complete in 1-3 working days. Partnership arrangements for MSPs wanting to offer Cyber Essentials as part of their own customer offering are also available - reach out via the contact form.