What evidence will the ISO27001 auditor want to see?

Preparing for an ISO 27001 audit can feel daunting if you imagine the auditor arriving with a long checklist and expecting a perfect folder of documents. In practice, a good auditor wants something more useful: evidence that your Information Security Management System, or ISMS, operates as part of the business.

ISO/IEC 27001:2022 remains the current published edition of the standard, alongside Amendment 1:2024 covering climate action considerations. The standard asks organisations to establish, implement, maintain and continually improve an ISMS that manages information security risk. Certification therefore depends on more than policies. An auditor will look for evidence that your organisation understands its risks, chooses suitable controls, assigns responsibilities, reviews performance and improves when weaknesses appear.

That evidence can come from documents, records, system reports, meeting notes, interviews, tickets, dashboards, logs, training records and direct observation. The exact evidence will vary according to your organisation, scope, risks and selected controls.

UK Cyber Compliance uses an automated and AI-driven platform to help organisations organise ISO 27001 work, manage risks, generate relevant documentation, track progress and prepare audit evidence. The platform can make it easier to show how different parts of the ISMS connect rather than leaving evidence scattered across folders, spreadsheets and email.

UK Cyber Compliance (a part of UK Cyber Security Group) provides these services and has a platform to make certification much easier and cheaper.

The auditor wants proof that the ISMS works

The simplest way to understand ISO 27001 evidence is to separate what your organisation says from what it can prove.

A policy might say that user access receives regular review. The auditor may then ask for records of recent access reviews.

A procedure might say that security incidents get recorded and investigated. The auditor may ask to see the incident register, sample incident records and evidence showing what happened after an incident.

Your risk treatment plan may say that a particular control reduces a certain risk. The auditor can then ask how the control works, who owns it and what records demonstrate its operation.

What counts as persuasive evidence?

Strong evidence usually shows something that actually happened.

For example, a completed access review carries more weight than a document saying access reviews should happen.

A successful backup recovery test provides stronger assurance than a policy stating that backups exist.

Training records combined with staff interviews show more than a training policy alone.

This approach means an organisation should avoid creating documents purely for audit day. The strongest evidence comes from normal business activity.

what is iso 27001

ISO/IEC 27001 is the international requirements standard for information security management systems. ISO describes it as the best-known standard for an ISMS and states that organisations of any scale and sector can use it to establish, implement, maintain and continually improve information security management.

The standard focuses on confidentiality, integrity and availability of information. It does this through a risk-based management system rather than a fixed technical checklist.

That distinction matters during an audit.

The auditor does not simply inspect whether you own security software. They look at whether your organisation identifies relevant risks, decides how to address them, operates appropriate controls and monitors whether those controls achieve the intended result.

Start with evidence about your organisation and scope

One of the first things an auditor will want to understand is what your ISMS covers.

Your scope statement should clearly describe the organisational boundaries of the ISMS. It may refer to business functions, locations, systems, services, legal entities and relevant dependencies.

The auditor will compare that scope against how the organisation actually operates.

Useful evidence can include:

• An approved ISMS scope statement
• An organisation chart
• Office and operational location records
• Service descriptions
• Process maps
• Network or system diagrams where relevant
• A list of business functions within scope
• Records showing interfaces with external parties
• Explanations for any justified boundaries

A scope that looks artificially narrow can create questions. If a system, team or supplier has a meaningful effect on information security within the ISMS, the auditor may want to know how you considered it.

Show that you understand internal and external issues

ISO 27001 expects organisations to understand the context in which the ISMS operates.

An auditor may want to see how you considered business conditions that can affect information security.

These can include customer expectations, regulatory obligations, remote working, technology dependence, supply-chain relationships, cloud services, staffing, market conditions and relevant environmental considerations.

Following ISO/IEC 27001:2022/Amd 1:2024, organisations also need to determine whether climate change is a relevant issue for the management system.

Evidence might include a context register, business review record, risk workshop notes, management meeting minutes or another controlled record that shows the organisation has considered relevant issues.

The auditor is not looking for a fashionable template. They want to see that the analysis makes sense for your organisation.

Interested parties need more than a list of names

Most organisations depend on several parties whose needs can influence information security.

These may include customers, employees, regulators, suppliers, shareholders, insurers, certification partners and public-sector clients.

