---
title: "Paranoid by Design: Cyber Essentials, the Cyber Resilience Pledge and Our Security Culture"
url: https://manage.management/blog/paranoid-by-design-cyber-essentials-cyber-resilience-pledge
description: "Manage.Management is Cyber Essentials certified, and one of the first signatories' of the Government's Cyber Resilience Pledge."
author: "Franklin Baeza"
published: 2026-07-31T09:00:00.000Z
updated: 2026-10-29T12:25:18Z
categories: ["Tech Update","Opinion"]
publisher: Manage.Management
language: en-GB
---

# Paranoid by Design: Cyber Essentials, the Cyber Resilience Pledge and Our Security Culture

Manage.Management is Cyber Essentials certified, and one of the first signatories' of the Government's Cyber Resilience Pledge.

## Three things happened, and they all point the same way

In the last few weeks, [Manage.Management](https://manage.management/) has:

## Key takeaways

- Manage.Management holds Cyber Essentials certification and has signed the Cyber Resilience Pledge.
- Certification meant around thirty concrete changes to devices, accounts and access, with no exceptions.
- Leaseholder data, payments and building documents deserve the same care as any financial system.
- Security is treated as culture, not a compliance badge.
- **Achieved Cyber Essentials certification:** the UK Government-backed scheme that sets the minimum security baseline for organisations in this country.
- **Signed the Government's Cyber Resilience Pledge**, launched at No.10 Downing Street on 7 July 2026, committing us publicly to three concrete actions.
- **Completed 30 file changes** across our codebase, remediating every recommendation raised by our independent penetration test with Aikido.

None of this is marketing. It's the standard we've decided to stand on.

## Why we should be paranoid

Think about what actually sits inside our software.

Service charge accounts. Bank and payment details. Section 20 consultations. Insurance schedules. Fire risk assessments. Directors' and leaseholders' home addresses. Contractor invoices. AGM votes. The lease document itself. For a single block, that's a complete financial and legal picture of dozens of people's homes.

The residential property sector has historically run on email attachments, shared drives and filing cabinets. Moving that into software is a huge upgrade, but only if the software is genuinely secure. Otherwise you've simply concentrated the risk and put it online.

Because of this, we're investing in being the platform that treats cyber resilience as culture, not just a checkbox, from the earliest stages of building the product.

## The CyberSmart years

Our co-founder [Franklin Baeza](https://www.linkedin.com/in/franklinbaeza) spent years at [CyberSmart](https://www.linkedin.com/company/cybersmartuk/), joining before the company had signed a single MSP partner and staying through its growth into one of the UK's largest Cyber Essentials certification bodies.

That's a lot of certifications. It's also years spent close to the frontline of cyber risk, seeing how often the root cause is boringly preventable: an unpatched machine, a shared password, a supplier with no controls, a board that assumes “IT has it covered”.

You don't come out of that experience relaxed about security. You come out of it slightly paranoid, and convinced that the basics, done properly and continuously, prevent the overwhelming majority of real-world harm.

The data supports the instinct. Insurance figures cited by the Government show organisations with Cyber Essentials are [92% less likely to claim on their cyber insurance](https://www.gov.uk/government/publications/cyber-essentials-scheme-overview) than those without it, and organisations that require their third parties to be Cyber Essentials certified see [up to an 80% reduction in cyber incidents](https://www.ncsc.gov.uk/information/cyber-essentials-supply-chain-playbook) across those suppliers.

## What Cyber Essentials actually involved

Cyber Essentials is an assessment against five technical control areas: firewalls, secure configuration, user access control, malware protection and security update management. It's the Government-backed baseline, and it's deliberately unglamorous. It targets the commodity attacks that make up the overwhelming majority of real-world breaches.

Getting there meant tightening things we could have left alone: device hardening, multi-factor authentication everywhere, patch windows measured in days rather than “when someone gets round to it”, and a much stricter view of who has access to what.

