If your business needs Cyber Essentials and you run bespoke software, the certificate is not something you can leave to your developer to hand over. It is passed on evidence, so the useful question is what has actually been checked, and by whom. Here is what to expect and what to ask for.
Evidence, not belief
Cyber Essentials is a UK government-backed scheme that sets out a basic level of security for organisations. You complete a questionnaire about how your systems are set up, and the answers are assessed.
The trap is answering from what you believe. Everyone believes their accounts are protected, their devices are updated and their software is configured sensibly. The faults that cause a failure are almost always things that were assumed to be true and never looked at. Answering from belief is how you fail, and then pay to do it again.
So the better approach is to answer only from what someone has checked and can show.
Scope is the whole organisation
It is tempting to carve out a small part of the business and put only that in scope. Resist it. Scope is the whole organisation, not a subset chosen to make the assessment easier.
For bespoke software, that has two practical consequences.
Every cloud account counts
Bespoke software rarely lives in one place. There is usually hosting, a database, email sending, payments, file storage, source code, monitoring and more. Each is a cloud service, and many hold your data.
From April 2026, a cloud service that holds the organisation's data cannot be left out of scope, and missing multi-factor authentication (MFA) on one is an automatic fail. A forgotten account with no second step at sign-in is enough.
Lists of accounts go stale. It is more reliable to find them from the other direction, by looking at what your devices actually connect to.
Every device that administers the system counts
The people who deploy, update and look after your software do it from devices. Those devices, the developer's laptop included, are part of the picture. If a machine can change your live system, it needs to meet the same basic standards as everything else: kept up to date, protected and locked behind proper sign-in.
What your developer should be able to show you
You do not need to understand every control. You do need your developer to produce evidence rather than reassurance. Ask them for:
- A list of every cloud account that holds your data or can change your systems, with who has access to each.
- Proof of MFA on each of those accounts, not a statement that it is switched on.
- The devices used to administer your systems, and confirmation that each has been checked.
- Where the software is kept up to date, including the libraries and services it relies on, and how updates are applied and recorded.
- What has changed since the last check, such as new accounts, new people or new tools.
If the answer to any of these is "I think so", that is the thing to check first.
Keep a dated record of what is true
Treating Cyber Essentials as a questionnaire you answer when it is due is the expensive way to do it. Systems change constantly: people join and leave, new services are added, old ones are forgotten.
The better habit is to keep a dated record of what is true, kept up to date as things change. When a renewal arrives, it is checked against that record, and the answers come from something that already exists instead of from memory and guesswork. It also means a problem is found when it appears, not when an assessor finds it.
A hypothetical example
Imagine a business with a bespoke ordering system. The owner is confident everything is protected, and the developer agrees. Nobody has listed the accounts.
When someone looks, they find a hosting account, a code repository, an email service and a file store. One of them, set up quickly for a test, has no MFA and holds real customer data. Under the current rules that alone would fail the assessment.
Nothing about the software was wrong. The fault was a thing everyone assumed to be true. Found during preparation, it is a quick fix. Found after a failed assessment, it means paying to be assessed again.
Questions to ask your developer
- Can you give me a list of every cloud account that holds our data, and show MFA is on for each?
- Which devices are used to administer our systems, and who has checked them?
- How do you find accounts we have forgotten about?
- Where is the record of what you have checked, and who keeps it current?
- What will you tell me when something changes?
A developer who can answer these plainly is one you can rely on at assessment time. One who cannot has told you where to start.
Let's build something together
Tell us what you're working on, and we'll come back with an honest view of how we could help.