saascode
saascode

EssentialsProof

A Cyber Essentials 2026 evidence workbench for UK small businesses that inventories cloud services tied to business identities, collects authorized identity-provider and service observations, maps current MFA coverage and gaps to sourced scheme questions, and exports a reviewer-approved snapshot without claiming certification.

Genesis score6.92/10
Make EssentialsProof real.0/500
500 more votes and EssentialsProof is authorized for build.
0%500 to authorize
Backing is the vote. When an idea crosses 500, we pull it into the build pipeline and ship it for real — the votes decide what gets built next, not an editor.
The opportunity
3Cross-references
0Inbound connections
0Direct connections
The case

UK small businesses seeking Cyber Essentials can document policies while still missing the actual cloud services and identities whose MFA state matters. EssentialsProof builds a reviewable service-and-identity inventory from authorized workspace, directory, domain, expense, browser, and owner evidence, then observes where MFA is available, configured, enforced, bypassed, exempted, or unknown. A directory policy is not proof every service enforces it, successful collection is not complete scope, a signed snapshot proves only bounded integrity, and an evidence package is not assessor acceptance or certification. Scheme source, applicability, service inventory, account, identity, observed configuration, test, exception, reviewer conclusion, remediation, management assertion, assessor finding, certification decision, expiry, and correction remain distinct.

Who pays — and why

An owner, IT lead, security adviser, managed service provider, or compliance coordinator at a UK small business preparing for Cyber Essentials or maintaining its control evidence.

What it unlocks
A scheme and applicability registry preserving source, question, version, effective date, entity, service class, account population, requirement interpretation, reviewer, supersession, and correction
A cloud-service identity graph linking domain, workspace, directory, application, social business account, owner, users, administrators, authentication path, federation, MFA availability, enrollment, enforcement, bypass, recovery, exception, last observation, and coverage source
An evidence lifecycle separating source observation, API and manual collection, test, unknown, mapping candidate, reviewer disposition, remediation, retest, management approval, snapshot manifest, assessor request, finding, response, certification outcome, expiry, and correction
How Genesis scored it
6.92across seven criteria
tension 7temporal 8blindspot 5buyer 7leverage 8convergence 5why-not 7
8
Temporal window

The updated scheme became live in April 2026, creating a current preparation need subject to later scheme revisions.

8
Asymmetric leverage

A versioned rule corpus, service inventory, collectors, tests, and snapshot exports can repeat across customers.

5
Convergence

Three cross-references with no inbound or direct connections provide limited corroboration.

Why it scored well

Three cross-references, confirmed April 2026 scheme changes, verified workspace interfaces, and no identified small-business continuous evidence service specific to the current Cyber Essentials question set support a dated, code-scalable wedge.

What's holding it back

There are no inbound or direct connections, cloud-service discovery is incomplete, paid-add-on and service-specific MFA semantics vary, scheme interpretation requires current qualified review, the package cannot guarantee assessor acceptance, pricing is unvalidated, and no structural incumbent cost is evidenced.

Signals detected4 sources crossed
SignalIASME and supplied scheme-analysis research

SignalSupplied Cyber Essentials 2026 research

SignalSupplied scheme research

SignalSource-run market scan

Direction briefessentialsproof.md
essentialsproof.md
Want this pointed at your vertical?Point Genesis at your own market and constraints — it invents adjacent, fork-ready ideas, private to you before they hit the public feed.

Discussion

?

No comments yet — be the first to weigh in.