Industry Voice: Cyber Essentials v3.3: What UK MSPs need to know to help clients achieve certification

While it’s true that Cyber Essentials certification is voluntary, it has become a business requirement for many UK organisations. Certification can affect eligibility for public sector contracts as well as for cyber liability insurance. Customers and partners are increasingly looking for it to assure that an organisation has baseline cyber controls in place.

For managed service providers (MSPs), developing the ability to help clients earn certification can seem daunting and potentially costly. But for MSPs who seek to grow both their business and their credibility, enabling clients to achieve certification represents a welcome opportunity.

Five primary areas of focus in Cyber Essentials v3.3

Service providers need to focus on five critical capabilities:

1. Network protection and firewall management

Under Cyber Essentials v3.3, firewall management interfaces should not be exposed to the internet unless there is a clearly documented business need and access is protected by multifactor authentication (MFA) or an IP allow list combined with a properly managed password. In fact, organisations will now automatically fail the certification assessment if MFA is available for a cloud service and has not been enabled.

For MSPs, supporting certification for clients often sounds straightforward in theory but becomes complex in practice. In modern IT environments, devices frequently connect from outside the corporate network and require consistent policies and device-level protections.

In interviews, MSPs told Acronis that certification can be difficult because assessors may interpret requirements differently. Plus, confusing technical configurations, such as whether certain VPN configurations count as open ports, can lead to inconsistent outcomes.

To help clients meet requirements effectively, MSPs need to:

• Implement centrally managed firewall policies.
• Ensure administrative interfaces are secured and not exposed to the internet.
• Use software firewalls for remote or unmanaged networks.
• Maintain documented approval for inbound firewall rules.

A security platform with a central point of management that integrates firewall visibility with broader endpoint protection can make this process far easier to manage across multiple customers.

2. Secure configuration across devices and cloud services

An important clarification in Cyber Essentials v3 states that all devices interacting with organisational services, including remote working devices and many bring-your-own-device (BYOD) scenarios, are within the scope of the framework.

MSPs say clients underestimate the scope of their environments. Service providers revealed to Acronis that one of the most common mistakes they see is organisations failing to account for “ghost IT” cloud services that employees have adopted without formal approval.

For MSPs, enabling certification requires:

• Comprehensive asset and application discovery.
• Standardised baseline configurations.
• Clear documentation of device and software management policies.

Without visibility across the environment, it’s almost impossible to prove consistent application of secure configuration and stay in line with Cyber Essentials requirements.

3. Patch management and vulnerability remediation

Cyber Essentials requires organisations to apply critical or high-risk vulnerability fixes within 14 days of release. The updated guidance also highlights that organisations must prioritise vulnerabilities with a CVSS score of 7 or higher, which reinforces the need for strong vulnerability management and visibility across endpoints and cloud services.

MSPs say that the cost and effort associated with implementing the required controls can be a major barrier to supporting certification for customers.

To manage patching effectively at scale, MSPs need:

• Automated vulnerability and patch management.
• Visibility into software versions across endpoints.
• Reporting to demonstrate certification with update timelines.

Automation is particularly important since manual patch management quickly becomes unsustainable in large environments.

4. Identity security and user access control

Under Cyber Essentials, organisations must ensure that accounts are assigned only to authorised individuals and that privileges are limited to what users need. Version v3.3 introduces clearer guidance on passwordless authentication methods such as biometrics, hardware tokens and one-time codes. Organisations should also separate administrator accounts from standard user accounts to minimise the impact of compromised credentials.

MSPs told Acronis that documentation and policy evidence, including BYOD policies and procedures for managing user access, can be particularly difficult for clients to produce during certification.

To support clients in certification efforts, MSPs should:

• Enforce MFA across all cloud services.
• Implement least-privilege access policies.
• Maintain clear processes for account creation and removal.
• Document access management procedures.

Identity management is increasingly central to effective cyber protection, particularly in distributed and cloud-first environments.

5. Malware protection

Malware protection remains one of the five core Cyber Essentials control areas. For MSPs, this is an important part of maintaining a consistent security baseline across client environments. Service providers can support clients pursuing certification by enabling organisations to ensure protection of in-scope devices against malware using appropriate controls.

MSPs can achieve that goal by providing:

• Maintained anti-malware software.
• Application allow listing.
• Another suitable and proven approach to malware protection.

A unified MSP platform with built-in malware protection eases support for certification for malware protection.

Building certification support as a managed service

Establishing repeatable processes that strengthen security across customer environments is critical for MSPs seeking to enable certification among their clients.

Solutions such as Acronis Cyber Platform bring together integrated data protection, cybersecurity and endpoint management capabilities, including patch management, backup and vulnerability assessment and monitoring, in a unified platform manageable from a single point of control. The integrated approach helps MSPs simplify the operational challenge of managing Cyber Essentials requirements for clients.

This article is sponsored by Acronis.