## Thirty changes, no exceptions

Alongside certification, we ran an independent penetration test with Aikido against our platform. The output was a list of recommendations, graded by severity.

We closed all of them: 30 file changes shipped across our application, covering input handling, access controls, dependency hygiene and configuration hardening. Not triaged into a backlog, not deferred to next quarter. Fixed.

We run the Aikido GitHub bot on our codebase, so every pull request is automatically scanned for new vulnerabilities before it's merged.

## What signing the Cyber Resilience Pledge commits us to

The [Cyber Resilience Pledge](https://www.gov.uk/government/publications/cyber-resilience-pledge) is a voluntary public commitment bringing government and industry together to strengthen cyber security across the UK economy. Signing it means committing to three actions:

1. **Make cyber a board responsibility, using the Cyber Governance Code of Practice.** Cyber security is not having a VPN or a password manager. It's a strategic risk that belongs on the board agenda, with named ownership, defined risk appetite, and regular reporting. We've formally adopted the [Code](https://www.ncsc.gov.uk/cyber-governance-for-boards/code-of-practice) and its five principles — risk management, strategy, people, incident planning and response, and assurance and oversight — as our governance framework.
2. **Sign up to the** [**NCSC's Early Warning service**](https://www.ncsc.gov.uk/section/active-cyber-defence/early-warning)**.** A free notification service that flags potentially malicious activity on our network, giving us an outside view alongside our own monitoring.
3. **Take a risk-based approach to requiring Cyber Essentials across our supply chain.** This is the one with teeth. We hold financial data, contractor records and resident information, and our suppliers touch parts of that. We're assessing them proportionately to the risk they carry, and Cyber Essentials certification is becoming part of that conversation.

Cyber Security Minister Liz Lloyd said:

> “As an early supporter of the Cyber Resilience Pledge, Manage.Management is sending a clear message to their customers, investors and supply chains that cyber resilience is a core part of how they do business.”

You can read about the Pledge on [GOV.UK](https://www.gov.uk/government/publications/cyber-resilience-pledge) and see the [list of signatories](https://www.gov.uk/government/publications/cyber-resilience-pledge-list-of-signatories).

## Culture, not compliance

Certificates expire. Pen test reports go stale the moment you merge the next pull request. The only thing that lasts is culture.

So we're building security into how we work rather than bolting it on annually:

- **Security is a board item, every meeting:** with an owner, metrics and tolerances, not a verbal “all fine”.
- **Every employee owns security:** automated scanning in CI, dependency alerts triaged like bugs, and threat modelling as part of design rather than an afterthought.
- **Least privilege by default:** nobody has standing access to production data because it's convenient.
- **Training for everyone:** including non-technical roles, because phishing doesn't care about your job title.
- **Suppliers get assessed:** in proportion to the risk they carry.
- **We rehearse incidents:** before we have one, so the first time we run the plan isn't the worst day of the year.

## What this means if you're a leaseholder, RTM director or managing agent

If you're a director of an RTM or RMC, cyber risk is now part of your duties too. Your block's finances and residents' personal data are on somebody's system. It's an entirely reasonable question to ask your suppliers, including us, what standard they're certified to, when they were last independently tested, and who at board level owns it.

Our answers: Cyber Essentials certified, independently penetration tested with all findings remediated, and a board that has formally adopted the Cyber Governance Code of Practice.

We think that should be the baseline for anyone handling the data behind people's homes. If you're a supplier, a partner, or another platform in this sector, [sign the Pledge](https://www.gov.uk/government/publications/cyber-resilience-pledge) and join us. Building cyber resilience is a shared responsibility.

Last reviewed: 29 October 2026 by Franklin Baeza, Manage.Management. This article is general information for England and Wales, not legal advice. Check the current position with a qualified adviser before acting.

---

Source: [Paranoid by Design: Cyber Essentials, the Cyber Resilience Pledge and Our Security Culture](https://manage.management/blog/paranoid-by-design-cyber-essentials-cyber-resilience-pledge) on the Manage.Management blog.