Your auditor may ask to see:

• An interested parties register
• Relevant information security expectations
• Contractual obligations
• Customer security clauses
• Supplier requirements
• Regulatory requirements
• Data protection obligations
• Service commitments
• Evidence of periodic review

The important question is whether your organisation understands which requirements matter to the ISMS and how it addresses them.

A generic list containing every possible stakeholder adds little value if nobody can explain why those parties matter.

Who needs iso 27001 certification

ISO 27001 can support organisations across technology, professional services, finance, healthcare, manufacturing, education, charities, public-sector supply chains and many other sectors.

Certification often becomes particularly useful when customers ask for independent assurance, procurement frameworks include information security requirements, sensitive data forms a major part of service delivery, or senior management wants a structured way to manage information risk.

ISO itself makes clear that organisations can implement the standard without seeking certification. Certification adds independent assessment by a certification body.

For UK organisations seeking accredited certification, UKAS accredits certification bodies for ISO/IEC 27001 information security management system certification. UKAS currently identifies ISO/IEC 27006-1:2024 as the applicable certification body standard for ISMS certification.

Leadership evidence should show real involvement

Leadership is a central part of ISO 27001.

An auditor may speak directly with senior management rather than relying only on the person who manages the ISMS.

They may ask leaders to explain:

• Why information security matters to the business
• The main information security risks
• Important security objectives
• How resources get approved
• Who owns key ISMS responsibilities
• How management reviews performance
• What happens when serious issues arise

Evidence can include approved policy records, management meeting minutes, resource decisions, assigned responsibilities, objectives and management review outputs.

The auditor wants to see that the ISMS has management backing rather than functioning as an isolated IT project.

Your information security policy should match reality

Most organisations maintain an information security policy as a central statement of intent.

The auditor may look at whether the policy suits the organisation, supports relevant objectives, includes commitments expected by the standard and receives appropriate approval.

They may also ask how employees access it and how the organisation communicates it.

A polished policy offers little value if staff have never seen it.

Evidence might include publication records, staff acknowledgements, training material, intranet access, review history and approval records.

Risk assessment evidence sits at the heart of the audit

Risk management drives ISO 27001.

Your auditor will want to understand the method you use to identify, analyse and evaluate information security risks.

They may ask for:

• Risk assessment criteria
• Risk acceptance criteria
• Risk assessment records
• Risk owners
• Likelihood and impact scoring
• Existing controls
• Residual risk
• Risk decisions
• Review records

Consistency matters.

If two similar risks receive completely different ratings without a sensible reason, the auditor may question the method.

Likewise, risks should relate to the organisation’s real activities, information, systems and dependencies. A risk register copied from another company rarely stands up well under questioning.

Evidence should show decisions

The auditor will often trace a risk from start to finish.

They may select one risk and ask why you scored it at a particular level.

Next, they may ask why you chose a control.

They could then request evidence that the control operates.

Finally, they may ask how you know the remaining risk sits within your organisation’s acceptance criteria.

That traceability provides much stronger assurance than a large risk register with no clear ownership or follow-up.

Risk treatment should connect risks to action

After identifying risks, your organisation needs to decide how to treat them.

The auditor will look for a clear connection between identified risks and the actions selected to address them.

Evidence may include:

• A risk treatment plan
• Assigned control owners
• Target dates
• Implementation records
• Accepted residual risks
• Management approval where appropriate
• Review history

A useful risk treatment plan tells the auditor what the organisation decided, who owns the action and whether the treatment has actually happened.

The Statement of Applicability is a key audit document

The Statement of Applicability, often called the SoA, is one of the most important records in an ISO 27001 audit.

ISO/IEC 27001:2022 Annex A contains 93 controls arranged across organisational, people, physical and technological themes. UKAS confirmed the move to 93 controls when organisations transitioned to the 2022 edition.

The SoA should identify the controls the organisation considers necessary, explain their inclusion, state whether they have been implemented and justify exclusions from Annex A.

The auditor will often use the SoA as a route into deeper testing.

If the SoA says a control applies, expect the auditor to ask how it operates and what evidence demonstrates that operation.

The SoA should also align with the risk assessment and risk treatment process. An unexplained gap between those records can create problems.

What is ISO 27001 Certification?

ISO 27001 certification provides independent assessment of an organisation’s ISMS against the requirements of ISO/IEC 27001.

