A customer forwards a tender requirement asking for Cyber Essentials or Cyber Essentials Plus. You already manage their devices, Microsoft 365 tenant, firewalls and patching. You can implement the controls and gather the technical information, but you need an independent licensed Certification Body to assess their submission and, where required, carry out the technical audit.
The answer should not be handing the customer over to a competing IT provider.
Malwise Cyber Ltd works with managed service providers (MSPs), outsourced IT teams and technology consultancies to provide independent certification and security testing, while you retain the client relationship. You do the day-to-day management and remediation; Malwise carries out the agreed assessment or test.
This guide explains how the partnership works, what you can prepare for clients, what both certifications cost and how external penetration testing and attack surface mapping can extend your security offering.
Can an MSP complete Cyber Essentials for a client?
An MSP can prepare and support the application, but the client remains responsible for its declaration.
As the client’s IT provider, you will often be best placed to answer the technical questions accurately. Your engineers understand which operating systems are in use, how multi-factor authentication is applied, what firewalls protect the environment and how updates are deployed.
A sensible division of responsibility is:
- Your MSP: technical discovery, evidence gathering, preparation, security configuration and remediation.
- Your client: decisions on scope, accuracy of the answers and sign-off by an authorised board member or equivalent.
- Malwise: independent assessment as an IASME-licensed Certification Body and, if commissioned, the Cyber Essentials Plus technical audit.
A third-party IT provider helping with the questionnaire does not transfer accountability for the answers away from the organisation being certified.
Why use an independent Cyber Essentials partner?
Many MSPs already perform much of the work needed to keep a client ready for certification. But managing security controls and independently assessing them are different roles.
Working with a dedicated certification partner means you can:
- Protect your commercial relationship. The client continues to use your team for support, administration and remediation.
- Offer formal certification. You can support a recognised assurance requirement without becoming a licensed Certification Body yourself.
- Keep responsibilities clear. The assessor reports against the scheme requirements; your engineers resolve technical issues in the managed environment.
- Meet customer deadlines. Scoping, questionnaire completion and any Plus testing can be planned together.
- Add independent security testing. Where appropriate, external penetration testing and attack surface mapping can be quoted as separate services.
Malwise’s partner proposition is deliberately focused on independent assurance. We do not sell managed helpdesk support, infrastructure management or IT procurement to replace your MSP. If required, we can agree appropriate non-solicitation and confidentiality terms before you introduce a customer.
How does the Malwise MSP partnership work?
There are two ways to work together, depending on how you want to manage the customer relationship and invoices.
Option 1: Referral, with Malwise contracting directly
You refer a client to Malwise for a defined certification or testing requirement. We provide the assessment, quotation and reporting, while keeping your team involved in preparation and remediation with the client’s permission.
This approach suits MSPs that want an independent partner without incorporating the assessment fee into their own service invoice.
Option 2: Delivery through your MSP
You contract with Malwise for a defined service and present it to the client within your wider proposal or managed services relationship. The commercial arrangement can sit with you, but the Cyber Essentials certificate must identify the certified client and the licensed Certification Body.
Certification cannot be represented as a certificate issued by an unlicensed MSP, even where the MSP manages the project and invoices the customer.
Discuss an MSP partnership with Malwise. You can initially share the approximate client size, service required and deadline without disclosing the client’s name.
Cyber Essentials and Cyber Essentials Plus prices for MSP clients
Malwise publishes transparent certification pricing. The Cyber Essentials assessment is based on IASME’s organisation-size fee. Cyber Essentials Plus is a separate technical audit. A new applicant requiring both normally pays the Cyber Essentials assessment fee plus the Plus audit fee.
| Client size | Employees | Cyber Essentials | Plus audit only | Both, new applicant |
|---|---|---|---|---|
| Micro | 0 to 9 | £320 | £1,095 fixed | £1,415 |
| Small | 10 to 49 | £440 | £1,395 fixed | £1,835 |
| Medium | 50 to 249 | £500 | From £1,750 | From £2,250 |
| Large | 250+ | £600 | From £2,500 | From £3,100 |
All figures are exclusive of VAT. Prices reflect Malwise’s published service pages as at 12 November 2026. Medium and large Plus audits are subject to scope. Optional preparation support, technical remediation, additional testing and travel are quoted separately where applicable.
Do clients always need to pay for both assessments?
No. If a client already holds a suitable Cyber Essentials certificate, it may be possible to undertake the Plus audit without paying for another Cyber Essentials assessment. The Plus audit must, however, be completed within three months of the qualifying Cyber Essentials certification, and the certificate date and scope must be checked before booking.
