Why ALL Managed Service Providers Need Cyber Essentials.

Cyber Essentials is often looked at from the perspective of the Customer. They usually want to win a tender, need it for insurances purposes or want to have peace of mind about their cyber posture.

However, there is another side to this that doesn’t get talked about enough. Managed Service Provider (MSP’s) refer lots of their customers toward the Cyber Essentials and Cyber Essentials Plus certifications. They help them to get certified and improve their cyber posture so it only makes sense that MSPs should also hold themselves to the exact same standards.

Cyber Essentials and Cyber Essentials Plus for Technical Drive

Recently KIT365 completed Cyber Essentials and Cyber Essentials Plus for one of their key MSP partnerships, Technical Drive.

Technical Drive won’t sell something to their customers that they don’t believe in, and they certainly won’t recommend something they don’t do themselves. Alongside Cyber Essentials Plus, they also hold ISO 27001 and ISO 9001, and for them these aren’t optional extras. As they put it themselves:

“An MSP offering cybersecurity services to clients without holding Cyber Essentials Plus themselves is like a driving instructor who hasn’t passed their own test.”

That’s exactly the point. MSPs hold the keys to their clients’ IT environments, so expecting clients to take cybersecurity seriously while not holding yourself to the same standard doesn’t add up.

Having Cyber Essentials Plus means Technical Drive’s own environment has been independently, hands-on tested. Not just a self-assessment questionnaire, but full network vulnerability scans, firewall and server configuration checks, and a real look at how their teams access systems and SaaS platforms day to day. 

This isn’t something Technical Drive just talk about. It’s something they actively do, and something KIT365 get to see up close when they carry out their assessment.

A Three-Way Partnership

This is where KIT365’s partnership with Technical Drive comes in. Together, they provide something a little different. Technical Drive handles the technical relationship with their customers, the calls, the frontline support, the day-to-day IT environment. KIT365 provide the independent cyber certification oversight.

So, through the Cyber Essentials Process there are three separate companies, three separate roles, all working towards the same goal.

The Customer needs to understand and improve their cybersecurity. This might be for peace of mind, to tender for new work, for insurance purposes, or simply because they know it matters.

Technical Drive, the MSP, knows the customer’s IT environment inside out. They are the ones helping implement the controls and making sure everything is set up the way it should be.

KIT365 provides the independent assessment and certification. KIT365 are not involved in the day to day running of the IT environment, and that is exactly the point.

There’s a reason this independence matters so much. If Technical Drive assessed their own environment, they would essentially be marking their own homework. It’s easy to overlook something when you’re the one who built it and use it every day. That’s exactly why bringing in an external certification body makes such a difference. KIT365 check their work properly, and they get an honest picture of how they’re actually operating, not just how they assume they’re operating.

This is exactly what happened during their last assessment. KIT365 hands-on testing picked up on MFA settings that needed tightening across some third-party tools used by their digital and marketing teams. That’s the value of an independent set of eyes that KIT365 provide to Technical Drive. By bringing KIT365 into the process, Technical Drive gives their customers something valuable too, an objective, independent assessment. It also means Technical Drive’s own work is being tested along the way, giving everyone confidence that the customer’s IT environment is genuinely secure, not just assumed to be.

Why KIT365 Love Working With Technical Drive

KIT365 have worked with Technical Drive for about five years now, and in that time, a lot of mutual respect has been built up.

KIT365 know how Technical Drive work, and that makes a real difference. When KIT365 give advice or guidance, they know it won’t just sit in an inbox. Technical Drive take it and apply it, not just for themselves, but across all their customers too. That’s rare, and it’s exactly why the partnership works so well.

They also have resource purely dedicated to delivering the five technical controls, which says a lot about how seriously they take this. Having a key point of contact for cybersecurity means everything runs smoothly, communication is easy, and nothing gets lost between the certification side and the day-to-day technical work.

As Rob puts it:

‘Technical Drive are a pleasure to work with. There is a genuine level of mutual respect in this partnership, and when we provide guidance, we know it will be implemented properly across all of their customers and not ignored. Having a dedicated resource and a clear point of contact for cybersecurity makes a significant difference to how smoothly this partnership operates, making preparation, audits and remediation work run effectively, thus enhancing the customers experience of the auditing process.’ 

Stuart Adams, Technical Drive’s dedicated Cyber Essentials adviser, agrees:

‘When we started our advisor service, we knew we needed an independent and separate certification body to ourselves, to ensure the work we did for our clients received the appropriate level of scrutiny and challenge. Rob and the team at KIT365 have consistently supported us with advice, robust challenge and reassurance that is the bedrock of our mutual respect. Our relationship with KIT365 ensures that when our clients achieve their Cyber Essentials certifications, they are in a more secure position than before.’

Final Thoughts

Cyber Essentials works best when everyone understands their role in it. The customer, the MSP, and the certification body, all playing their part, all heading towards the same outcome.

Cyberattacks targeting supply chains have risen sharply, with smaller suppliers and service partners often used as the backdoor into much larger networks. Whether Technical Drive is supporting a manufacturer needing to demonstrate compliance to retain contracts, or a charity protecting confidential records, a verified security posture means they never become that weak link.

This really isn’t about ticking boxes but about businesses being genuinely secure, and about partnerships built on mutual respectdoing the work properly, together.

KIT365 are proud to work alongside Technical Drive and are looking forward to sharing more of how this partnership works in practice.