ISO does not certify organisations itself. Independent certification bodies perform certification, while accreditation provides assurance about the competence and impartiality of those bodies.

UKAS explains that accredited certification gives users confidence in the competence of the certification body and the reliability of its certification activities.

For an organisation preparing for audit, that means evidence must withstand independent review rather than simply demonstrating that a document exists.

ISO 27001 Certification Levels

ISO 27001 does not use formal bronze, silver, gold or graded certification levels.

An organisation either demonstrates conformity with the certification requirements for its defined scope or it does not.

However, the certification journey normally includes different audit stages and ongoing reviews. The evidence expected at each point can vary because the auditor’s purpose changes.

Stage 1 focuses strongly on readiness and the design of the management system.

Stage 2 focuses on implementation and effectiveness.

Surveillance audits then examine whether the ISMS continues to operate and improve.

A recertification audit reviews the system again as the certification cycle renews. UK certification providers commonly describe the certification cycle as Stage 1, Stage 2, surveillance activity and later recertification.

How the Certification Works

For initial certification, certification bodies commonly use a Stage 1 and Stage 2 process.

Stage 1 evidence

At Stage 1, the auditor reviews the design and readiness of the ISMS.

They will typically inspect core documented information, the scope, risk assessment arrangements, the SoA, internal audit activity and management review readiness.

The purpose is to determine whether the management system has reached a point where a full Stage 2 assessment makes sense.

UK certification providers describe Stage 1 as a review of readiness and documented arrangements.

Stage 2 evidence

At Stage 2, the focus moves much more heavily towards operation.

The auditor samples records, interviews employees, reviews controls and tests whether the organisation follows its own processes.

They may compare policies with technical settings.

They may select an employee and trace the joiner process.

They could examine a supplier and follow the security review process.

They may choose a risk and trace it through assessment, treatment, controls and monitoring.

Stage 2 therefore tests whether the ISMS works in practice rather than merely looking complete on paper.

After successful certification, surveillance audits normally take place during the certification cycle, with recertification following later.

Internal audit records matter

A certification auditor will expect your organisation to have conducted internal audits of the ISMS.

The internal audit process should provide objective information about whether the management system conforms to planned arrangements and the standard’s requirements.

Evidence can include:

• An internal audit programme
• Audit scope and criteria
• Auditor assignment records
• Audit reports
• Findings
• Corrective actions
• Follow-up records
• Evidence of auditor objectivity

Internal audit should not become a box-ticking exercise.

A useful internal audit identifies weaknesses before the external auditor does.

The certification auditor may look closely at whether your internal audit programme covers the ISMS properly and whether the organisation acts on findings.

Some UK certification bodies explicitly expect organisations to have completed a management review and an internal audit cycle before the initial certification assessment progresses.

Management review must show active governance

Management review provides one of the clearest signals that leadership engages with the ISMS.

The auditor will usually want records showing that senior management reviewed the management system and considered relevant inputs.

Evidence may include discussion of:

• Previous review actions
• Changes affecting the ISMS
• Performance information
• Security objectives
• Audit results
• Interested party feedback
• Risk status
• Opportunities for improvement
• Resource needs

The output should show decisions and actions, not just attendance.

If every management review record says that everything is satisfactory and no action is ever needed, an auditor may question whether the review process has enough depth.

Security objectives need measurable evidence

ISO 27001 expects organisations to establish information security objectives at relevant functions and levels.

Auditors may ask how you measure progress.

Examples could include improving security update performance, reducing overdue risk actions, increasing training completion, improving incident response times or completing supplier reviews.

Evidence might come from dashboards, reports, action trackers and management review records.

Choose objectives that mean something to the business.

A large collection of metrics that nobody uses is less convincing than a small number of useful measures linked to security outcomes.

Competence and awareness need records

People play a major role in information security.

An auditor may ask how your organisation determines the competence required for relevant roles.

Evidence can include:

• Training records
• Professional qualifications
• Skills assessments
• Role descriptions
• Induction records
• Security awareness records
• Phishing exercise results
• Records of follow-up activity

The auditor may also interview employees.

They could ask staff how they report a security incident, where they find security policies or what responsibilities apply to their role.

This makes genuine awareness more important than simply collecting training certificates.

Document control should be visible

Your ISMS will contain controlled documents and records.

The auditor may look at whether current versions remain available, changes receive appropriate review, obsolete material does not create confusion and important records remain protected.

