Cyber Essentials, Explained for Small Businesses

Cyber Essentials tends to come up in two places: contract paperwork and insurance renewals. A council tender asks whether you hold it. An insurer's questionnaire wants a yes or no. And most small business owners, reasonably enough, have never had a reason to think about it before that moment.

Here's the short version. Cyber Essentials is a UK government-backed certification scheme, run by the National Cyber Security Centre (NCSC), that checks you have five basic technical controls in place. It isn't a deep audit and it doesn't take months. For a typical small business it's a few weeks of tidying up, then a questionnaire.

This guide covers what the scheme involves, roughly what it costs, and why it's worth a small business's time even when no contract is demanding it.

What Cyber Essentials actually checks

The scheme deliberately ignores the exotic stuff. It focuses on five controls that block the bulk of common, opportunistic attacks — the kind aimed at any business with an internet connection, not at you specifically.

• Firewalls. A proper boundary between your network and the internet, with nothing exposed to the outside world that doesn't need to be.

• Secure configuration. Default passwords changed, unused software and accounts removed, and devices set up deliberately rather than left as they came out of the box.

• User access control. People get the access their job needs and no more. Admin rights are reserved for admin tasks, not used for everyday email and browsing.

• Malware protection. Every device runs anti-malware protection that's switched on and kept current — laptops at home included, not just the machines in the office.

• Security update management. Software and operating systems patched promptly. The scheme expects critical updates applied within 14 days of release, which catches out more businesses than any other control.

None of that is advanced, and that's the point. Done consistently, these basics shut the doors most attackers try first.

Standard vs Cyber Essentials Plus

There are two levels. Standard Cyber Essentials is a self-assessment: you answer a questionnaire about your setup, a senior person signs it off, and an assessor reviews the answers. If they hold up, you're certified for a year.

Cyber Essentials Plus covers the same five controls, but an assessor verifies them hands-on — testing devices, checking that malware protection actually catches things, confirming the patches you say are applied really are. More work, more cost, more weight when a client asks for evidence.

Which one you need is usually decided for you. If a contract or client names Plus, that settles it. Otherwise, standard is where nearly every small business starts, and for many it's all they ever need.

One thing worth knowing before you fill in the questionnaire: it covers every device that touches company data, including the laptop your part-timer uses from home and the phone that picks up work email. Businesses often fail not on their office kit but on the machines nobody thought of as "company IT". Worth an honest inventory before you start.

What it costs

The certification fee itself is modest. Standard self-assessment runs to a few hundred pounds, tiered by company size. Plus costs more — typically into four figures — because an assessor has to spend real time testing your setup.

But the fee is rarely the real cost. The real cost is the work to get the five controls in place before you apply: replacing the laptop that can't take updates any more, untangling who has admin rights, closing accounts that belong to people who left two years ago. If your IT is already tidy, certification is quick and cheap. If it isn't, the scheme has just told you something useful.

Why small businesses bother

Three reasons come up again and again. First, contracts: central government work involving personal data typically requires Cyber Essentials, and that requirement flows down supply chains — so a subcontract two steps removed from Whitehall can still ask for it. Larger private-sector clients increasingly ask too, usually via a security questionnaire before they'll sign.

Second, insurance. Cyber insurers want evidence of basic controls before they price a policy, and certification is a simple, recognised way to show it.

Third — and honestly the best reason — the five controls are just good hygiene. A business that patches promptly, limits admin rights and has no orphaned accounts is a far harder target, certificate or not. Most of the small-business incidents we see start with exactly the gaps this scheme exists to close.

There's a quieter benefit too. The annual renewal gives you a fixed date each year when someone has to look at the basics and confirm they still hold. Small businesses rarely schedule that kind of review on their own; the machine bought in a hurry, set up by whoever was free that afternoon, tends to stay however it was left. A yearly forcing function catches that drift before an attacker does.

How we help — and what we don't do

To be clear about our role: we're an IT support company, not a certification body. We don't issue Cyber Essentials certificates, and you should be wary of anyone who blurs that line. What we do is align your setup with Cyber Essentials guidance, so that when the questionnaire arrives the answers are already true.

In practice that's work we do for clients anyway. Vulnerability and patch management through our cyber security service keeps the update control satisfied month after month, not just in the week before an assessment. Managed joiner and leaver processes through the helpdesk keep access control tidy. Firewall and office network design sit under network management, and Microsoft 365 hardening handles secure configuration across your tenancy.

Alignment with Cyber Essentials, ISO 27001 and NCSC guidance is built into how we run client environments from our Shoreditch office. So by the time a client decides to certify, it's a formality rather than a project.