What Is Cyber Essentials? (And Does Your Small Business Need It?)

Cyber Essentials is a UK government-backed cybersecurity certification scheme. It was created by the National Cyber Security Centre (NCSC) to help organisations protect themselves against common cyber attacks. It's been around since 2014, and it's increasingly becoming a requirement rather than a nice-to-have.

What It Covers

Cyber Essentials focuses on five technical controls — the basics that prevent the majority of common cyber attacks:

• Firewalls: Every device that connects to the internet must be protected by a properly configured firewall. This includes routers, laptops, and any internet-facing services.
• Secure configuration: Devices and software should be configured to reduce vulnerabilities. Default passwords changed, unnecessary services disabled, automatic updates enabled.
• User access control: People should only have the access they need. Admin accounts restricted. Strong passwords enforced. MFA in use.
• Malware protection: Anti-malware software installed and up to date on all devices. Or — for devices where traditional antivirus isn't suitable — alternative measures like application whitelisting.
• Patch management: Software and operating systems must be kept up to date. Security patches applied within 14 days of release. Unsupported software removed.

Two Levels

Cyber Essentials is a self-assessment questionnaire. You answer questions about your security controls, and a certification body reviews your answers. It costs around £300–£500 and can be completed in a day if your controls are already in place.

Cyber Essentials Plus includes everything in the basic certification plus an independent technical audit. A qualified assessor tests your systems — vulnerability scanning, email and web filtering tests, and verification that your controls actually work in practice. It costs more (typically £1,500–£3,000 depending on scope) but provides much stronger assurance.

Do You Need It?

You need it if:

• You bid on UK government contracts — Cyber Essentials is mandatory for any contract involving the handling of sensitive or personal information.
• You work with larger organisations that require it from their supply chain.
• You handle personal data and want to demonstrate GDPR compliance measures.
• You want cyber insurance — many UK insurers now require or discount for Cyber Essentials certification.

You should get it even if you don't strictly need it because:

• It forces you to get the basics right. The five controls aren't aspirational — they're the minimum viable security posture.
• It differentiates you from competitors. When a potential client is choosing between two providers and one has Cyber Essentials, that matters.
• The certification includes cyber liability insurance (up to £25,000 for basic, more for Plus) at no extra cost.

How to Prepare

If you're running Microsoft 365 Business Premium with Intune, Defender, and Conditional Access properly configured — see our Microsoft 365 setup guide for small teams — you're already most of the way there. The main areas where small businesses typically fall short:

• Unsupported operating systems (Windows 10 reaches end of life in October 2025 — devices need to be on Windows 11).
• Missing patches — devices that haven't been updated in months.
• Excessive admin access — too many people with admin rights.
• No MFA on all accounts.
• Home routers with default admin passwords (relevant for remote workers).

Fix these gaps, and the certification process is straightforward. The controls exist to protect your business, not to create bureaucracy. Most small businesses that take it seriously find the process genuinely useful — not just a box-ticking exercise. Our cybersecurity team can help you prepare for certification.