Can Our Business Get Cyber Essentials Without an Internal IT Department?

Can an outsourced IT provider do the technical work for us?

A provider can investigate devices, change settings, improve administration and explain the evidence needed for assessment. Having employees with IT job titles is not the deciding factor. A business with no internal department can still organise the work sensibly, provided somebody inside the organisation can make decisions and challenge unexplained gaps.

IASME’s guidance on third-party IT providers makes the central distinction clear: outsourcing delivery does not transfer your organisation’s responsibility for its security. The provider helps establish the controls; your business must understand what it is declaring. Give the provider the current requirements rather than simply asking whether everything is secure.

Start with a short discovery discussion about your actual systems. Ask which changes the provider can deliver under the support agreement, which need a project and which depend on another supplier. Our Cyber Essentials support service is a relevant starting point for discussing preparation and technical remediation. Agree the work and assessment arrangements before committing to a deadline.

Who should own Cyber Essentials inside the business?

Choose a person who can coordinate finance, operations, HR and external suppliers. In a small company this may be a director or operations manager. In a larger company it may be a compliance lead supported by an executive sponsor. The role needs authority and protected time, rather than an impressive title or deep technical expertise.

The owner should know which legal entity is applying, why the business needs certification and who can approve spending. They should also know how an unresolved issue reaches a director. When a laptop needs replacing, an application needs retiring or an employee needs to accept a different sign-in process, these become business decisions.

Keep a named deputy and a shared action record. An external engineer should never have to guess whether the finance director can approve a change while the main contact is away. A useful owner can translate a technical finding into a clear choice: change the system, change the process, investigate an alternative or pause the certification timetable.

How do we divide responsibilities without creating gaps?

Write a responsibility schedule that follows each service and control. Record who configures it, who pays for it, who approves changes, who monitors exceptions and who provides evidence. A generic statement saying that the supplier manages IT rarely answers all five questions. HR may own leaver notification while the provider performs the account changes.

Use one real employee journey to test the schedule. Follow a starter from the hiring decision through laptop issue, access approval and sign-in. Then follow a leaver through return of equipment and removal of access. The exercise often reveals handovers that every party thought somebody else was handling.

If several suppliers are involved, appoint a coordinator who can resolve boundaries. Your cloud application supplier may control one set of settings while your IT provider controls devices and identities. A documented outsourced IT support arrangement should explain those interfaces, including the service hours, escalation route and evidence the business receives.

What information should we collect before asking for a quote?

Create a working inventory of people, devices, operating systems, applications, internet connections and cloud services. Include business use of personal equipment, remote workers and accounts bought directly by departments. Avoid limiting discovery to assets that appear on the IT provider’s invoice. Marketing, payroll and finance may have purchased tools independently.

For each item, record an owner and where its configuration can be checked. Do not put passwords in the inventory. The purpose is to find evidence and responsible people, not to create a new source of sensitive access information. An uncertain entry should remain visible with a named action to investigate it.

Give the prospective provider the inventory and ask them to identify assumptions. A quote built around twenty managed laptops may be misleading if another fifteen personal devices access company information. Our cyber security audit services can support a broader review when the current environment is poorly documented or responsibilities have changed over time.

How should we agree the assessment scope?

Discuss scope before rushing into questionnaire answers. Describe the business activities, legal entities, locations and systems intended to be covered. Ask the certification body to clarify uncertain boundaries. The aim is an accurate description that reflects how the organisation works, rather than a convenient list assembled around the easiest devices.

Document exclusions and their rationale, together with the technical boundaries that make them meaningful. Removing a difficult system from a spreadsheet does not separate it from the environment. If staff still use it to handle business information or connect it to shared services, the underlying relationship needs investigation.

Review scope again after material changes. An acquisition, new office or new application can make a previously tidy description incomplete. Ask the provider to flag changes that may affect the assessment rather than leaving the business owner to infer them from support tickets. Scope is an operational agreement that needs understandable language as well as technical detail.

What evidence should our provider give us?

Ask for evidence that can be explained in a review meeting. Useful material may include device reports, configuration records, supported software information, access reviews and change records. The exact evidence needed depends on the question and assessment. A large folder of screenshots is less useful than a smaller set that clearly identifies what was checked and when.

Make reports traceable to the inventory. If a report shows forty devices, your owner should know whether those are the forty devices intended to be covered. Ask how missing or inactive assets are handled. A reassuring percentage can hide a population that was never enrolled in the management tool.

Store evidence in a restricted shared location with a simple index. Record the source, owner and review date. Avoid circulating administrative screenshots in general email threads. A good evidence process reduces repeated requests and lets the business check the declaration without having to become an expert in every management console.

Can Microsoft 365 administration be handled externally?

External administrators can help review the Microsoft 365 environment, but changes need a clear business approval route. Ask which identities have privileged access, how the provider uses its own accounts and how access is removed when an engineer changes role. Company ownership of the tenant should remain clear throughout the relationship.

Plan changes around actual workflows. A stronger sign-in setting may affect shared devices, older applications or a finance integration. Identify those dependencies before making broad changes, test with representative users and provide support instructions. Security settings are most effective when staff understand how to complete their work within them.

Our Microsoft 365 support services can help businesses examine administration and user access alongside everyday support. Ask for a record of decisions, not just a statement that a standard configuration has been applied. Your assessment owner needs to understand material exceptions and any unresolved dependency that prevents the agreed configuration being used consistently.

How do we manage home workers and personal devices?

Start with an honest account of how work is done. Ask staff what equipment they use to read email, open documents and access business systems. A policy banning personal devices does not establish that nobody uses them. Compare policy with reality through a proportionate, clearly explained discovery exercise.

