By Jonathan Krause | Founder, Forensic Control | June 2026
Valkyrie’s cyber assurance capability expanded when Forensic Control joined the group, adding Cyber Essentials and Cyber Essentials Plus certification to an established offer. In this piece, Forensic Control’s founder sets out what that certification means for family and private offices.
A family office holds more sensitive information per head than almost any organisation I assess, and usually has far less protection around it. Bank details, asset structures, property, travel patterns, household staff, the principal’s medical and family affairs. All of it sits with a team that is often fewer than a dozen people, running on the same cloud tools a small business would use, with security that was never really designed for what it is now protecting.
Cyber Essentials, the UK government-backed certification scheme, was built for exactly this kind of small, exposed organisation. It is also becoming something the institutions you deal with quietly expect to see.
Why a family office is an unusually attractive target
Most criminals are opportunists working at scale. A family office breaks that logic, because the return on a single successful intrusion is enormous. One compromised mailbox can expose wire instructions, legal correspondence, the names and movements of family members, and the trust of every adviser who emails in.
The data is also unusually rich. It is not just money. It is the context around the money, which is what makes social engineering against a family office so effective. An attacker who has read six months of a principal’s correspondence does not need a sophisticated exploit. They need a plausible payment request sent at the right moment.
Security also tends to be built for discretion and speed rather than for the controls a regulated firm carries as a matter of course. Personal devices, shared logins and informal processes are common, not through carelessness but because the office grew around the family rather than around an IT department.
What Cyber Essentials actually checks
Cyber Essentials covers five technical controls: firewalls, secure configuration, user access control, malware protection, and keeping software updated. None of it is exotic. The National Cyber Security Centre (NCSC) designed the five controls to prevent the most common internet-based cyber attacks, the basic, opportunistic attempts that make up the bulk of what small organisations face.
Multi-factor authentication (MFA), the second check on top of a password, now sits at the centre of the scheme. Under the current requirements, if a cloud service offers MFA and you have not switched it on for everyone, you fail. For a family office that has Microsoft 365 or Google Workspace available with MFA but never rolled it out across the family and the staff, that is the single most common gap I see.
There are two levels. Cyber Essentials is a verified self-assessment. Cyber Essentials Plus adds a hands-on technical audit, where an assessor checks your devices rather than taking your word for it. For an office holding this kind of data, Plus is the level worth aiming at, and it is the one institutions take more seriously.
The part that catches family offices out
The controls are not the hard bit. The scope is.
A normal business has a reasonably clear boundary. A family office does not. The principal’s own laptop, a family member’s phone that picks up the shared calendar, a domestic staff member using a personal device to access the household management system, an adviser given a login years ago and never removed. Each of those is a route in, and each of them complicates the question of what your certification actually covers.
Getting this right means deciding honestly what is in scope and securing it, rather than drawing the boundary narrowly to make the assessment easier. I am not going to pretend that is frictionless. Persuading a principal to accept MFA on their own account is sometimes the longest conversation in the whole engagement. But a certificate that excludes the riskiest devices in the office is not protecting the thing you most need to protect.
What the certificate signals to your bank and your insurer
This is where certification earns its place beyond the security itself. Cyber insurers commonly take account of security certifications when setting terms and pricing, and Cyber Essentials is widely recognised as evidence of baseline hygiene. Whether it changes your premium depends on the insurer and the policy, but it is increasingly something underwriters ask about.
The same expectation is spreading through business relationships more widely. In 2024 the NCSC, the government and several of the UK’s largest banks jointly encouraged organisations to adopt Cyber Essentials across their supply chains. A family office is rarely a supplier in that sense, but the same question surfaces in its own dealings, with co-investors, advisers and the firms it contracts. Holding certification answers it before it is asked, which matters when you are the smaller, unregulated party in a relationship with a large regulated one.
Where to start
The certificate is the end of the process, not the start. The value is in the readiness work, finding the accounts without MFA, the devices nobody is patching, the logins that should have been switched off two staff changes ago, and closing them. Most offices that come to us are a few specific fixes away from passing, and they do not know which few until someone looks.
If you run or advise a family office and you have never had this assessed, that audit is the first step. It is quick, it is proportionate to the size of your team, and it tells you exactly where you stand.
To talk through what Cyber Essentials would involve for your office, book a 30-minute call with Jonathan, or visit forensiccontrol.com.
Frequently asked questions
Is Cyber Essentials relevant to a family office, or is it just for larger companies?
It is relevant, and arguably more so. Cyber Essentials was designed for small organisations, which is exactly what a family office is. The scheme addresses the common attacks that family offices are most exposed to, and its size means certification is proportionate and quick rather than a heavy compliance exercise.
Does a family office really need certification with only a handful of staff?
The number of staff is not the risk. The sensitivity and concentration of the data is. A small team holding a family’s financial, personal and security information is a high-value target precisely because the team is small and the protections are often light. Certification forces the basics that small offices most often skip, particularly universal multi-factor authentication.
What is the difference between Cyber Essentials and Cyber Essentials Plus?
Cyber Essentials is a verified self-assessment against five technical controls. Cyber Essentials Plus adds an independent hands-on audit, where an assessor tests your devices directly. For a family office handling principal data, Plus carries more weight and is the level we would usually recommend.
Will Cyber Essentials affect our cyber insurance?
It can. Insurers increasingly take security certifications into account when deciding terms and pricing, and treat Cyber Essentials as evidence of baseline cyber hygiene. It is worth raising directly with your broker, as the effect depends on your insurer and your policy.
How long does certification take and how disruptive is it?
Once the underlying controls are in place, certification itself is fast, often a few working days. The time is usually spent on the readiness work beforehand, closing gaps such as missing multi-factor authentication or unpatched devices. For most offices this is a small number of specific fixes rather than a long project.