This is why the table separates Cyber Essentials, Cyber Essentials Plus audit only and the total for a new applicant. You can give a client a useful budget figure without charging twice for an assessment they may already have.
For the current service details, see Cyber Essentials pricing and Cyber Essentials Plus pricing.
How should your MSP prepare a Cyber Essentials client?
Start with the actual environment, not just the devices showing in your remote monitoring and management platform. Clients may use personally owned devices, cloud services not purchased through you or infrastructure maintained by other suppliers.
| Area | Questions your team should resolve |
|---|---|
| Scope and boundaries | Which legal entities, users, sites, networks and systems form part of the assessment? Are any exclusions appropriately defined? |
| Endpoints and servers | Are in-scope operating systems supported and securely configured? Are mobile devices and remote working included? |
| Cloud services | Which services hold or process organisational data? Is multi-factor authentication applied in accordance with the scheme requirements? |
| Firewalls and remote access | Are internet-facing services justified? Are firewall rules and administrative access controlled? |
| User accounts | Are privileged accounts limited, approved and separated from normal user activity where required? |
| Security updates | Are supported applications, browsers and operating systems kept patched within the required timescales? |
| Malware protection | Is a scheme-accepted protection method configured on every relevant device? |
| Client declaration | Has a board member or equivalent reviewed the answers and accepted responsibility for their accuracy? |
The scope must reflect how the client actually operates. For example, if a user accesses work email on a personal laptop, you need to assess whether the device falls within the scheme requirements. A neatly maintained corporate asset list alone does not resolve that question.
For more detail, read Cyber Essentials scope: devices, cloud and remote work.
What extra work does Cyber Essentials Plus require?
Cyber Essentials is a verified self-assessment. Cyber Essentials Plus independently checks a representative sample of the systems against the scheme’s prescribed technical test specification.
That means your engineers may need to make sampled devices available and assist with technical access, while the assessor verifies items such as patching, malware protection, account controls and other in-scope requirements.
For an MSP, the practical preparation is usually:
- Make sure the whole estate follows the required patching and security configuration standards, not only the devices expected to be tested.
- Confirm the Cyber Essentials certification date so that Plus can be completed within its three-month window.
- Arrange an appropriate client contact and technical administrator for the testing period.
- Check that the client’s self-assessment answers accurately describe the environment before testing begins.
- Leave room in the timeline for findings, remediation and any follow-up permitted by the scheme.
See Malwise’s Cyber Essentials Plus audit preparation guide for more detail.
What if the assessment identifies non-compliance?
An assessment is useful only if the result is understandable. The assessor must identify what does not meet the applicable scheme requirements, rather than simply saying the organisation needs to improve its cyber security.
Where corrections or retesting are permitted, the arrangements must follow the scheme rules and the agreed service scope. The client remains responsible for the certification declaration. Your MSP normally completes the technical remediation, and Malwise independently reviews or retests as appropriate.
For your customer, this preserves a single accountable IT support relationship with an additional layer of independent assurance.
Beyond certification: external penetration testing for MSP clients
Cyber Essentials Plus checks a defined set of security controls. It is not a full penetration test and it does not necessarily establish whether an attacker could compromise a particular public-facing service through an exploitable weakness.
That gap creates a useful additional service for MSPs managing business-critical external infrastructure.
An external penetration test may cover an agreed set of:
- Public IP addresses and externally exposed hosts.
- VPN and remote access gateways.
- Internet-facing management portals and network appliances.
- Public web services and supporting infrastructure.
- Other customer-owned or explicitly authorised targets.
Malwise uses a scoped, manual testing approach supported by appropriate tooling. A penetration-testing engagement establishes the authorised targets, exclusions, objectives and rules of engagement before testing begins. The resulting report should distinguish confirmed vulnerabilities from lower-confidence observations, describe potential impact and provide practical remediation guidance.
Malwise’s published rate is £800 + VAT per tester-day, with a two-day minimum of £1,600 + VAT. The actual test duration depends on the number and complexity of targets. A small external network assessment is not the same as a complex authenticated web application test.
For the MSP, this is straightforward: Malwise tests and reports; your engineers can remediate the findings for the customer.
Request an external penetration-testing quote.
Attack surface mapping: do you know everything your client exposes?
A client may confidently tell you that it has one firewall, a website and a VPN. But what about a legacy subdomain, an old cloud instance, an unused remote access service or an application that a former supplier left running?
