1. Throughout this report we reference a number of strategic documents, action plans, resources and toolkits. Where possible, a hyperlink has been included each time a document is mentioned for the first time.
2.financial figures given in relation to spending on the actions plans are to March 2020
3. Universities and colleges can access the MailCheck service, but are not eligible for the Protective DNS or Webcheck Services. Therefore, they have been removed from the sample.
4. These 20 organisations have not indicated to us that Cyber Essentials should not apply to them. There are currently between 30 and 40 organisations that do not have Cyber Essentials for a good reason (for example, they either do not have a network of their own or they have outsourced management of it).