Scope and asset inventory
Record the organisations, locations, end-user devices, servers, networks, cloud services and internet-facing services that form the assessment boundary.
Technical overview · Foundation
Turn a recognised baseline into evidence your organisation can maintain.
A technical view of Foundation scope, Cyber Essentialsi control areas, evidence preparation, remediation and the boundary between readiness support and independent certification.
System flow
From authorised input to usable evidence.
This sequence shows how the principal technical activities connect. It is a capability flow, not a promise that every engagement uses every stage.
- 01
Define scope
Confirm entities, users, devices, networks, cloud services and justified exclusions.
- 02
Map controls
Relate the five Cyber Essentials controls to the systems and services inside scope.
- 03
Collect evidence
Gather configuration, access, inventory, update and malware-protection evidence.
- 04
Close gaps
Prioritise blockers, assign ownership and refresh evidence after remediation.
- 05
Prepare assessment
Assemble a coherent readiness record for the selected certification route.
Module specifications
What the technical capability covers.
The modules below retain the operational detail a technical evaluator needs when deciding whether the service fits their environment.
Firewalls and network boundaries
Review boundary protections, permitted inbound services, administrative interfaces and the rationale for exposed services.
Secure configuration
Review default accounts, unnecessary software and services, device-locking controls, privileged settings and baseline configuration standards.
Security update management
Identify supported operating systems, applications and firmware; evidence vulnerability decisions; and review whether relevant high-risk updates meet the required timescale.
User access control
Map joiner, mover and leaver processes, privileged access, separate administrative accounts, authentication controls and MFAi coverage.
Malware protection
Confirm the selected protection approach for each device type, including anti-malware, application allow-listing or restricted application installation.
Coverage, logic and outputs
The specification behind the workflow.
These details make the coverage and operating assumptions easier to evaluate. Items identified in the verification notice remain subject to sign-off before launch.
Evidence coverage
- Current hardware, software and cloud-service inventory
- Firewall and internet-service configuration evidence
- Account, privilege and MFAi configuration records
- Supported-version and security-update evidence
- Malware-protection policy and device-level implementation
Assessment logic
- One agreed assessment boundary and documented exclusions
- Cyber Essentials self-assessment mapped to accountable owners
- Cyber Essentials Plusi preparation aligned to independently selected technical samples
- Evidence checked for consistency across questionnaire, configuration and operational practice
- Scheme interpretation and certification decisions remain with the authorised certification body
Readiness outputs
- Control-by-control readiness matrix
- Prioritised blockers and evidence gaps
- Named remediation owners and target actions
- Assessment preparation record and supporting evidence index
- Maintenance and renewal actions for the next assessment cycle
One platform
Pentesys Portal — One Platform
The Pentesys Portal scans your authorised domain or domains to identify subdomains, IP addresses, cloud services, APIs, technologies, certificates and open ports—making it quicker, more accurate and simpler to define scope and capture the evidence needed for Cyber Essentials.
Boundaries and assumptions
Confirm the detail before work begins.
Technical coverage is shaped by the agreed scope, customer environment, service selection and authorised operating model.
See prices →- Pentesys provides readiness and preparation support; formal certification is completed through an authorised certification body.
- The exact evidence set depends on the agreed organisation and technical scope.
- Cyber Essentials Plus tests the scheme controls and is not a substitute for a broader penetration test.
Review the scope
Apply the technical model to your environment.
A relevant Pentesys specialist will review this overview, answer questions about boundaries, evidence and workflow, and explain the smallest proportionate next step.
Review this scope with a specialist Please do not submit credentials, secrets or sensitive evidence through the enquiry form.
Technical language, translated
Need a definition before going deeper?
The Pentesys glossary explains the security, testing and assurance terms used throughout this overview in plain English.
Browse the glossary →Trusted experience
Supporting recognised organisations.
Pentesys has continuously performed admirably during our collaboration, giving us faith in their knowledge. They delivered work that above our expectations by approaching each project with a deep understanding of our specifications. Their team demonstrated a remarkable degree of proficiency by effectively pinpointing weaknesses and offering practical suggestions to reduce possible hazards.
Unlike previous pentests that produced generic outputs, this engagement gave us clear, prioritised actions with real-world attack scenarios. The platform visibility into assets, vulnerabilities and remediation progress has helped us mature our security posture significantly. The team were professional, responsive, and genuinely cared about improving our security rather than just ticking a box.
The red team and external attack surface management work highlighted blind spots we didn't know existed. What stood out was the strategic guidance alongside the technical delivery – helping us shape a longer-term security roadmap rather than a one-off engagement. This felt like a partnership, not just a transactional assessment.
Pentesys has continuously produced excellent work. Their group demonstrated extraordinary technical proficiency by spotting crucial flaws and offering clever fixes that greatly strengthened our security stance. Their meticulous approach and attention to detail ensured that every facet of the project was covered in full.
We engaged Pentesys and the team for a complex penetration test and adversary simulation. The quality of the technical findings, realism of the attack paths, and clarity of reporting were outstanding. The recommendations were practical and mapped clearly to business risk, which made board-level conversations much easier. We've since built Pentesys into our ongoing security assurance programme.
ACCREDITED TO THE HIGHEST INDUSTRY STANDARDS
CREST member company
Pentesys has met CREST requirements for penetration testing in EMEA, demonstrating independently assessed technical and operational security-testing standards.
Cyber Essentials certified
Pentesys is Cyber Essentials certified across the whole organisation, showing that essential controls are in place to protect against common cyber threats.
CREST AI Charter signatory
A visible commitment to responsible, transparent and trustworthy use of AI within cyber security services.