We are Cyber Essentials certified. Here is what that checks.

Hiscox Media Limited holds a Cyber Essentials certificate, issued on 14 September 2026 through Cyber Securities UK, an IASME-licensed certification body, certificate number 75a6f497-ef15-4f43-a1aa-cc7d31e9d4fc (verifiable on the IASME registry). This is the first of the accreditations we set out to hold, and the one most customers ask about first, so this is a plain account of what it is and what it is not.

What Cyber Essentials is

Cyber Essentials is the UK government’s baseline scheme for cyber security, run by the National Cyber Security Centre with IASME as its delivery partner. It is not a badge for saying the right things. It is an assessment of five technical controls, applied to every device and cloud service an organisation uses to hold or process its data:

1. Firewalls. Every internet connection sits behind a firewall, and every device carries its own.
2. Secure configuration. Default passwords gone, unused software and accounts removed, devices locked when unattended.
3. Security update management. Operating systems and software patched within fourteen days of a fix being released, and nothing in use that its maker no longer supports.
4. User access control. Every person has their own account, administrator rights are separate from day-to-day accounts, and every cloud service is protected by multi-factor authentication.
5. Malware protection. Every device runs current protection, and it is actually switched on.

The assessment is a self-assessment, signed by a director, reviewed by an assessor at the certification body, and valid for twelve months. Cyber Essentials Plus adds an independent technical audit of the same controls, and is our next step.

What we had to show

The scheme covers the whole business, not a corner of it. For us that meant listing every laptop and server, every cloud service from email to the customer portal, and confirming each control on each one. The work behind the questionnaire, done through August and September, was more useful than the certificate: an information systems register that names every service and who administers it, multi-factor authentication confirmed on every cloud account, separate administrator accounts, monitored endpoint protection on every machine, patching on a fixed monthly day, and quarterly reviews of who has access to what. Those routines now run whether an assessor is watching or not.

What it means when you hand us your media

Most of what we do involves other people’s data. A memory card from a camera, a recorder or a medical device carries whatever was on it until we erase it. Cyber Essentials does not certify our erasure process; NIST 800-88 covers that, and every card leaves with its own certificate. What Cyber Essentials certifies is the environment the card sits in while it is with us: the machines it is read on, the portal where its record lives, and the accounts of the people who can see it. It is the answer to the question a procurement team asks before the one about erasure.

What comes next

Cyber Essentials Plus, with its independent audit, is the next milestone. After that, ADISA certification for the media handling itself, and ISO 27001 when the business is large enough to carry it. We will publish each one here as it happens, with the same account of what it checks.

If your own supplier questionnaire asks for our certificate, it is available on request from lee@hiscox.biz.