We delivered a full-service Cyber Essentials Plus readiness program. This included a deep-dive gap analysis, rewriting 20+ cybersecurity policies, hardening infrastructure (covering over 50 end-user devices and 30+ cloud services), full implementation of all CE+ requirements:

1. Firewalls & Internet Gateways

   • Boundary and device firewalls must be configured to block untrusted access.

   • Only essential inbound/outbound ports should be open.

2. Secure Configuration

   • Devices and software must be securely configured (e.g., disable unnecessary services, remove default accounts).

   • Admin privileges must be tightly controlled.

3. User Access Control

   • User accounts must be assigned based on the principle of least privilege.

   • Admin accounts must be used only when necessary.

   • MFA is required for all cloud services.

4. Malware Protection

   • Endpoint devices must have anti-malware tools (e.g., AV, application allowlisting, or sandboxing).

   • Only trusted software should be executable.

5. Security Update Management

   • All software and firmware must be kept up to date.

   • High/critical updates must be applied within 14 days.

… and hands-on support through certification with IASME. Our work helped RMI meet NHS contract requirements and significantly mature their security posture.

It was essential to maintain eligibility for government contracts—especially with the NHS Countess of Chester Trust. Beyond compliance, RMI needed to enhance protection for a globally distributed workforce using mixed devices (BYOD, corporate) and cloud platforms.

We mapped all in-scope systems—including home-office devices and international endpoints—and established controls like patch automation, MFA, and endpoint monitoring. We tailored the scope to reflect RMI’s operational model without creating unnecessary compliance friction. We also stepped in in fractional manner, but provided full service. This meant significant cost reduction for RMI.

Key policies included: Access Control, Risk Management, Secure Configuration, Incident Response, and BYOD Guidelines. All documents aligned with CE+ 3.1 requirements and were customized to RMI’s hybrid/cloud-first model. We also create asset registry list, and enabled real-time overview, which was previously not done, and partially done manually.

Today, RMI has all policies actually implemented, managed, maintained and automated.

RMI successfully achieved Cyber Essentials Plus certification. Just as importantly, they now have clear governance, stronger infrastructure controls, and scalable practices for frameworks like ISO 27001.

In theory, yes—but in practice, the depth of documentation, technical hardening, and audit prep required deep expertise and significant effort.

Our structured, accelerated approach avoided costly missteps and ensured success on the first attempt.

That’s a common misconception. Cyber Essentials Plus involves technical audits, device testing, and validation of actual controls in place—not just paperwork. Achieving certification across RMI’s distributed, cloud-heavy environment was far more than ticking boxes.

We go beyond minimum compliance. While others may offer templated policies or basic scans, we deliver tailored risk insights, real policy integration, infrastructure tuning, and stakeholder education. The result is certification plus long-term security value

Both. The certification was the objective, but the process led to tangible improvements: tighter access controls, formalized governance, real-time patching, and centralized visibility. These improvements help protect RMI’s people, systems, and clients beyond the audit.

It’s a strong foundational framework, but not a silver bullet. However, with the added structure and controls we implemented, RMI is well-positioned to pursue more advanced standards like ISO 27001 or NIST CSF if needed.