IT support and Cyber Essentials for recruitment agencies
Recruitment agencies hold an unusually rich set of personal data — CVs, references, right-to-work documents, bank details for temp payroll — and increasingly have to prove to clients that it is looked after. Meanwhile the day-to-day reality is a floor of consultants who need their laptop, CRM and phone working now, not in four hours. Managed IT for a recruitment business has to deliver both: responsive support and a security posture that survives a client questionnaire.
- Cyber Essentials covers five technical control themes
- 5 controlsCyber Essentials covers five technical control themes
- IT, phones and connectivity supported by one accountable provider
- Same teamIT, phones and connectivity supported by one accountable provider
- Documentation for client and framework due diligence
- Audit-readyDocumentation for client and framework due diligence
- Responsive UK support for consultants who cannot afford to sit waiting.
- Practical work towards the five Cyber Essentials control themes, which is what clients ask about.
- Microsoft 365 configured properly — identity, multi-factor authentication, backup and retention.
- Starter and leaver processes that actually remove access, including to call recordings.
The five Cyber Essentials control themes
Cyber Essentials is a UK government-backed scheme covering five technical control themes. Certification is delivered through IASME as the National Cyber Security Centre’s partner, and Cyber Essentials Plus adds a hands-on technical audit. Increasingly, large clients and public sector frameworks ask recruitment suppliers for it.
- What it covers
- Boundary protection between your network and the internet
- Where agencies typically fall short
- Consumer routers, default credentials, no segmentation for guests
- What it covers
- Removing unnecessary functionality and default settings
- Where agencies typically fall short
- Devices deployed from the box with default accounts left enabled
- What it covers
- Right people, right access, administrative rights controlled
- Where agencies typically fall short
- Shared logins, consultants with local admin, leavers still active
- What it covers
- Protecting devices from malicious software
- Where agencies typically fall short
- Inconsistent coverage across laptops, no central visibility
- What it covers
- Keeping operating systems and software patched
- Where agencies typically fall short
- Personal devices and laptops months behind on updates
We help you meet these controls and prepare for assessment. Certification itself is issued by a certification body, not by us — we will not pretend otherwise.
Why this lands on recruitment specifically
Recruitment sits in a data-rich, high-turnover, phone-heavy position, which combines badly with informal IT.
- You hold CVs, references, right-to-work documents and often payroll bank details for temporary workers.
- Consultant turnover is high, which makes leaver access revocation a recurring risk rather than an occasional task.
- Business email compromise targets any business that sends payment instructions, which temp payroll does constantly.
- Candidate data is attractive and portable, and a departing consultant taking a list is a realistic scenario to design against.
- Clients in finance, public sector and large corporates run supplier due diligence and will ask for evidence.
Want this looked at on your own setup?
A review is free, there is no obligation, and you keep the written summary either way.
What managed IT covers for an agency
The unglamorous list that keeps a recruitment floor working.
- Service desk support for consultants, with a clear escalation path.
- Device provisioning to a standard build, so a new starter is working on day one.
- Microsoft 365 administration: identity, multi-factor authentication, licensing, mailbox and file permissions.
- Backup and retention for email and files, tested rather than assumed.
- Endpoint protection and patching with central visibility.
- Starter and leaver processes covering email, CRM, phone system and recording access together.
- Asset inventory, so you know what you own and how old it is.
- Security awareness guidance for consultants, focused on the scams that actually target recruitment.
The leaver problem
This is worth its own section because it is where agency risk concentrates, and because phones and IT being separately managed is precisely why it goes wrong.
- Email, CRM, phone system, call recordings, file shares and any mobile app all need revoking on the same day.
- A departing consultant’s calls need re-routing to a colleague so client relationships do not hit voicemail.
- Where personal mobiles were used, the business has no ability to intervene at all — another reason to end that practice.
- A single provider handling IT and telephony makes this one process rather than several that partially happen.
Agency IT and security review checklist
- Is multi-factor authentication enforced on every Microsoft 365 account?
- Are leavers fully removed — email, CRM, phone and recordings?
- Is every laptop encrypted, patched and centrally visible?
- Do consultants have local administrative rights they do not need?
- Is email and file backup in place, and has a restore ever been tested?
- Is guest Wi-Fi separated from the staff network?
- Could you evidence the five Cyber Essentials controls if a client asked this month?
- Do you know what happens to candidate data if a consultant resigns tomorrow?
Frequently asked questions
Do we need Cyber Essentials to win recruitment contracts?
It is not universally mandatory, but it is asked for often enough — particularly by public sector buyers and large corporates — that not having it costs opportunities. It is also a sensible baseline regardless of whether anyone asks.
Can you certify us?
We help you meet the controls and prepare the evidence. Certification is issued by a certification body under the IASME-operated scheme rather than by your IT provider, and any provider claiming to issue it themselves is worth questioning.
Will you work with our existing IT person?
Yes. Plenty of mid-sized agencies have an internal IT manager and use us for depth, out-of-hours cover, projects, voice and connectivity. We agree the boundary in writing so nothing falls between us.
How fast is your support response?
We agree response expectations with you rather than quoting a number on a web page we would then have to defend out of context. What we will commit to is that the same team supports your phones, connectivity and IT, so nobody spends the morning deciding whose fault it is.
Related recruitment guides
Get an IT and security baseline review
We will assess your estate against the Cyber Essentials control themes and show you exactly where the gaps are — before a client asks.
- Full audit of every line, number and contract you hold
- Honest view of what your CRM will and will not integrate with
- The call data you are not currently seeing, including missed inbound
- A written summary — yours to keep either way