Rubicon IT is now Cyber Essentials Plus certified. The Plus certification requires an independent technical assessment, not just a self-assessed questionnaire, so clients can verify our security posture rather than take it on trust.
What Cyber Essentials Plus actually means
Cyber Essentials is the UK government-backed certification scheme. It requires organisations to demonstrate five controls that block the most common, commodity cyber attacks: firewalls, secure configuration, user access control, malware protection and security update management.
Cyber Essentials Plus starts from the same five controls but adds something that the standard self-assessment cannot: an independent technical audit. A qualified assessor verifies that the controls are genuinely in place, not just attested to on paper. The pass bar is also higher. Where Cyber Essentials permits isolated non-compliances, Cyber Essentials Plus requires full remediation before certification is awarded.
In plain terms: you have our word, and now you have a third-party auditor's word as well.
Cyber Essentials Plus is renewed annually. It is not a one-time badge. We requalify each year, which means the controls stay current and you do not need to ask.
Why this matters for creative studios and architecture practices
Many of the businesses we work with operate under supply chain requirements. Architecture practices bidding on commercial or public-sector projects increasingly face security screening. Post-production studios working with major broadcasters or streaming platforms face TPN and content security requirements that cross-reference supplier credentials. Design agencies handling client data under GDPR or commercial NDAs have a genuine interest in the security posture of the partners they rely on.
Cyber Essentials Plus certification gives those businesses something concrete to point to: an audited, current, government-recognised standard. It is the kind of assurance that holds up in a procurement questionnaire or a client security review.
It also aligns directly with the work we do for clients who are pursuing their own Cyber Essentials or Cyber Essentials Plus certifications. We have always supported clients through the programme: gap assessments, remediation, assessor liaison, and keeping the controls in place day-to-day. Holding CE Plus ourselves means we are doing exactly what we help our clients do.
How we help clients achieve CE and CE Plus
For clients who need Cyber Essentials or Cyber Essentials Plus themselves, the path typically looks like this.
Cyber Essentials
Self-assessment questionnaire, independently verified. Rubicon assesses your current controls, closes gaps and supports you through the submission process. Renewable annually.
Cyber Essentials Plus
Everything in CE, plus a full technical audit. Rubicon prepares your environment, coordinates with the assessor and handles remediation if issues surface. A stronger signal to clients and supply chains.
For Business-PRO clients, the ongoing controls Cyber Essentials requires: patch management, endpoint protection, access control and firewall management are built into the managed service. Getting to certification means assessing what is already in place, closing the specific gaps and managing the audit.
What changes for you
If you are an existing client, the short answer is: nothing changes in how we work together. You already benefit from the security baseline that underpins our CE Plus certification.
If you are in a procurement process and your questionnaire asks about supplier cyber security credentials, you can now cite Cyber Essentials Plus.
If your own business is thinking about pursuing Cyber Essentials or CE Plus and you want to understand what is involved, talk to us. We have been through the process. We know where the work is.
Thinking about Cyber Essentials for your business? Take our free security self-assessment to see how your current posture compares against the CE controls.