Martin Hopkins has renewed its Cyber Essentials certification for another year. Here’s what that means, why a creative agency bothers with a government-backed security standard, and why it matters to the clients who trust us with their brand and their data.
The short answer
Cyber Essentials is a UK government-backed certification scheme, developed by the National Cyber Security Centre (NCSC) and delivered by IASME. It verifies that an organisation has five fundamental technical controls in place to protect itself against the most common cyber attacks.
We hold it because we handle client material that isn’t ours to lose: unreleased brand identities, pre-launch product artwork, commercially sensitive property information, customer data inside the websites we build, and login credentials for platforms our clients depend on. Certification is the evidence that we look after all of it properly, not a promise that we do.
Why a design agency needs to take security seriously
There’s a persistent assumption that cyber security is an IT company’s problem. It isn’t. Creative agencies sit at an unusually attractive intersection for attackers:
- We hold pre-release information. Rebrands, acquisitions, new developments and product launches all pass through us months before they go public.
- We have access to client systems. CMS logins, hosting environments, DNS records, analytics, social accounts and email platforms.
- We build and maintain live websites. A compromised website is a direct route to a client’s customers and their reputation.
- We’re a supply chain link. Attackers routinely target smaller suppliers as a way into larger organisations. It’s one of the most common patterns in UK breach reporting.
If an agency is careless, the damage doesn’t stop at the agency. It lands on the client.
What Cyber Essentials actually covers
The scheme is built around five technical controls. They sound simple; applying them consistently across every device and cloud service an organisation uses is where the real work sits.
- Firewalls – securing the boundary between our systems and the internet, including properly configured firewalls on every device.
- Secure configuration – removing default accounts, unnecessary software and weak settings that ship with new hardware and software.
- User access control – making sure people only have access to what their role requires, with administrator rights tightly restricted and multi-factor authentication enforced.
- Malware protection – active, maintained protection across all in-scope devices.
- Security update management – applying critical and high-risk security updates promptly, across everything, without exception.
Certification is assessed annually. It isn’t a badge you earn once and forget about, which is precisely the point – the threat landscape changes, so the evidence has to be renewed.
The bar keeps rising, and that’s the point
Cyber Essentials is reviewed every year by the NCSC and IASME, because the threats it defends against don’t stand still. Our current certification was completed under the Willow question set. From 27 April 2026, the scheme moved to a new question set, Danzell, running alongside version 3.3 of the Requirements for IT Infrastructure – so that’s the standard our next renewal will be assessed against.
The five core controls are unchanged. What’s changing is how rigorously they’re assessed:
- Stricter marking on critical controls. Failures on multi-factor authentication and timely security updates now result in an automatic fail of the assessment.
- Tighter scoping. Any organisational device connected to the internet is in scope. Cloud services that store or process business data — including SaaS platforms — can no longer be excluded.
- Evidence over assumption. The question set asks for more detail and leaves far less room for vague or theoretical answers. Organisations have to show controls working in practice.
We’re already working to the tighter requirements rather than waiting for the assessment to force it. That’s the honest value of an annually renewed certification: it gives you a deadline to keep improving against, instead of a badge you earn once and quietly stop thinking about.
What this means if you’re our client
Your procurement process gets simpler. Cyber Essentials is a mandatory requirement for many UK public sector contracts and an increasingly standard question in private sector supplier due diligence. If you’re in financial services, healthcare, public sector or corporate real estate, your compliance team is going to ask. We can answer immediately.
Your data is handled to a verified standard. Access to your systems is controlled, logged and limited to the people who need it. When a project ends or a team member moves on, access is removed.
The websites we build start from a secure baseline. Secure configuration and update discipline are habits, not one-off tasks. The same standards we apply internally shape how we build, host and maintain client sites.
We’re a lower-risk link in your supply chain. If your own security posture depends partly on your suppliers, and it does – this is one fewer gap to worry about.
Why we did it for ourselves first
Honestly, the client-facing benefits came second. The first reason was straightforward: we didn’t want to be the agency that lost a client’s work, or the one whose compromised account was used to reach somebody else.
Going through certification forced us to document things we’d been doing informally, fix a few things we’d been meaning to get to, and build a proper annual rhythm around reviewing them. That’s the real value. The certificate is the by-product.
We ask our clients to invest serious money in their brand and their digital presence. Protecting that work is part of the job.
Frequently asked questions
Cyber Essentials is a UK government-backed certification scheme developed by the National Cyber Security Centre and delivered by IASME. It verifies that an organisation has five fundamental technical controls in place – firewalls, secure configuration, user access control, malware protection and security update management – to defend against the most common cyber attacks.
Creative agencies hold pre-release brand work, commercially sensitive client information, and privileged access to client websites, hosting and marketing platforms. Certification provides independent verification that this material and access are managed to a recognised national standard, and reduces supply chain risk for the client.
No. Cyber Essentials focuses on five specific technical controls and is assessed annually through a verified self-assessment. ISO 27001 is a broader international standard covering an entire information security management system, and requires external audit. Cyber Essentials is often a practical first step and is the standard most commonly named in UK procurement.
Annually. Each certification is valid for twelve months, after which the organisation must be reassessed against the current version of the scheme.
If you work in the public sector, financial services, healthcare or regulated industries, your procurement or compliance team will very likely require it of suppliers who handle your data or access your systems. Even where it isn’t mandatory, it’s a reasonable question to ask any agency you’re about to hand your website credentials to.
From 27 April 2026, new assessments use the Danzell question set alongside Requirements for IT Infrastructure v3.3. It replaced the Willow question set and introduced stricter marking, tighter scoping and greater evidence requirements.
Working with a certified agency
Martin Hopkins is a Cardiff-based brand and website design agency working with clients across the UK, including in financial services, public sector and commercial property, sectors where supplier security isn’t optional.
If you’re evaluating agencies and security sits on your checklist, we’re happy to share our certification details as part of the conversation.
