Frameworks
Win UK contracts with Cyber Essentials certification
Bidding for UK public sector work or supplying UK customers without Cyber Essentials closes doors before the conversation starts.
Tidal makes certification straightforward. Implement the five technical controls, keep the scope and evidence current for the annual renewal, and prepare for the hands-on test of Cyber Essentials Plus.
These companies run their compliance on Tidal Control
Cyber Essentials in depth
Cyber Essentials certifies a defined scope: the whole organisation or a well-separated part of it, with every device, account and cloud service in it. Devices used to access organisational data, including bring-your-own devices, are in scope too.
A scope that is drawn too narrowly is the most common reason a certificate does not mean what customers think it means, and an unclear boundary is the most common reason an assessor asks for more information.
In Tidal the scope is a list of assets and services with an owner, so the boundary is written down and changes to it show up before the renewal.
How Tidal helps you get certified
Hit the ground running
Start with our pre-built controls, policies, and risk assessment templates.
Our platform guides you through establishing your ISMS scope, identifying assets, and implementing right-sized controls that match your business needs.
Why Tidal Control
We understand your challenges because we've been there. Our team of GRC experts and security professionals built Tidal to solve the real problems compliance teams face every day.
Made in Europe
Built and hosted in Europe. Your compliance data stays in the EU for full control and peace of mind.
Continuous automation
Automated evidence collection from cloud providers and development tools working 24/7 for you.
Real security
Build secure systems that protect your business and satisfy auditors, not just check compliance boxes.
Go beyond Cyber Essentials
Explore frameworks that build on the five technical controls.
ISO 27001
Ready for a full management system? ISO 27001 builds on the Cyber Essentials controls with risk management, governance and continual improvement.
CIS Controls
Want prioritised technical safeguards beyond the five controls? The CIS Controls extend asset, vulnerability and logging management.
GDPR
Processing personal data of UK or EU residents? The technical controls of Cyber Essentials support the security of processing that data protection law requires.
NIST CSF
Selling to US customers as well? The NIST Cybersecurity Framework gives a common structure that maps onto the Cyber Essentials controls.
Integrate with your existing tools
Testimonials
What our customers say
With a single click, one Tidal test checks dozens of disks for encryption. Doing that manually would take a lot of time.
Frequently asked questions
Cyber Essentials is a UK government-backed certification scheme, run by the National Cyber Security Centre (NCSC) and delivered through IASME and its certification bodies. It certifies that an organisation has five technical controls in place that protect against the most common internet-based attacks: firewalls, secure configuration, security update management, user access control and malware protection.
Both levels assess the same requirements. Cyber Essentials is a self-assessment questionnaire that a certification body verifies. Cyber Essentials Plus adds a hands-on technical audit, in which an assessor tests a sample of your devices and accounts. That is why Tidal has one Cyber Essentials framework for both levels: the requirements do not change, only how they are verified.
Tidal uses the NCSC Requirements for IT Infrastructure v3.3, published in April 2026. It holds the requirements under the five controls plus the scoping and cloud service requirements, 42 in total. Because the NCSC publishes the scheme in English and Welsh, the framework is available in English only.
UK central government requires Cyber Essentials from suppliers on contracts that involve handling sensitive and personal information or providing certain technical products and services. Many other UK organisations, including the Ministry of Defence supply chain, ask for it too. Organisations outside the UK can certify if they supply UK customers.
A Cyber Essentials certificate is valid for 12 months. Tidal keeps the scope, the device list and the evidence for each requirement current throughout the year, so the renewal questionnaire is answered from records you already have.
Yes. Cloud services you use, whether infrastructure, platform or software as a service, are in scope when they hold or process your organisation's data. The requirements set out which controls you are responsible for and which the provider is. Tidal records that split per service, together with the multi-factor authentication the scheme requires for cloud services.