Free first call
What you actually need, and whether we can help.
Harrow and UK-wide · Small businesses
Cyber Essentials
Cyber Essentials
is five controls.
Firewalls, secure configuration, access control, malware protection and patching. Not a product, not a subscription — five things that mostly need doing rather than buying.
- 2016trading since
- UKregistered company
- CEreadiness
- Freefirst call
What we do
Four services, aimed at the actual risks
Certification is issued by a licensed Certification Body. We prepare you for it and refer you to one.
Cyber Essentials readiness
Preparing an organisation against the five technical controls the scheme assesses.
See the programSecurity review and patching
Reviewing patching, accounts, administrator rights and the things left switched on.
See the programBackup and recovery testing
Testing that a backup actually restores, and how long a real recovery would take.
See the programStaff training and phishing
Short practical training and phishing simulation, run to encourage reporting.
See the program
How it works
How we work
Fix configuration before buying products, test the restore, prepare for certification, and never promise safety.
Fixed scope and fee
Agreed in writing before work starts.
Configuration first
Most gaps need doing, not buying.
Certification referred
To a Certification Body licensed by IASME.
Working together
Ways to work with us
Fixed scope and fee. We issue no certificates and guarantee no outcome, because nobody honestly can.
Security review
An honest look at patching, accounts and admin rights.
- Leaver accounts found
- Admin rights separated
- Patching made routine
- Unsupported software named
- Short written report
Cyber Essentials readiness
Prepared properly against the five controls.
- Device inventory built
- Gap list against each control
- Fixes mostly configuration
- Told honestly if not ready
- Referred to a licensed certifier
Backup & training
Restore testing and staff sessions.
- Restore tested in front of you
- Offline copy verified
- Honest recovery time
- Phishing run to build reporting
- First-hour incident drill
Every engagement is quoted after a free consultation. No subscription.
How we work
A UK firm, and we issue no certificates
TN Amazonia Ltd is a private limited company registered in England and Wales under company number 10093706, incorporated in March 2016, with its registered office at Laxmi House 2-B Draycott Avenue, Kenton, Harrow HA3 0BU.
Three limits stated plainly. Cyber Essentials certification is issued only by a Certification Body licensed by IASME — we prepare organisations and refer them, and we do not issue or guarantee certificates. No measure removes risk, so we give no warranty that you will not suffer an incident; an assessment reflects the configuration we saw on the day. And you remain the data controller for your own data: a reportable breach must be notified to the ICO without undue delay and within 72 hours where feasible, and we can help with the technical investigation but cannot discharge that duty for you.
Frequently asked
The questions we get most
Can you certify us for Cyber Essentials?
No. Certification is issued by a Certification Body licensed by IASME. We prepare you against the five controls and refer you to one — and if you are not ready we will say so rather than putting in an assessment that fails.
What do we need to buy?
Usually less than you expect. The commonest failures are unsupported software still in use and everyone running as administrator, and neither is fixed by a purchase. We work through configuration first.
Will this stop us being hacked?
No, and nobody can promise that. Good controls make an incident much less likely and far less damaging. Anyone guaranteeing you will not be breached is selling something other than security.
We have backups, so we are covered?
Only if someone has restored one. Ransomware encrypts backups it can reach, so we test a restore in front of you and check that at least one copy is genuinely offline or immutable.
Who tells the ICO if we have a breach?
You do. You are the data controller, and a reportable breach must be notified without undue delay and within 72 hours where feasible. We can help establish what happened technically, but the duty stays with you.
Will you test our systems?
Only with your written authorisation, and only against systems you own or are entitled to authorise. Testing anything else would be unlawful regardless of who asked.
Going for Cyber Essentials?
A free first call on where you actually stand against the five controls.