Evidence can include approval history, version history, document ownership, review dates and access controls.

An automated platform can make this easier because it can centralise current records and reduce uncertainty about which file represents the approved version.

UK Cyber Compliance states that its platform supports real-time progress tracking and can generate audit-ready evidence packs, risk reports and Statement of Applicability records.

Asset evidence helps connect risk to reality

Where asset management controls apply, auditors may review how you identify information and associated assets.

Evidence can include asset registers, ownership records, device management reports, software inventories, cloud service registers and information classification records.

Accuracy matters more than appearance.

If the asset register shows 80 laptops but your endpoint management system shows 110 active devices, expect questions.

Auditors often compare evidence from different sources to see whether the ISMS reflects the real environment.

Access control creates strong operational evidence

Access management often produces some of the clearest audit evidence because systems record what organisations actually do.

An auditor may sample:

• Joiner records
• Mover records
• Leaver records
• Access approvals
• Privileged account reviews
• Multi-factor authentication settings
• Group memberships
• Periodic access reviews
• Administrator role assignments
• Access removal evidence

The auditor may select an employee who recently left and ask when the organisation disabled their access.

They may also ask why a user holds privileged rights.

A written access policy needs to match system reality.

Supplier security deserves clear records

Modern organisations depend heavily on external service providers.

If relevant controls apply, the auditor may ask how you assess information security risk before onboarding suppliers and how you monitor important suppliers afterwards.

Evidence might include:

• Supplier risk assessments
• Due diligence records
• Security questionnaires
• Contract clauses
• Data processing agreements
• Service review records
• Supplier incident records
• Exit planning
• Cloud service assessments

The depth of assessment should reflect risk.

A supplier handling sensitive customer data deserves more attention than a low-risk supplier with no access to your systems or information.

Incident management evidence should tell the full story

Security incidents provide valuable evidence because they show whether the organisation can recognise, report, assess and respond to problems.

An auditor may ask to see your incident register and then sample individual incidents.

They may look for:

• Date and time
• How the incident was reported
• Initial assessment
• Ownership
• Containment actions
• Investigation
• Communication
• Recovery
• Lessons learned
• Follow-up actions

Having no recorded incidents at all can sometimes lead to questions, especially in a larger organisation.

The auditor may want to know whether the organisation truly had no events or whether staff simply do not report them.

Backup and recovery evidence should prove restoration

If backup controls apply, an auditor may ask more than whether backups run.

They may want evidence showing successful backup jobs, failed job handling, retention arrangements, access restrictions and recovery testing.

A restore test provides strong evidence because it demonstrates that the organisation can recover information rather than merely create backup copies.

Records should show what the organisation tested, when the test happened, the result and any actions that followed.

Vulnerability and update records can be important

Where relevant technological controls apply, auditors may review vulnerability management and security update processes.

Evidence can include:

• Vulnerability scan reports
• Security update dashboards
• Remediation tickets
• Exception approvals
• Risk acceptance records
• Unsupported software records
• Review schedules
• Evidence of completed actions

The auditor does not expect every organisation to use the same technical platform.

They do expect the chosen process to work.

Logging and monitoring should support your risk decisions

If logging and monitoring controls apply, the auditor may ask how you capture relevant events and what happens when monitoring identifies something unusual.

Evidence might come from a SIEM, endpoint security platform, cloud audit logs, firewall logs or another monitoring service.

The auditor may ask who reviews alerts, how incidents get escalated and whether the organisation retains records for an appropriate period.

A dashboard full of alerts does not prove effective monitoring if nobody responds to them.

Physical security still matters

ISO 27001 covers information in more than digital systems.

Depending on scope and risk, the auditor may inspect office security, secure areas, visitor processes, equipment protection, clear desk practices, disposal arrangements and environmental safeguards.

Evidence may include visitor records, access card reports, secure disposal records, office inspection records and maintenance evidence.

For remote-first organisations, the auditor may instead focus more heavily on how the organisation manages equipment and information outside a traditional office.

Legal and regulatory evidence needs ownership

An auditor may ask how your organisation identifies legal, regulatory and contractual information security obligations.

For a UK business, relevant requirements may include data protection law, sector obligations, customer contracts, confidentiality commitments and intellectual property requirements.

Evidence can include a legal and regulatory register, contract review records, compliance reviews, assigned owners and updates.

