Who runs Five Controls

Why Five Controls exists

When an insurer, a public sector buyer or a key customer asks for Cyber Essentials, the official documents set out clear high-level rules — such as “install high-risk updates within 14 days” or “use separate administrative accounts” — without showing which settings to change in Microsoft 365, Windows or macOS to meet them.

We wrote Five Controls so any UK small business can check whether it would fail under the current rules, understand what is in scope, and see the exact technical fix before spending money on an assessment fee.

Who we are

AlphaSec (alphasec.uk) is the cyber security arm of Alphabyte IT Limited (alphabyte.it), based at 9/10 Connies House, Rhymney River Bridge Road, Cardiff CF23 9AF. Our factual track record:

• Looking after UK small and mid-sized businesses since 2009.
• A Microsoft Partner managing around 60 Microsoft 365 tenants day to day.
• Cyber Essentials certified ourselves — we work to the same five controls we help clients put in place.
• None of the clients we’ve prepared for Cyber Essentials has ever failed.

Alphabyte IT Limited accreditations

Alphabyte IT Limited holds Cyber Essentials certification (badge shown on this page under IASME’s branding guidelines for certified organisations) and is a Microsoft Partner.

About Ross Owen

Ross Owen · Founder and CEO, Alphabyte IT

Ross is the Founder and CEO of Alphabyte IT. He established the business in 2009 after a career in IT working for large law firms in Cardiff, and leads our work helping UK small and mid-sized businesses secure Microsoft 365 and prepare for Cyber Essentials.

How our guides are written and checked

Every guide on Five Controls is written in our own words and checked line by line against primary sources: the National Cyber Security Centre (NCSC) Requirements for IT Infrastructure v3.3 (April 2026), IASME’s published Danzell scheme updates, and GOV.UK procurement policy notes. We never copy IASME’s assessment question wording.

Every content page carries a visible Last reviewed date and numbered links to the primary documents at the foot of the page. When the rules change each April, we update the guides and tools. If you spot anything that needs a correction or clarification, please email hello@five-controls.co.uk.

How this site is paid for — and our relationship with certification bodies

Every guide and interactive tool on Five Controls is free to use. The site is funded by AlphaSec: some readers who use our free tools ask us to prepare their Microsoft 365 tenant and devices for a fixed fee so they pass first time.

We are not a certification body: your Cyber Essentials certificate is issued by an IASME-licensed Certification Body. Our job is to check your systems against the requirements, fix anything that would fail, and help you complete the assessment accurately — which is why none of the clients we’ve prepared has ever failed.

Independence disclaimer

Five Controls is run by AlphaSec, a trading name of Alphabyte IT Limited (company no. 07014261). It is independent and is not affiliated with or endorsed by the National Cyber Security Centre (NCSC) or IASME. Cyber Essentials is a UK Government scheme owned by the NCSC and delivered by IASME. Our tools give an indication only and are not an assessment or certification.