Cyber Essentials: what it is and why your business should care
Most cyber attacks on small businesses are not sophisticated. They exploit the basics: software that has not been updated, weak or easy-to-guess passwords, no extra login checks such as multi-factor authentication, and staff passwords leaked online without anyone noticing.
The scale is significant. The government’s latest Cyber Security Breaches Survey estimates that UK businesses experienced around 5.19 million cyber crimes in the past year. Yet only 30% carried out a cyber security risk assessment. (Source: Cyber Security Breaches Survey 2025/26)
That is where Cyber Essentials comes in. It is a government-backed certification scheme that checks whether you have five basic controls in place. Get them right and you block the bulk of common attacks.
Here is what it involves and whether it is worth doing.
What is Cyber Essentials?
Cyber Essentials is owned by the National Cyber Security Centre (NCSC) and delivered by IASME, its certification partner. It was created after the government found that a handful of basic controls would have stopped many real attacks before they caused damage.
Since 2014, more than 215,000 certificates have been issued to UK businesses, charities, schools and local authorities. Each certificate lasts 12 months and is renewed annually. Yet the same government survey found that only 24% of businesses and 13% of charities have all five controls in place.
The five controls
Firewalls
Every device sits behind a properly configured firewall, whether that is at the office boundary or on the device itself.
Secure configuration
Insecure default settings are removed. That means no default passwords left in place, no unused accounts and no software installed that nobody uses.
User access control
Staff only get the access they need to do their job. Administrator accounts are separate from everyday accounts, and leavers are removed promptly.
Malware protection
Anti-malware is in place on every device, or you use an approved alternative such as application allow-listing.
Security update management
Software is licensed, supported and patched. Critical updates are applied quickly, and anything no longer supported by the manufacturer is removed.
Example: Microsoft ended standard support for Windows 10 in October 2025, yet it still runs on around 28% of Windows computers worldwide. Unless they are enrolled in Microsoft’s Extended Security Updates programme, these machines no longer get security fixes. Any new flaw found in Windows 10 could leave them open to attack.
None of this is particularly unusual. For a business with reasonably well-managed IT, much of it will already be in place.
Why it is worth doing
It stops the attacks you are most likely to face
The scheme targets the common, opportunistic attacks that make up most incidents affecting small businesses. These are not targeted operations. They are criminals looking for the easiest way in.
It usually includes cyber insurance
Qualifying UK organisations with turnover under £20m get cyber liability cover included with their certificate at no extra charge. Check the level of cover and the conditions, as it is a modest policy rather than a full solution.
It can help your wider insurance position
Insurers want evidence that controls are in place. Certification gives you something concrete to point to when you renew.
It finds the things nobody had noticed
This is the benefit people mention most. Going through the questions tends to surface an old machine running unsupported software, a former employee whose account is still active, or a system where everyone has administrator rights.
It gives your team something to work to
A certificate with an annual renewal date creates a rhythm. Security stops being an occasional worry and becomes a yearly task with a deadline.
Cyber Essentials or Cyber Essentials Plus?
There are two levels, covering the same five controls.
Cyber Essentials is a self-assessment questionnaire, reviewed and verified by an assessor. Most small businesses with tidy systems get through it quickly.
Cyber Essentials Plus covers the same ground, but a certification body also tests your actual systems to check the controls work. That includes vulnerability scans and checks on a sample of your devices. It takes longer and costs more, but it gives stronger assurance to you, your clients and your stakeholders.
Which one you need usually depends on who is asking. Many tenders and supply chains now ask for Cyber Essentials, and some charity funders do too. It is required for some central government contracts, and some government and defence contracts ask for Plus. If a customer or contract specifies Plus, you need Plus. Otherwise the base certification is a sensible starting point, and many businesses do that first and step up later.
Note: Cyber Essentials Plus must be completed within three months (90 days) of passing or renewing Cyber Essentials.
What it costs
Base certification is priced by the size of your organisation and starts in the low hundreds of pounds plus VAT for a micro business. Cyber Essentials Plus is quoted separately and depends on the size and complexity of your systems, so it typically runs into the low thousands.
Budget for remediation as well. If the assessment finds old kit or unsupported software, fixing it is often the larger cost. That is not a reason to avoid the process. It is the point of it. It is better to be proactive, than wait for a cyber attack to prompt you to update your systems.
How to get started:
Talk to whoever manages your IT. They will know straight away whether you are close or have work to do.
Take stock of your devices. Every laptop, phone and server in use, including personal devices used for work.
Deal with the obvious gaps first. Unsupported software, shared logins and missing multi-factor authentication are the usual culprits.
Apply through a certification body. They guide you through the questionnaire and review your answers.
For most well-run small businesses, certification is achievable in weeks rather than months.
Our IT partner can help
We work with TwentyFour IT Services, an IASME licensed and accredited certification body. They can certify your business for both Cyber Essentials and Cyber Essentials Plus. They handle the whole process: the assessment, any fixes needed along the way and the technical audit for Plus.
They also offer an ongoing Compliance Management service to help you keep your certification year after year, with regular reviews, guidance and help gathering evidence.
If you would like an introduction, get in touch and we will connect you with the right person.
This article is for general guidance only. Certification requirements and costs change, so check the current position before you commit.
