Cyber Essentials explained for small businesses

Short answer. Cyber Essentials is the UK government’s baseline security certification, run by the National Cyber Security Centre and delivered through IASME. It checks five controls: firewalls, secure configuration, security updates, user access, and malware protection. The basic level is a self-assessment questionnaire priced by organisation size; Cyber Essentials Plus adds an independent audit. For a small business it is worth doing if you bid for contracts or work with larger clients, and the five controls are the right starting point even if you never certify.

I take clients through it several times a year. This is the practical version of what is involved.

What it is, and what it is not

Cyber Essentials is a set of basic technical controls designed to stop the majority of opportunistic, automated attacks: the scanning, phishing and credential-stuffing that hits every business regardless of size. It is not a guarantee against a determined, targeted attacker, and it does not cover things like staff training, incident response or data protection policy. Think of it as locking the doors and windows rather than hiring a guard.

There are two levels:

• Cyber Essentials. A self-assessment questionnaire, signed off by a board member or equivalent, reviewed by an assessor. Certificate valid for twelve months.
• Cyber Essentials Plus. The same questionnaire, followed by an independent technical audit: vulnerability scans of a sample of your devices and tests of your email and web defences. Must be completed within three months of the basic certificate.

The five controls

1. Firewalls. Every device and your internet connection must sit behind a properly configured firewall. Default passwords changed, no unnecessary services exposed to the internet, and a documented reason for any that are.

2. Secure configuration. Devices set up deliberately: unused accounts removed, default passwords changed, auto-run disabled, a lock screen with a proper password or biometric. Since the 2025 question set, passwordless and biometric authentication are explicitly recognised.

3. Security update management. Every operating system and application must be supported by its vendor and receiving updates, with high and critical fixes applied within 14 days of release. This is where Windows 10 machines fail, and where old browser plug-ins and forgotten software get caught.

4. User access control. Each person has their own account. Administrator accounts are separate from day-to-day accounts and used only for admin tasks. Multi-factor authentication is required on cloud services wherever it is available. Leavers are removed promptly.

5. Malware protection. Anti-malware on every device, kept up to date, or application allow-listing, or sandboxing. Microsoft Defender counts, provided it is actually on and managed.

What it costs

Certification fees are set by IASME and tiered by organisation size, from a few hundred pounds plus VAT for micro businesses, rising through small, medium and large bands. Cyber Essentials Plus is priced by the certification body and depends on size and how many devices need testing; four figures is normal for a small business.

The real cost is usually the remediation. If the questionnaire exposes six laptops that cannot run a supported operating system, or reveals nobody has MFA on email, the fix costs more than the certificate. That is also the point.

Why small businesses fail first time

The same handful of things, over and over:

• Unsupported software. An old Windows version, an out-of-support Office, a router the manufacturer stopped patching years ago.
• MFA gaps. It is on for most people but not the director who found it annoying, or not on the accounts package.
• Shared or everyday admin accounts. Everyone logs into the office PC as “admin”. Or the owner’s normal account is a global administrator.
• Patching lag. Updates are “set to automatic” but nobody checks, and a third of the devices are months behind.
• Scope confusion. Home workers’ personal laptops used for work are in scope and were never considered.

None of these are hard to fix. They are hard to notice without looking.

Is it worth it for a 5 to 50 person business?

Yes, in three situations:

1. You bid for public sector or larger corporate work. Cyber Essentials is frequently a pass/fail requirement in supplier questionnaires.
2. Your clients trust you with their data. Accountants, law firms, recruiters and consultancies are asked about this by their own clients now.
3. You want cyber insurance at a sane premium. Insurers’ questions map closely onto the five controls; a certificate shortcuts the conversation.

If none of those apply, you can skip the certificate and still adopt the controls. They are the baseline I put in place on every managed IT engagement, whether or not the client ever certifies. The difference between doing it and certifying it is about a day of paperwork and the fee.

The process, start to finish

1. Scope. Decide whether the whole organisation is in scope (it should be) and list every device, including home workers’.
2. Gap check. Walk the five controls against reality. Fix what is missing.
3. Questionnaire. Answer honestly. Assessors do read them, and Plus will test the claims.
4. Board sign-off. A director confirms the answers.
5. Certificate. Usually issued within days of a clean submission.
6. Plus, if wanted. Book the audit inside the three-month window.
7. Diary the renewal. It is annual, and the question set evolves.

I handle the technical side and the questionnaire for clients as part of IT security work; you sign the form. If you want to know how far off you are, the IT & Security Audit walks the five controls against your whole estate and gives you the gap list in writing, two weeks and from £1,500. A 30-minute call is the place to start.