Cyber Essentials Evidence Workspace for MSP-Led Certification Readiness
opportunity / idea_filter — supported, but as a narrow wedge rather than a broad GRC platform.
Build a lightweight multi-client evidence and remediation workspace for UK MSPs, small Cyber Essentials certification consultancies, and SMB IT teams that repeatedly prepare Cyber Essentials submissions and renewals, especially under the April 2026 v3.3 scope/MFA language.
Primary buyer: 5-50 person UK MSPs and small cyber consultancies that help SMB clients prepare for Cyber Essentials or Cyber Essentials Plus but do not want to become, or are not yet, a fully licensed certification-body operation.
Secondary buyer: SMB IT managers in firms with recurring customer/procurement pressure for Cyber Essentials, especially professional services, public-sector suppliers, charities, manufacturers, and SaaS vendors.
The highest-fit user is the person who currently translates the IASME question set into client tasks: collecting device/user/cloud-service inventories, asking for screenshots or exports, tracking remediation, and then handing the final answer/evidence pack to an assessor or Certification Body.
The wedge should deliberately avoid becoming a universal control library, vulnerability scanner, or ISO/SOC compliance suite. The useful product shape is closer to “Cyber Essentials packet prep and renewal operations”:
NCSC’s April 2026 “Cyber Essentials: Requirements for IT Infrastructure v3.3” says the applicant is responsible for meeting all requirements and “might also be required to supply evidence before your Certification Body can award certification.” It also tells applicants to establish the boundary of scope, determine what is in scope, review the five technical control themes, and take steps to meet every requirement.
That language matters because the official product is not merely a form-fill. It creates a defensible trail: what is in scope, what requirements apply, how the applicant knows the controls are in place, and what evidence can be produced if the Certification Body asks.
IASME’s question-preview page confirms the operational workaround: Cyber Essentials is an annually renewable self-assessment questionnaire; applicants can download the question set in advance, then “copy and paste” prepared answers into the assessment portal. That is a strong signal that preparation happens outside the portal today, often in spreadsheets, email, tickets, and screenshots.
IASME says the Cyber Essentials v3.3 update applies to assessment accounts created after 27 April 2026; accounts created before then continue under the previous question version and applicants have six months to complete an assessment.
The update is described as mostly clarification, but the operational impact is not trivial for SMBs and MSPs:
For an MSP running 20-100 clients through renewals, this creates a repeatable checklist problem: Which clients use which cloud services? Is MFA actually on for all relevant accounts? Which screenshots/exports prove it? Which client owner can approve scope? What changed since last year?
GOV.UK’s Cyber Essentials management information says 55,995 Cyber Essentials certificates were awarded from January 2025 to December 2025, with 42,288 at Cyber Essentials level and 13,707 at Cyber Essentials Plus. Certificates are valid for 12 months, making renewal an annual workflow rather than a one-time event.
NCSC’s overview says IASME manages a network of 400+ cyber security organisations across the UK that advise and help organisations get certified. That gives the wedge a discoverable channel: certification bodies, Cyber Advisors, MSPs, and consultancies already clustered around one scheme.
CyberSmart’s 2026 MSP survey cites DSIT research that the UK had 12,867 active MSPs in 2025, up from 11,492 in 2024, generating around £51bn in annual revenue and employing more than 343,000 people. Treat vendor-sponsored survey material cautiously, but it supports the obvious channel thesis: MSPs are the front line for time- and knowledge-constrained SMEs.
Several commercial pages sell against the same pain:
This is unusually direct validation. The risk is competition, not absence of demand.
The willingness-to-pay signal is moderate to strong:
A plausible pricing wedge: £49-£149 per client assessment pack, or £199-£599/month for MSPs with 10-50 active clients, with white-label/client-portal tiers. Avoid enterprise GRC pricing at the start.
A weekend-buildable MVP does not need integrations on day one.
1. Client workspace: organisation, scope boundary, certification target, renewal date, assessor/certification-body contact.
2. Inventory snapshots: upload CSV/manual tables for devices, users, admin accounts, cloud services, software, third-party access, and network assets.
3. v3.3 question/evidence map: plain-language tasks grouped under the five Cyber Essentials controls, with “answer needed,” “evidence needed,” “owner,” “status,” and “freshness date.”
4. Evidence request portal: magic-link client upload pages for screenshots, PDF exports, policies, file attachments, and written confirmations.
5. Remediation tracker: tasks for MFA gaps, unsupported software, patching, admin-rights issues, firewall/default-password checks, malware protection, BYOD/cloud exceptions.
6. Handoff export: ZIP/PDF/HTML evidence pack with question mapping, inventory summary, outstanding risks, and Certification Body notes.
7. Renewal mode: clone last year’s pack, mark stale items, request fresh screenshots, and show changed answers.
Do not build vulnerability scanning, endpoint agents, or universal compliance mappings first. The wedge is coordination, evidence freshness, and repeatability.
1. Direct competition exists. CyberSwift and GetCybr already describe the MSP/multi-client/evidence/remediation/renewal workflow. A new entrant must be sharper, cheaper, easier to try, or attached to a distribution wedge.
2. Official portal access may be closed. If the IASME assessment portal cannot be integrated, the product must remain a preparation and handoff workspace, not claim automated submission.
3. Evidence expectations vary by Certification Body. The product should support assessor-specific templates rather than pretending one evidence pack is universally sufficient.
4. The basic certification can be “just a questionnaire” for simple companies. Very small SMBs may not pay unless an MSP or consultant bundles the workflow.
5. Requirement language changes annually. The product needs a maintained content-update process; stale question mapping would destroy trust.
6. Security posture risk. Storing screenshots and infrastructure details creates sensitive data obligations. A local-only or customer-owned-storage option could be a differentiator.
The strongest evidence is first-party for scheme requirements, annual renewal, April 2026 timing, and the evidence expectation. The market-size evidence is credible enough for directional sizing via GOV.UK certificates and NCSC/IASME network size.
The weakest part is direct, quotable practitioner pain from neutral forums. Search results show MSP/Spiceworks discussions about Cyber Essentials ambiguity, patching, MFA, BYOD, and client requirements, but many forum pages are low-context or difficult to extract cleanly. Vendor pages provide much clearer pain language, which risks circular validation because they are selling the solution.
Competition is also heavier than a clean greenfield idea. CyberSwift appears particularly close to the proposed wedge. The viable path is therefore not “nobody has built this.” It is “there is enough recurring, scheme-specific operational pain to support a focused, workflow-first, evidence-pack tool if the product is easier to adopt than broad GRC and more MSP-friendly than the official/manual process.”
A credible narrow workflow wedge for MSP-led Cyber Essentials renewals, but not broad enough or differentiated enough to be an obvious Brian-priority build.