43%
of UK businesses breached in 2025/26
Just over four in ten UK businesses reported a cyber security breach or attack in the past twelve months — DSIT Cyber Security Breaches Survey 2025/2026.
Cyber Essentials & CE+ — York & Yorkshire
Get certified. Win contracts. Fix your insurer's requirements.
Fixed-price Cyber Essentials and CE+ certification for Yorkshire SMBs. Published prices — no "call for a quote". CE from £1,250. CE+ from £2,495. Serving York, East Riding and North Yorkshire.
Certification you can defend — not just a tick-box.
The independent assessment argument.
Cyber Essentials certification prepared by your existing IT provider carries a structural problem: when the same team that configured your network assesses whether it meets the CE controls, there is an unconscious tension between finding gaps and implicating their own work. An independent assessment — where the person assessing has no stake in the original configuration — removes that tension and produces a certificate you can stand behind.
39%
took no preventive action after a breach
Of businesses that experienced a breach or attack, 39% reported taking no action to prevent future incidents. Familiarity normalises risk — until the consequences escalate.
5
controls address most commodity attacks
DSIT's own research shows the five Cyber Essentials controls address the attack vectors behind the majority of incidents affecting UK SMBs. Certification is evidence of having applied them.
Source: DSIT Cyber Security Breaches Survey 2025/2026 (published April 2026).
Cyber Essentials & CE+ certification
The certification that wins government contracts, satisfies insurers, and reassures your clients. Fixed, published prices — everything included.
Cyber Essentials — York & Yorkshire
£1,250 flat, ex-VAT — CE readiness + certification
Covers all five control areas: firewalls, secure configuration, access control, malware protection and patch management. Includes gap assessment, remediation guidance, policy templates, evidence preparation, submission handling, one resubmission, and a 30-day post-cert retest window. The certificate is issued via an IASME-accredited certification body. CE Starter for businesses with 1–4 users is £795.
Full pricing and what's included →Cyber Essentials Plus (CE+)
£2,495 from, Micro — ex-VAT
Hands-on technical verification by an assessor, not just a self-assessment questionnaire. CE+ carries more weight with insurers and is required by some NHS commissioners and public sector clients. Micro (1–9 users) £2,495; Small (10–49 users) £2,995. Remote delivery as standard.
Full CE+ pricing →Cyber Essentials Gap Analysis
£750 fixed price
Not ready to submit yet? The standalone gap analysis identifies every issue before the formal certification process starts. The most expensive mistake is submitting before you know whether you will pass — the gap analysis prevents that. Plain-English report with remediation steps.
How it works →
Why a gap analysis first? Submitting for Cyber Essentials before gaps are closed means paying twice — the first assessment fee, remediation time, and a retake. Starting with a gap analysis removes that risk and is included in the CE and CE+ engagement prices.
Managed services & ongoing security
Certification gets you the certificate. These services keep you covered after it.
Security Partner Retainer
£600/month
Ongoing access to a named security consultant without a standing project. Monthly review call, 24-hour priority response, two hours of included ad-hoc work per month, and 10% discount on all project engagements. Suitable for businesses that want a security adviser on tap once CE certification is in place.
Full details →UniFi / CCTV install
Day-rate
Network hardware installation — switching, wireless, and CCTV. VLAN configuration, structured cabling, and handover documentation included. Work scoped and priced before the visit.
Full details →What the Cyber Essentials assessment covers
The assessment is structured, documented, and delivered by one consultant throughout — the person doing the work, not an account manager. Every engagement covers all five CE control areas from gap to certificate.
Scope
- External network exposure — what attackers can see from the internet
- Internal network configuration — segregation, access controls, open services
- Firewall and router configuration review
- Wireless network security assessment
- User access and privilege review
- Patch status and known vulnerability exposure
- Written report — plain-English findings with remediation steps
- 30-minute follow-up call to walk through findings
- 30 days of post-report email support
Pricing
Cyber Essentials Gap Analysis
£750
Fixed price. Any size SMB.
Security Partner Retainer
£600/mo
Monthly access, priority response, 2hrs included ad-hoc work, 10% project discount.
Wolds Cyber Ltd · Company No. 17143627 · Registered in England & Wales
How Cyber Essentials certification works
From first conversation to certificate in hand. The most expensive mistake is submitting before gaps are closed — the process below avoids it.
1
Scoping call
A free 15-minute call. We establish your organisation size, current posture, and the right certification tier. You receive a confirmed price before any work starts.