The important point is that the organisation should know which obligations apply and who monitors them.

Corrective action evidence shows maturity

Auditors do not expect a management system to have no problems.

They do expect the organisation to respond properly when problems arise.

If an internal audit, incident, customer complaint or management review identifies a weakness, the auditor may ask what you did about it.

Strong evidence shows:

• The issue
• Immediate correction where necessary
• Root cause consideration
• Corrective action
• Responsibility
• Completion date
• Effectiveness review

Repeated findings can signal that the organisation treats symptoms rather than causes.

Show what changed

Closing a corrective action should mean more than changing its status to complete.

The auditor may ask what changed because of the action.

Perhaps you changed a process.

Maybe you added an automated control.

You might have retrained employees.

You could have changed ownership or introduced additional monitoring.

Evidence showing the result helps demonstrate continual improvement.

Evidence should connect across the ISMS

The best audit evidence rarely sits in isolation.

Imagine a supplier risk.

The supplier appears in your interested parties or supplier records. The risk assessment identifies the information security concern. The risk treatment plan selects an action. The SoA identifies relevant controls. The contract contains appropriate clauses. A supplier review later checks performance. Management then reviews significant issues.

That chain gives the auditor confidence that your ISMS operates as a connected system.

An automated platform can help by linking risks, controls, evidence, responsibilities and review activity in one place.

Which UK-based firms offer ISO 27001 consultancy services?

Many UK firms provide ISO 27001 consultancy, readiness support, gap assessments and implementation guidance.

When choosing support, look at whether the provider understands ISO/IEC 27001:2022, risk assessment, the SoA, internal audit, management review, evidence preparation and the certification process.

Also check whether the service helps you build a management system that can continue after the initial audit.

UK Cyber Compliance combines guided workflows, risk management, policy generation, progress tracking and audit-ready evidence functions through its online platform. Its website states that the platform supports ISO 27001 compliance work with AI-powered automation, risk management and audit-ready documentation.

UK Cyber Compliance is also identified on its website as part of UK Cyber Security Group.

Keep evidence current rather than creating it at the last minute

Auditors can usually distinguish between a management system that operates throughout the year and one assembled shortly before assessment.

Current records make a major difference.

Review risks when the business changes.

Record incidents when they occur.

Complete access reviews on schedule.

Track corrective actions.

Review suppliers according to risk.

Update policies when needed.

Run internal audits properly.

Hold meaningful management reviews.

Monitor objectives.

These activities create a natural evidence trail.

The UK cyber risk makes evidence-based security increasingly valuable

The UK Government’s Cyber Security Breaches Survey 2025/2026 found that 43 per cent of UK businesses identified a cyber security breach or attack during the previous 12 months, representing around 612,000 businesses.

The figure rose to 65 per cent for medium businesses and 69 per cent for large businesses. Among organisations that identified a breach or attack, 29 per cent of businesses said incidents occurred at least weekly.

The same government research found that phishing affected 38 per cent of businesses, while 19 per cent of businesses had experienced at least one cyber crime during the previous 12 months.

These figures help explain why customers increasingly want evidence of structured information security rather than broad claims about being secure.

ISO 27001 gives organisations a recognised framework for managing that risk, while certification adds independent assessment.

What should you have ready before the auditor arrives?

A practical audit evidence pack could include:

• ISMS scope
• Information security policy
• Context and interested party records
• Information security objectives
• Risk assessment method
• Current risk assessment
• Risk treatment plan
• Statement of Applicability
• Key policies and procedures
• Competence and awareness records
• Internal audit programme and reports
• Management review records
• Corrective action records
• Monitoring results
• Incident records
• Supplier security records
• Access review evidence
• Asset records
• Relevant technical evidence
• Legal and regulatory records
• Records showing continual improvement

Do not treat this as a fixed checklist that applies identically to every organisation.

The auditor will sample evidence according to your scope, risks, processes and selected controls.

The strongest preparation comes from understanding why each record exists and being able to explain what it demonstrates.

Make the audit easier by making evidence easy to follow

Good organisation saves time during an audit.

Use clear names for records.

Assign owners.

Keep current versions accessible.

Link actions to risks.

Link controls to evidence.

Track review dates.

Keep completed records rather than relying on verbal statements.

If the auditor asks for evidence of an access review, you should be able to find it quickly.

