Firewalls
Boundary firewalls and the software firewalls on every device: default passwords changed, admin interfaces off the internet, and every open inbound rule justified and documented.
Managed Services
Pass Cyber Essentials without guessing what to fix
Cyber Essentials is a self-assessment most SMBs can pass in a few weeks of tidying up. The problem is knowing what to tidy. Defined Complex Solutions reviews your setup against the five controls, gives you a gap report with the fixes ordered by effort, and checks your answers before you submit — for a fixed price, with the same engineers who run SMB stacks every day. Healthcare providers get the NHS Data Security and Protection Toolkit covered in the same engagement.
What the assessment covers
The five Cyber Essentials controls, checked against your real setup
Every Cyber Essentials question maps to one of five technical controls. We check each one against what you actually run — not a questionnaire you fill in hopefully.
Secure configuration
Unused accounts and software removed, auto-run disabled, device locking enforced, and the default settings that ship with laptops, routers and cloud tenants replaced with ones that would survive an audit.
Access control
Who has an account, who has admin rights and why. Multi-factor authentication on every cloud service, a joiners-and-leavers process that actually runs, and admin accounts used only for admin work.
Malware protection
Anti-malware on every in-scope device, kept current and actually switched on, or an approved application allow-list in its place. Checked device by device, not by assumption.
Patch management
Every operating system and application supported by its vendor, with critical and high-risk updates applied within 14 days. The control most SMBs fail on, and the one that is easiest to fix once you can see it.
How it works
Four steps from first call to a submission you are confident in
Mostly remote, fitted around your working week, and finished before the questionnaire is opened.
Scoping call
Thirty minutes to agree what is in scope — devices, cloud services, home workers, the lot — and confirm which package fits. Fixed price confirmed at the end of the call.
Remote review and evidence request
We review your Microsoft 365 tenant, devices and network remotely and ask for the evidence an assessor would want. You answer questions; you do not fill in forms.
Gap report, fixes ordered by effort
A written report of every gap against the five controls, with the fix for each and the effort involved, so the quick wins come first and nothing is a surprise.
Review before submission
Once the fixes are done, we go through your self-assessment answers line by line before you submit, so the first attempt is the one that passes.
Packages
Fixed prices, agreed before we start
All prices exclude VAT. The IASME certification fee is set by the certification body and paid separately; we tell you the current figure for your size of business on the scoping call.
| Package | What you get | Price (ex VAT) |
|---|---|---|
| Cyber Essentials Readiness | Scoping call, remote review, gap report with fixes ordered by effort, and a line-by-line check of your answers before submission. | £750 |
| Cyber Essentials + NHS DSPT | Everything in CE Readiness, plus the DSPT evidence checklist mapped to your organisation type, policy templates and a pre-submission review. For GP practices, dental surgeries, pharmacies and care providers. | £1,250 |
| Annual renewal check | A yearly re-check of the five controls against what has changed, and a review of your renewal answers before you submit again. | £295 |
| Remediation | Fixing the gaps the report finds — MFA roll-out, patching, firewall changes, device clean-up — done by our engineers if you would rather not do it yourself. | Quoted per day |
Scope, exclusions and what certification does and does not guarantee are set out in our consultancy terms.
Healthcare
NHS DSPT for GP, dental, pharmacy and care providers
If you hold NHS patient data, the Data Security and Protection Toolkit is an annual obligation, and most organisation types submit by 30 June. Its evidence items overlap heavily with Cyber Essentials, so doing the two separately means paying twice for the same work.
We map each DSPT assertion for your organisation type to the Cyber Essentials control that already covers it, supply the policy templates the toolkit asks for, and review the submission before it goes in. One engagement, both certificates, one fixed price.
What the DSPT package adds
- DSPT evidence checklist mapped to your organisation type
- Policy templates: access control, patching, backup, incident response, acceptable use
- Staff training and awareness evidence, listed and checked
- Pre-submission review of every assertion
- Annual renewal check available for both schemes
Ask a question
Tell us where you are and we'll tell you what it takes
Not sure whether you need Basic or Plus, or how far off a pass you are? Send a few details and an engineer will reply — no sales script.
Certification is the receipt. The point is the fixes.
Cyber Essentials is a sensible baseline, and the work to pass it is work your business should do anyway. Start with a technical review and we will tell you honestly how far off you are and what it costs to get there.