Cyber Essentials doesn't need a Statement of Applicability or an NCSC Cyber Assessment Framework (CAF) Improvement Plan, so we don't sell you one. Here's exactly what your Cyber Essentials / CE+ package includes: a focused policy set plus the handful of supporting tools that actually matter for this certification, built from one short questionnaire.
Need more, a live SoA, a CAF-aligned Improvement Plan, a formal risk register, ROPA, BC/DR planning? That's the Cyber Assurance Policy Pack. See the full sixteen-tool toolkit it includes.
Your full Cyber Essentials (or Cyber Essentials Plus) policy set, covering all five technical control themes, built from your real answers, not a generic template.
A real inventory of the devices and software in scope, the exact "what needs protecting" evidence an assessor asks for, and a genuine CE+ scoping requirement.
Every outstanding gap turned into a prioritised to-do list, so getting certified is a clear checklist, not a guess at where to start.
A real record of who's been trained, and when, the people side of your five controls, evidenced rather than assumed.
A plain, practical plan for the first hour of a security incident, good practice that costs nothing extra to include.
A one-page summary of your security baseline in plain English, useful the moment a client or insurer asks "are you Cyber Essentials certified?"
Certification isn't a one-off event, your setup changes, and a policy set that's accurate on day one but wrong by month six won't hold up if you're ever asked to prove it. Automated affected-document flagging and review-reminder emails keep everything above matched to how your business actually runs.
If a public sector tender starts asking for CAF alignment, an enterprise client wants ISO 27001, or your insurer wants a full evidence trail, the Cyber Assurance Policy Pack builds on the same platform and the same answers.
A genuinely smaller, faster, lower-cost package, for businesses that only need the baseline.