The questionnaire that stopped the deal
It happened — 2026IASME (the certification body), 2026
Since 27 April 2026, Cyber Essentials marks harder exactly where small firms are weakest: any cloud service with MFA available but not enforced for every user — admins included — is an automatic fail. Meanwhile the certificate keeps spreading down supply chains as a condition of doing business.
Your version arrives as an email attachment. Twelve people, growing on referrals, and your biggest-ever prospect sends the vendor onboarding pack: Do you hold Cyber Essentials? Is multi-factor authentication enforced for all users? How do you manage devices and patching? The deal owner forwards it with “can you sort this by Friday?” — and the honest answer, today, is “no, but we've been meaning to”. Nobody is quite sure what's actually switched on in Microsoft 365, and two freelancers still log in with a shared account.
This is you if A tender or client onboarding pack is sitting unanswered; nobody can say what's actually switched on in M365; you've lost a deal to “compliance” and never found out why.
How we run it
We answer the questionnaire before we chase the certificate.
The deal has a deadline and the certificate has a queue. So week one produces truthful, evidence-backed answers plus a dated plan for the gaps — and procurement teams accept a plan with dates far more often than they accept silence.
Then the MFA sweep — the item that now fails firms outright.
Every cloud service inventoried, the second sign-in check enforced for everyone including the administrators, and shared logins replaced with named ones. This is the exact line the assessment checks first.
Devices and updates come up to evidence standard.
Supported systems only, updates verified rather than presumed, and the machines that can't make it named and scheduled out rather than quietly ignored.
Then we certify — and keep it true.
Submission handled, and the badge goes into your proposals and your email footer, because it's a sales asset, not a filing. A quarterly check stops a quietly-added tool with MFA off from failing you at renewal.
Made boring by: a fixed-price readiness package, then Professional to keep the answers honest year-round. One won corporate client pays for it many times over. Per-job · ongoing from Professional £69/user/month
Real scheme change: IASME, Apr 2026. The twelve-person agency is illustrative.