Decide which usage patterns the business will support. Providing managed equipment may simplify administration, while another approach may require different controls and clear limits. Consider employee experience, privacy, support capacity and cost together. Ask the assessor how the current requirements apply to your arrangement instead of relying on a blanket rule remembered from a previous year.

Tell employees what will change and why. Explain the help available, the information administrators can see and the steps to follow if equipment cannot comply. Our modern workplace security services are relevant when the challenge involves consistent access and device practices across office and remote teams. Avoid leaving staff to invent their own workaround during preparation.

What should we do about old equipment or unsupported applications?

Treat a difficult legacy system as a business dependency that needs investigation. Find out what it does, who uses it, what data it handles and why replacement has been delayed. Then ask for workable options with cost, disruption and residual risk made explicit. Do not assume that explaining its importance makes an assessment issue disappear.

Separate immediate remediation from longer term redesign. Some changes may be straightforward, while others need vendor testing, procurement or a controlled migration. Put both into the plan so a quick fix does not conceal a dependency that will return at renewal. Record the evidence required to show that a replacement or configuration change is complete.

A review of IT infrastructure management can help connect certification preparation with replacement planning. The useful outcome is a maintained environment and an affordable lifecycle, not a one-off buying exercise. Involve the people who operate the affected process so technical changes do not unexpectedly stop order processing, production or month-end work.

How do we choose a provider rather than just a cheap package?

Ask a prospective supplier to explain its preparation method using your circumstances. Who performs discovery? Who makes changes? Who checks the evidence? Who carries out independent certification, and how is that arranged? Distinguish hands-on technical work from questionnaire guidance and distinguish both from the certification fee.

Request a written list of exclusions and assumptions. A low headline price may not cover replacement hardware, application upgrades, additional licences or work outside support hours. Equally, a larger proposal should explain why the work is needed. Compare deliverables and responsibilities rather than treating all certification packages as interchangeable.

Review ongoing support as carefully as the initial project. Our managed IT support services are relevant where the business needs continued administration after the assessment. Ask what reporting and review you will receive, how exceptions are escalated and what happens if either party ends the relationship. A usable exit plan is part of responsible supplier selection.

How much internal time should we allow?

Allow time for discovery, decisions, staff communication and checking evidence. Even when an external provider performs every technical change, somebody must confirm what the business uses and approve any change to its working practices. A project plan that allocates no internal time is likely to rely on assumptions.

Ask the provider to identify the decisions that could delay work. These might include retiring an application, agreeing device ownership or finding an administrator for a cloud service bought years ago. Put the decision dates next to the technical tasks, with a person who can act if the normal contact is unavailable.

Protect short review sessions rather than arranging one long meeting at the end. A regular discussion of unknown assets, blocked actions and upcoming changes makes it easier to correct misunderstandings. The business owner should finish each session knowing what has changed, what remains uncertain and whether the target assessment date is still realistic.

What should happen after we receive the certificate?

Convert preparation tasks into routine ownership. Keep the inventory current, review access when people move roles and include security requirements when buying new services. Certification preparation often creates useful records; they lose their value if nobody maintains them once the immediate deadline has passed.

Agree a short operational report with your provider. Ask for unresolved issues, devices or services missing expected management, material changes and actions needing business approval. Focus on exceptions that require a decision rather than pages of reassuring charts. Your owner should be able to explain which problems are open and what will happen next.

Our managed security services can be discussed where the organisation needs an ongoing security operating model. Certification and ongoing security are connected, but a certificate should not be used as a promise that incidents cannot happen. Keep incident contacts and recovery arrangements understandable, and make sure the business can reach the right people when routine support is unavailable.

How can a small business keep cloud suppliers accountable?

List the cloud services that support important work, then identify what your organisation controls and what each supplier controls. Ask where you can find the relevant security commitments and how changes are communicated. Do not assume that a well-known brand or a familiar application means every responsibility is covered automatically.

For business-critical services, agree who checks administration, renewals and supplier notices. A finance manager may own the commercial account while an IT provider manages access. Both need to know when a feature, licence or support arrangement changes. Keep sufficient information to avoid losing administration rights when the original purchaser leaves.

A discussion about managed cloud services can help make these shared responsibilities visible. Bring your service list and the questions you cannot answer. The most useful next step may be a targeted review rather than a wholesale migration. Start with the gaps that stop your business understanding or controlling its existing environment.

How do we avoid becoming dependent on one engineer?

Ask for a handover that another competent person could follow. The business should know where asset records, service ownership, supplier contacts and approved configuration decisions are held. Access information needs a secure management method, while operating instructions should remain available to the people who need them. Do not confuse keeping information safe with leaving it undocumented.

Include the handover in acceptance of the preparation work. Ask the provider to demonstrate how a different engineer would identify a device, investigate a failed change and find the business approver. This is a practical continuity check rather than a demand that every employee understand the technical tools. It also makes a future change of supplier more manageable. If the usual engineer is unavailable during an assessment query, accurate records and named deputies should allow the work to continue without relying on their personal inbox or memory.

What is a practical first step if we have no IT team?

Nominate the internal owner, gather the current service and device information and arrange a scoped readiness conversation. Ask for a written action list organised by responsibility and dependency. Do not commit to a certification date until the main unknowns have been investigated and any important replacement work has been considered.

Use a simple acceptance test for the preparation work: can the owner explain the scope, show where the evidence comes from and identify who maintains each control? If the answer relies entirely on one engineer’s memory, improve the handover. A non-technical business should be able to understand its responsibilities in ordinary language.

There is no need to create an internal department solely to start the conversation. There is a need for informed ownership and a dependable delivery arrangement. To discuss your systems and the support you need, speak to NetMonkeys. Bring an accurate picture of the awkward parts as well as the managed devices; those details make a practical plan possible.