Cyber security health check, penetration test or Cyber Essentials?
By Sanderson Cyber Security · Published
These services answer different questions. Before booking, write down what you need to know or demonstrate: a sensible starting point for improvements, evidence about a particular system, or a named certification requested by a customer. The service should match that purpose.
A health check: understand your starting point
A Sanderson Security Health Check is a broad advisory review of the agreed business environment. It considers people, technology and processes, then sets out findings and priorities in a report. It can help an owner understand where to direct attention and what to discuss with an IT provider.
The scope can cover accounts, devices, networks, email and cloud services, data, backups, staff awareness, policies, physical security, incident response, suppliers and security management. The report is an action plan for the agreed scope, not proof that every possible weakness has been found.
A penetration test: investigate technical weaknesses
A penetration test examines agreed systems for exploitable weaknesses under explicit rules and written authorisation. Its scope might focus on a web application or a network rather than the wider business processes considered in a health check. The appropriate approach depends on the system and the assurance you need.
Sanderson does not currently offer penetration testing. If your customer or supplier asks for a penetration test, check the exact requirement and engage an appropriate specialist. Do not assume a health check meets a contractual testing requirement.
Cyber Essentials: a separate certification process
Cyber Essentials is a UK government-backed certification scheme focused on five technical controls. Certification follows the scheme's assessment process. Cyber Essentials Plus adds independent technical testing of those controls.
A Sanderson health check does not award either certification. If certification is your goal, consult the current NCSC guidance and an appropriate certification body. Confirm what your customer requires before deciding which route to take.
Questions to ask before choosing
A clear brief helps you compare quotations and avoid buying the wrong service.
- What decision will the findings help me make?
- Is someone asking for a specific test, standard or certificate?
- Which systems, locations and suppliers must be included?
- What permissions, access and possible disruption need to be agreed?
- What will I receive, and who will help me act on it?
Where Sanderson fits
For a small business in Thanet or Kent that wants to understand its current position, an on-site health check offers a practical starting point. Staff awareness training addresses a different need: helping people recognise common threats and use the organisation's reporting routes.
Tell Brian what prompted your enquiry. The scope, deliverables and price are agreed before work begins. If the requirement falls outside Sanderson's services, that should be clear before you book.