Cybersecurity 23 May 2026 3 min read Cyber Essentials, certified By Old Forge Technologies 28 reads Contents There's a moment, partway through a Cyber Essentials assessment, where you stop describing what your systems *should* do and start proving what they actually do. That moment is the whole point of the certification - and as of this week, Old Forge Technologies has passed it. ## What Cyber Essentials actually is It's a UK government-backed scheme, run by IASME, that audits five technical control areas: firewalls, secure configuration, user access control, malware protection, and patch management. Each one has a specific, testable definition. You don't pass by writing a policy that says "we patch promptly" - you pass by showing that the patches are, in fact, on the machines. For a one-person consultancy that handles client environments, AI workloads, and identity infrastructure, that distinction matters. Every control falls to me. There is no security team to delegate to, no compliance officer to interpret a clause. Either the laptop's disk is encrypted or it isn't. Either the public-IP services have MFA in front of them or they don't. ## What the audit surfaced The useful part of any audit is the gap between what you *think* is true and what is. A few things I tightened while preparing: - **The inventory got honest.** I had a rough idea of which hosts ran what. After the audit, I had an exact list, current to the day, with patch status and owner. - **Default-deny crept further out.** Some internal services were reachable from segments that didn't need them. They aren't anymore. - **Identity is now the perimeter.** Every public surface - this site's admin panel, the product portfolio, internal tooling - sits behind a single Keycloak realm with MFA enforced. The audit forced me to write that down as a *principle*, not a habit. None of these are revelations. They're the kind of hygiene anyone in security knows about. The audit just made me prove them on a specific date for a specific scope. ## Why it matters for clients When I tell a prospective client that their data is handled correctly, "trust me" is not a strong opening move. A Cyber Essentials badge isn't a substitute for a serious conversation about threat models - but it *is* a third party confirming that the basics aren't being skipped. That's a different starting point. The certificate is verifiable on the [Blockmark registry](https://registry.blockmarktech.com/certificates/11f0ad4a-e333-4449-bd09-520f04a31c5f/?share_key=2OKIz0hNtH4bq4I_aq_aJ1jospH0R2MRGQQ88o_IcZw); the badge in the Imprimatur band on the home page links straight to it. No screenshot of a logo - the actual record. ## What's next Cyber Essentials Plus is the same five controls, verified by hands-on testing rather than self-attestation with audit. That's the next step, and the work I did this month is most of what's needed for it. I'll write again when it's done. Until then: the basics are in writing, and the writing is on record.