2
Gap assessment
We assess your current configuration against all five Cyber Essentials control areas and produce a plain-English gap list. Nothing is submitted to the certifying body at this stage.
3
Remediation
You or your IT team works through the gap list. We provide policy templates and are available for questions. For CE+, we recheck controls once remediations are applied.
4
Certification
We prepare the evidence pack and submit to our certification body. The certificate is issued by an IASME-accredited body and is valid for 12 months. One resubmission included if needed.
Built for businesses with something to protect
Sectors where data loss, downtime, or a regulatory breach would cause real harm.
Motor Trade
Insurer-approved bodyshops, fleet SMBs, leasing brokers, dealers handling consumer finance
Solicitors & Legal
SRA cyber security guidance, client money accounts, GDPR
Accountants
HMRC data handling obligations, client financial records
Healthcare & Dental
CQC Data Security Toolkit, patient records
Logistics
Ransomware exposure, operational continuity, supply chain
Professional Services
Candidate data, client records, GDPR, regulatory exposure
Charles Cassam
Founder, Wolds Cyber Ltd — Pocklington, East Yorkshire
I spent over a decade in automotive management — franchised dealer, independent garage, Bosch Car Service implementation. That background taught me how operational failures actually propagate, and how to communicate technical findings to people who need to act on them, not just read them.
Direct expert — no handoff
The person you brief is the person who does the work and writes the report. No account managers, no junior analysts shadowing. Direct technical contact from scope to deliverable.
AI-era security methodology
Trained in current adversary-AI techniques. The threat landscape moved past 2019 playbooks — so did the methodology applied to every assessment.
Data sovereignty
Your assessment data stays on infrastructure I own and operate. No vendor cloud, no third-party AI training on your artefacts. Defensible to insurers and regulators who ask where your audit findings sit.
Common questions
Straight answers.
Cyber Essentials is a UK Government-backed certification scheme covering five technical controls: firewalls, secure configuration, access control, malware protection, and patch management. It is mandatory for government contracts involving sensitive personal data. Beyond that, cyber insurers increasingly require it, and larger clients — particularly in legal, healthcare, and public sector supply chains — ask for it during due diligence. The current scheme version is Danzell (Requirements for IT Infrastructure v3.3), which became mandatory from 27 April 2026 and introduced stricter MFA requirements for cloud services.
Wolds Cyber publishes fixed prices. CE Starter (1–4 users) is £795 ex-VAT. CE standard is £1,250 ex-VAT. CE+ Micro (1–9 users) is £2,495; CE+ Small (10–49 users) £2,995. Every engagement includes gap assessment, remediation guidance, policy templates, evidence preparation, submission handling, one resubmission, and a 30-day post-cert retest window. No separate charge for readiness work, no hidden extras. See the full price table →
Basic Cyber Essentials is a self-assessment questionnaire, independently verified by a certifying body. Cyber Essentials Plus involves hands-on technical testing by an assessor who verifies your controls in practice — not just on paper. CE+ carries significantly more weight with insurers and clients who require supply-chain assurance. Both cover the same five control areas.
The gap assessment and remediation phase depends on how many controls need work. Once gaps are closed and the evidence pack is submitted, basic CE is typically certified within a few working days. CE+ involves hands-on verification by the certifying body and usually takes longer end-to-end. Starting with a gap assessment — rather than submitting directly — avoids the most expensive mistake: failing on first submission and paying twice.
The distinction is independence. When your IT provider assesses the network they built and maintain, there is a structural tension — even for diligent, well-intentioned engineers. An independent assessment removes that tension and produces a certificate and report you own, suitable for sharing with your insurer, a regulator, or a client doing due diligence. Most clients continue to use their IT provider for day-to-day work and use an independent consultant for assessment. The two roles are complementary.
Yes, and frequently. Ransomware and credential-harvesting campaigns are automated — they scan the entire internet for systems with known vulnerabilities. They do not check company size first. SMBs are specifically attractive because they are perceived as having weaker defences and fewer resources to respond. DSIT's Cyber Security Breaches Survey 2025/2026 found 43% of UK businesses experienced a breach or attack in the past year. The five Cyber Essentials controls address the attack vectors behind the majority of those incidents.
Ready to get Cyber Essentials certified?
The first step is a free 15-minute call. We confirm your organisation size, the right certification level, and what the process involves — before any work starts. No commitment.
Book a Free 15-Minute CallFree Website Security Check
Scan your website for SSL issues, missing security headers, and DNS vulnerabilities. Instant results, no sign-up required.
Scan Your Website Free