Achieving Cyber Essentials
A UK SME was struggling to become Cyber Essentials compliant. Its internal IT team understood the importance of certification but lacked the time and specialist knowledge to deliver the changes required. Golshtech helped the team understand the requirements, then worked alongside them to bring their environment up to the standard needed to pass.
At a glance
| Organisation | UK SME |
|---|---|
| Platform | Microsoft 365 and Windows devices |
| IT resource | Small internal IT team |
| Driver | Customer and contract requirements |
Why Cyber Essentials matters
Cyber Essentials is the UK government-backed baseline for protection against common cyber attacks, and is increasingly required by customers, supply chains and insurers. In 2025/26, 43% of UK businesses reported a cyber breach or attack.
The standard has also become stricter. Since April 2026, cloud services such as Microsoft 365 are fully in scope, and failing to enforce MFA wherever it is available is an automatic fail. Many organisations want to comply but don’t have the internal resource to make the changes.
The challenge
- Devices were not centrally managed, so there was no reliable view of patching, encryption or admin rights.
- MFA was inconsistent across users and cloud services.
- Sign-ins to Microsoft 365 were allowed from any device and any location.
- Capacity: the IT team had day-to-day support to run and no time to plan and deliver changes affecting every user.
How we helped
Golshtech explained what Cyber Essentials requires in practical terms, assessed the client’s environment against the standard and agreed a staged plan. We then delivered the changes with the IT team, so they could maintain them afterwards.
Device management and compliance
- Enrolled all company devices in Microsoft Intune.
- Applied compliance policies for supported OS versions, encryption, Defender and screen lock.
- Automated updates to meet the 14-day patching requirement and removed everyday admin rights.
Multi-factor authentication
- Enforced MFA for all users across Microsoft 365 and other cloud services.
- Blocked legacy authentication and supported staff through the rollout.
Conditional Access
- Allowed access to company data only from compliant devices.
- Restricted sign-ins to the UK and applied stronger controls to admin accounts.
The results
- Cyber Essentials achieved, meeting customer and contract requirements.
- Every device managed, patched and compliant, with a clear view for the IT team.
- Stronger protection against account compromise through MFA and Conditional Access.
- A team ready for renewal, confident in maintaining the standard year on year.