What is Cyber Essentials, and does your business need it?

If a customer, a public-sector buyer or your insurer has asked whether you’re Cyber Essentials certified, you’re not alone. It’s become the standard way for UK businesses to show they take security seriously, and for a small business it’s very achievable.

What it is

Cyber Essentials is a UK government-backed certification scheme, run on behalf of the National Cyber Security Centre (NCSC). It checks that you have five basic security controls in place: the measures that stop the large majority of everyday cyber attacks.

1. Firewalls. Your internet connection and devices only let through the traffic they should.
2. Secure configuration. Devices and software are set up securely, with default passwords changed and anything unnecessary switched off.
3. User access control. People only have the access they need, admin accounts are kept separate, and multi-factor sign-in is switched on for cloud services.
4. Malware protection. Every device is protected against viruses and other malicious software.
5. Security update management. Operating systems and apps are kept up to date, with critical updates applied promptly.

None of this is exotic. It’s the basics, done consistently on every device.

Cyber Essentials vs Cyber Essentials Plus

• Cyber Essentials is a self-assessment: you answer a set of questions about your setup, and an independent certification body reviews your answers.
• Cyber Essentials Plus covers the same five controls, but an assessor also tests your systems hands-on, checking a sample of devices and accounts to confirm things really are set up as described.

Both need renewing every year. Most small businesses start with Cyber Essentials, and move to Plus when a customer or contract asks for it.

Who asks for it

• Public-sector contracts. Many UK government contracts that involve handling personal or sensitive information require it.
• Larger customers. Businesses increasingly ask their suppliers for it as part of their own security checks.
• Insurers. Cyber insurance forms often ask about the same controls, and being certified makes those questions much easier to answer honestly.

Even if nobody is asking yet, it’s a sensible, structured way to get the basics right.

How hard is it for a small business?

For most small businesses the challenge isn’t the questionnaire. It’s discovering the gaps: an old laptop that stopped getting updates, a shared admin password, a cloud service without multi-factor sign-in. Fixing those is usually straightforward once you know they’re there.

That’s how we approach it. We check your setup against the five controls, fix what needs fixing, then guide you through the assessment so it passes first time. We also keep you in line with the controls all year, so renewal is a formality rather than a scramble.

The short version

• Cyber Essentials proves you have the basics of security in place.
• It’s increasingly expected by customers, public-sector buyers and insurers.
• For a small business, it’s very achievable with the right preparation.

If you’d like to know how close you are, get in touch. We offer Cyber Essentials as a fixed-price project, and you can read more about how we approach cyber security.