Decide what is in the assessment scope
When a UK startup asks for IT support, distinguish hands-on server and cloud administration from end-user devices, Microsoft 365, application development and formal certification. List the accounts, cloud subscriptions, laptops, offices and remote workers involved. A provider should explain which of those assets it can actually manage.
NCSC Cyber Essentials is a certification scheme built around five technical controls. Its website provides the current assessment questions and infrastructure requirements. Preparation assistance is not certification: the organization should use the official route and an appropriately authorised assessor when it wants an assessment.
Build a responsibility table
For each control, write down the customer owner, supplier owner, actual configuration and evidence location. A cloud vendor may operate the physical platform while the customer or their support provider configures identities, devices, software and network access. Record exceptions and their owners instead of treating a tool purchase as proof of a control.
Ask who reviews administrative accounts, who installs security updates, how unsupported systems are identified, and what happens when a remote employee loses a device. Make the answers specific to the agreed scope and current scheme requirements.
Verify access and changes
Use individual support identities where supported, restrict privileges to the job, require appropriate multi-factor authentication and define the offboarding process. Review a proposed change and recovery plan before touching production. Keep evidence of when the change happened and who checked the result.
Choose the right support model
Ask for the support window in UK local time, escalation path, included cloud accounts, incident exclusions and any extra fees. Clouvenix can discuss cloud security support and related infrastructure work; assessment or certification is a separate decision for the customer and the relevant scheme bodies.