TL;DR: A Cyber Essentials certificate means nothing if the controls behind it aren't real. We regularly audit new clients who hold valid Cyber Essentials certificates but whose environments fall well short of the actual requirements. Certification is a point-in-time assessment — the director who signs the declaration is confirming ongoing compliance, not a one-off snapshot. A breach at a non-compliant certified business can cascade to every supplier and customer relying on that certificate, with contractual and regulatory consequences. We're offering new clients a free, no-obligatio...