The SJP mandate in practice
St James's Place has historically operated one of the largest restricted-advice partnerships in the UK, with an internal technology stack that Partner Practices are expected to align to. The cyber essentials mandate applies across the Partnership - meaning certification is not optional for any practice that wants to continue transacting through the SJP platform. For many smaller practices this represents the first formal cyber certification they have pursued, and the scoping questions can be unfamiliar.
Typical Partner Practice scope: partner and adviser workstations, Practice staff workstations, the Practice mail environment, any client-data files stored locally or in practice-managed cloud storage, the Practice network (router, firewall, wireless access points), and the mobile devices used for client meetings. The SJP-managed systems (Salesforce Financial Services Cloud, Panacea, the internal Partnership portal) typically sit outside the Practice's own Cyber Essentials scope because the Partnership operates those platforms centrally - but any device used to access them is in scope.
Cyber Essentials vs Cyber Essentials Plus for Partner Practices
Cyber Essentials (self-assessed) is the level the mandate currently requires for the majority of Partner Practices. A minority of larger practices - or those with bespoke infrastructure outside the standard Partnership-issued estate - need Cyber Essentials Plus, which adds an external vulnerability scan and a technical audit. Fig Group's published fee for Cyber Essentials Micro (1-9 employees) is £299.99 + VAT, which covers the majority of sole-Partner and small-Practice setups. Practices with 10-49 staff pay £399.99 + VAT; 50-249 staff pay £449.99 + VAT.
For Partner Practices considering Plus, the uplift is meaningful but still transparent: £1,499 + VAT at Micro, £1,999 + VAT at Small. No revenue-based pricing, no hidden fees, no mandatory consultancy add-ons. Every Plus engagement includes the external scan and the sampled endpoint audit as standard.
How Fig Group works with Partner Practices
We run the entire engagement remotely for the majority of Partner Practices. Scoping is a thirty-minute call where we identify in-scope assets and resolve the Partnership-vs-Practice boundary. Submission runs through our portal. Three review rounds are included at no extra cost. Certification for compliant submissions is issued within six hours.
For Practices based in central London who would prefer an in-person scoping session, our office at 167-169 Great Portland Street is a short walk from Oxford Circus - convenient for Partner Practices in the West End corridor. We also support multi-Partner group engagements where a network hub wants to run multiple Partner Practices through certification on a single timeline.