How to show Cyber Essentials readiness to clients
Show each client a single readiness score, then the five Cyber Essentials control areas underneath it, each marked as met, partially met, not met or awaiting evidence, with the finding behind every mark. A client needs to know where they stand, what is outstanding and who has to act, in under a minute.
The five areas
Cyber Essentials was developed by the National Cyber Security Centre (NCSC) and is delivered through its partner IASME. It covers five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. These five headings are the natural structure for a readiness view.
Make the status honest
Use four states rather than a pass or fail: met, partially met, not met, awaiting evidence. "Awaiting evidence" matters because it separates a problem from a gap in paperwork.
Attach the evidence
Every mark should point to what was found and where it came from, for example a device count from the tools you already run. A result a client can trace back to its source is easier to trust and easier to question.
Say who has to act
Split outstanding items into those for your team and those for the client. Clients then see only what needs them.
Readiness is not certification
Cyber Essentials certification is a separate assessment. Cyber Essentials is a self-assessment questionnaire that an independent certification body reviews, and Cyber Essentials Plus adds hands-on technical testing by an assessor. A readiness score shows how prepared a client is. It does not replace certification, and it should not be described as certification.
Keep it current
A readiness view is only worth having if it updates as the underlying facts change. A score from three months ago is worse than none.
Where Trigway fits
Trigway shows each framework, Cyber Essentials among them, with a readiness score and every control marked in these four states, with the finding behind it, inside a portal carrying the MSP's brand. It is pre-launch; join early access or see the product.