External attack surface mapping helps answer a different question from a penetration test: what internet-facing assets appear to be associated with the organisation, and which of them are actually within its control?
Depending on the agreed scope, a discovery exercise can examine:
- Registered domains and relevant subdomains.
- Public IP address ranges and externally reachable services.
- DNS records and TLS certificate information.
- Public-facing web applications, portals and remote access systems.
- Cloud-hosted endpoints and potential legacy exposures.
- Changes in the externally visible estate over time.
Discovery is followed by validation. A domain name, IP address or certificate association does not by itself prove the customer owns the asset, and discovering a service does not establish that it is vulnerable. Active security testing should only be carried out where the necessary permission has been established.
For MSPs, attack surface mapping can be useful when onboarding a client, reviewing acquisitions, preparing for an external penetration test or checking whether untracked assets have appeared since the last assessment.
One-off mapping or ongoing monitoring?
A one-off attack surface review establishes an initial picture of externally visible assets. An ongoing programme checks for changes, validates relevant findings and supports vulnerability prioritisation. Malwise can scope this alongside vulnerability management services.
Pricing depends on the number of organisations, domains, IP ranges, required validation and reporting frequency. We quote the work after agreeing the scope rather than advertising a fixed price that may not match the environment.
Ask Malwise about external attack surface mapping.
How can an MSP package these services for customers?
A useful approach is to separate the work into services with a clear purpose, rather than describing everything as a generic “cyber security assessment”.
| Client need | Appropriate service | Typical deliverable |
|---|---|---|
| Needs to satisfy a contractual baseline requirement | Cyber Essentials | Verified self-assessment and certificate on a pass |
| Needs independent evidence the baseline controls work | Cyber Essentials Plus | Prescribed technical audit and certificate on a pass |
| Wants to understand internet-facing assets | External attack surface mapping | Validated asset and exposure inventory with prioritised observations |
| Wants to understand how an attacker might get in | External penetration testing | Manually validated technical findings, exploitation evidence where appropriate and remediation guidance |
| Wants to track new exposures and vulnerabilities | Ongoing vulnerability management | Scheduled reviews, triaged findings and remediation tracking |
For example, your MSP can prepare a customer’s Cyber Essentials questionnaire, manage remediation and arrange Malwise’s Plus audit. Six months later, that same client may have launched a new customer portal. An external attack surface review can help identify what is publicly exposed, followed by a separately authorised penetration test if the risk warrants it.
Each service answers a different question. The customer receives clear deliverables, and your MSP retains ownership of the support relationship.
Frequently asked questions
Can an MSP complete the Cyber Essentials questionnaire?
Yes, you can prepare the answers using your knowledge of the client’s systems. The applicant must approve an accurate submission through an authorised board member or equivalent. An independent licensed assessor reviews the completed questionnaire.
Can we invoice the customer for Cyber Essentials Plus?
Yes, where agreed under a through-MSP commercial model. Malwise still performs the independent assessment, and the certificate must name the certified organisation and licensed Certification Body correctly.
Does Malwise offer managed IT support to our clients?
No. Malwise’s MSP partnership offering focuses on certification, security testing and independent assurance, rather than replacing your managed IT services.
Can you sign an NDA or a client non-solicitation agreement?
Yes. If your client relationship requires additional confidentiality or non-solicitation terms, discuss them with Malwise before sharing client details.
Do we need a penetration test if the client has Cyber Essentials Plus?
Not automatically. It depends on the client’s risks, contracts and objectives. The services answer different questions, and Cyber Essentials Plus is not a substitute for a scoped penetration test.
Can we arrange attack surface mapping without immediately booking a penetration test?
Yes. External discovery and asset validation can be commissioned on their own. A penetration test is a separate, explicitly authorised engagement, typically scoped after the relevant assets and objectives are agreed.
Will Malwise work with clients across the UK?
Yes. Malwise provides certification and appropriately scoped testing services to organisations throughout the UK, remotely where suitable and on-site by agreement.
We certify. You keep the client.
If one of your customers needs Cyber Essentials, Cyber Essentials Plus, external penetration testing or attack surface mapping, Malwise can help you deliver the independent assurance without handing over the day-to-day IT relationship.
Tell us the service required, approximate organisation size, deadline and preferred commercial model. We can discuss scope and pricing before you disclose the customer’s identity.
We certify. You keep the client.
Tell us the service required, the approximate organisation size, the deadline and which commercial model suits you. You do not need to name the client to get a scope and a price.