Cyber Essentials and data rooms: what the certificate does and does not tell you

Read the last column with care. Every one of these depends on scope, and scope is where certificates are most often misread.

What is Cyber Essentials, in plain terms?

Cyber Essentials is a certification scheme backed by the UK government and run under the National Cyber Security Centre. It was designed to protect organisations against the most common internet-based attacks, the kind that rely on unpatched software, default passwords and open ports rather than a determined, well-funded attacker.

It checks five areas:

1. Firewalls, so that only necessary services are reachable from the internet.
2. Secure configuration, removing default accounts and unnecessary software.
3. User access control, so people only have the access they need, with stronger authentication where it matters.
4. Malware protection on the devices in scope.
5. Security update management, so that known vulnerabilities are patched promptly.

At the basic level, the organisation completes a self-assessment questionnaire that a certification body reviews. At Cyber Essentials Plus, an assessor also tests a sample of systems directly. Certification is renewed annually, and the requirements are updated from time to time, so a certificate from three years ago tells you very little.

Cyber Essentials has been a requirement for many UK central government contracts that involve handling personal information since 2014, and many banks, insurers and large companies now ask their suppliers for it too. That is why it appears on so many supplier questionnaires.

Why is it not enough on its own for a data room?

A data room is a hosted application that holds some of the most sensitive documents a business ever produces, shared with outsiders, often under time pressure. The risks that matter most are specific to that job.

• Can one bidder ever see another bidder’s folders, through a bug or a misconfigured group?
• Is document rights control enforced on the server, or only in the viewer?
• Is the audit trail complete and tamper-resistant?
• How are encryption keys managed, and who at the provider can access customer files?
• How is the platform itself tested: penetration tests, code review, vulnerability management?
• What happens to your data when the room is closed?

Cyber Essentials does not ask any of these questions. It is about baseline technical hygiene of the IT in scope. If a provider’s certificate covers only its office laptops and corporate email, it tells you something about the company’s habits but nothing about the platform holding your files. Even when the hosted service is in scope, the five controls are a floor, not a full picture.

ISO 27001 and SOC 2 go much further. ISO 27001 requires the provider to run a management system: identify risks, choose controls to treat them, monitor them and improve over time, all checked by external auditors. A SOC 2 Type 2 report goes into detail on how specific controls operated over a period, with any exceptions the auditor found.

Which certifications do the data rooms we review hold?

Cyber Essentials is not among the certifications we track for each provider. Many of the rooms we review are headquartered outside the UK, and a UK scheme may not be the evidence they lead with. If a UK certificate matters to your procurement, ask the provider directly; do not assume either way.

Here is what our data shows for ISO 27001 and SOC 2 across the rooms in our UK line-up.

Every provider in the line-up reports SOC 2. Twelve of the eighteen also hold ISO 27001. Ellty, CapLinked, SecureDocs, Onehub, Digify and DocSend do not, and Ellty’s SOC 2 is described as SOC 2 Infrastructure, so ask exactly which systems and period its report covers. Headquarters is not hosting location; we do not hold confirmed hosting regions for any of these providers.

Certifications are one input into our Security and UK GDPR score, which carries 30% of each overall rating. The rest comes from access controls, audit, two-factor login and how well the room supports UK GDPR duties. Our methodology page explains the weighting.

When does Cyber Essentials actually matter in a deal?

In three situations, mostly on the other side of the table from the data room.

When your buyer asks about the target. Cyber diligence is now a routine workstream on UK acquisitions. Buyers ask whether the target holds Cyber Essentials, whether it has had incidents, and how it manages patches and access. If the target is certified, put the current certificate and the scope statement in the IT folder of the data room. If it has lapsed, expect a question.

When the target sells to government. If the business holds public sector contracts that require Cyber Essentials, a lapsed certificate can be a contract compliance issue, not just a hygiene point. Buyers will want to see renewal dates.

When your own procurement team requires it. Some UK public bodies, banks and regulated firms apply the same supplier rules to every software purchase, including a data room bought for a single transaction. In that case ask providers early, because collecting evidence can take longer than the deal timetable allows.

What should you ask a data room provider about security?

The NCSC’s supply chain security guidance recommends proportionate questions based on what the supplier will hold. For a room full of deal documents, that means more than a certificate.

• Can we see the current ISO 27001 certificate, including its scope statement?
• Can we see the latest SOC 2 report under NDA, and is it Type 1 or Type 2?
• Do you hold Cyber Essentials or Cyber Essentials Plus, and does it cover the hosted platform?
• When was the platform last penetration tested, by whom, and were findings fixed?
• Where will our room’s files be stored, and which subprocessors handle them?
• Is two-factor login enforced for every user, including bidders, or optional?
• Who at your company can access customer files, and how is that logged?
• How long after closure is our data deleted, and do you confirm it in writing?
• How would you notify us of a security incident affecting our room, and how fast?

The location and subprocessor questions also feed your UK GDPR records. The ICO’s guidance for organisations sets out what a controller must check before using a processor, including sufficient guarantees about security.

Does certification replace configuring the room properly?

No, and this is the part sellers most often forget. A provider can hold every certificate going and the room can still leak if it is set up badly. Most incidents in deal rooms are configuration mistakes: a bidder group given access to the wrong folder, download rights left on for a sensitive file, an adviser who left the deal still able to log in.

Those settings are yours. Before the room opens, check that two-factor login is enforced, that each bidder group sees only what it should, that view-only and watermarking are on for the most sensitive folders, and that someone reviews the audit trail weekly. When a bidder withdraws, disable its access the same day.

For the personal data inside the room, our guide to UK GDPR in a data room covers staged disclosure and the controller and processor roles.