If they ask how a risk led to a control, the relationship should make sense.

If they ask how management knows the ISMS performs effectively, your metrics, reviews and audit records should provide the answer.

Do not assume every Annex A control must apply

One important ISO 27001 principle often causes confusion.

Annex A provides a reference set of 93 controls, but organisations should select controls according to risk and the requirements identified through their ISMS.

The SoA records which Annex A controls apply and why.

An organisation can justify excluding an Annex A control when the control does not apply to its circumstances, provided its risk treatment process remains adequate and all applicable requirements receive appropriate treatment.

This is another reason the risk assessment, risk treatment plan and SoA need to align.

Simply marking every control as applicable does not necessarily create a stronger ISMS.

Expect the auditor to sample rather than inspect everything

Auditors normally use sampling.

They cannot examine every user account, supplier, security event, device, risk and training record during a limited audit period.

Instead, they select examples.

That creates an important lesson for preparation.

Do not make only a handful of records audit-ready.

Your normal process needs to work consistently.

If the auditor chooses a random leaver, the account closure process should show appropriate action.

If they select a random supplier, the supplier assessment process should make sense.

If they select a recent security incident, the incident record should show how the business handled it.

Consistency gives the auditor much more confidence than a few carefully prepared examples.

Employees may become part of the evidence

Auditors do not only speak to the ISMS manager.

They may interview employees from HR, IT, operations, management, finance or other relevant functions.

Questions usually relate to what people actually do.

An employee might receive questions about reporting suspicious email.

HR might need to explain joiner and leaver activity.

IT may need to demonstrate access control or vulnerability management.

Senior management may need to explain information security priorities and governance.

The objective is not to catch employees out.

Interviews help confirm that the management system reaches the people who need to use it.

Your evidence should tell one consistent story

Conflicting information creates unnecessary audit questions.

Imagine that your policy says administrator access receives review every quarter.

Your procedure says it happens every six months.

The last recorded review happened nine months ago.

An auditor will immediately want to understand the discrepancy.

Consistency across policies, procedures, records and technical systems matters.

The same principle applies to risk scores, asset records, supplier reviews and employee training.

Your platform or evidence repository should make it easy to see the current position.

Automation can help, but human ownership still matters

Automation can significantly reduce the administrative burden of ISO 27001.

It can help organisations maintain risk registers, generate documents, track actions, collect evidence, monitor completion and produce reports.

AI can also help teams draft policies, identify gaps and organise information more efficiently.

However, the organisation still owns its ISMS.

An auditor may ask why you selected a control.

They may ask a risk owner to explain a decision.

Senior management may need to discuss objectives.

An employee may need to describe an operational process.

Technology can organise evidence and guide work, but people still need to understand the security decisions behind it.

UK Cyber Compliance’s platform combines automation with guided compliance workflows, risk analysis, control coverage and audit reporting to help organisations maintain that evidence trail.

The auditor is looking for confidence, not paperwork for its own sake

The central question behind most ISO 27001 audit activity is simple: does the organisation manage information security in a controlled, repeatable and risk-based way?

Documents matter because they define and record the management system.

Operational evidence matters because it proves that people follow it.

Interviews matter because they reveal whether employees understand their responsibilities.

Technical records matter because they show whether controls operate.

Internal audits, management reviews and corrective actions matter because they demonstrate that the organisation checks itself and improves.

This is why audit preparation should focus on a coherent evidence trail rather than producing the largest possible document library.

UK Cyber Compliance can support this process through an automated and AI-driven platform that brings together risk assessment, policies, control tracking, Statement of Applicability records and audit evidence.

For organisations working towards ISO 27001, the goal should be straightforward: make information security part of normal business management, keep reliable evidence of what you do and ensure that the records tell the same story as the real organisation.

When that happens, the certification audit becomes much easier to navigate because the evidence already exists as a natural result of running the ISMS properly.

UK Cyber Compliance is here to help

For more information, please do get in touch.

Please check out our Free Cyber Insurance

Other blog posts, Your ISO 27001 Questions Answered, Get ISO 27001 Certified ,

If you would like to know more, do get in touch as we are happy to answer any questions. Looking to improve your cybersecurity but not sure where to start? Begin by getting certified in Cyber Essentials, the UK government’s scheme that covers all the technical controls that will provide the protection that you need to help guard against criminal attacks.