← All articles

Cyber Essentials explained for UK small businesses

Cyber Essentials is the UK government-backed baseline for cyber security. Here is what it covers, why it matters, and how to get through it without stress.

Cyber By Kris Wolton CITP 2 min read

If you supply larger organisations, the public sector, or simply want proof that you take security seriously, you will sooner or later be asked: "Are you Cyber Essentials certified?" Here's what that means.

What is Cyber Essentials?

Cyber Essentials is the minimum standard of cyber security recommended by the UK government for organisations of all sizes. It was developed by the National Cyber Security Centre (NCSC) and is designed to protect against the most common, everyday cyber attacks, the kind that target any business with an internet connection, not just high-profile ones.

The five technical controls

The NCSC's Cyber Essentials requirements are organised under five technical controls:

  1. Firewalls, controlling what can reach your devices and network from the internet
  2. Secure configuration, removing default passwords and unnecessary software and accounts
  3. Security update management, keeping operating systems and applications patched
  4. User access control, giving people only the access they need, with strong authentication
  5. Malware protection, stopping malicious software from running

None of these are exotic. That's the point: most successful attacks on small businesses exploit one of these basics.

Cyber Essentials vs Cyber Essentials Plus

According to IASME, which delivers the scheme:

  • Cyber Essentials is an independently verified self-assessment. You answer a questionnaire about your systems, and an assessor reviews it.
  • Cyber Essentials Plus covers the same controls but adds a hands-on technical audit of your systems by an assessor.

Many businesses start with Cyber Essentials and move to Plus when a customer or contract requires it. Certification is priced by organisation size; the NCSC overview lists current costs.

Who needs it?

You should seriously consider Cyber Essentials if you:

  • Bid for public sector or government-related work
  • Supply larger companies that ask security questions in their supplier checks
  • Hold customer personal data
  • Want to show insurers, clients and staff that you've covered the basics

How to prepare (and pass first time)

The questionnaire is straightforward if your IT is well run, and painful if it isn't. Before you apply:

  • Know what's in scope: every laptop, phone, server and cloud service used for work
  • Check updates: devices and software must be supported and patched promptly
  • Turn on multi-factor authentication for cloud services, especially email and Microsoft 365
  • Remove admin rights from day-to-day user accounts
  • Tidy up accounts: disable leavers, remove shared and default logins
  • Confirm malware protection is active on every device

Beyond the certificate

Cyber Essentials is a strong baseline, not the finish line. It doesn't cover everything, backups, incident response and staff awareness matter too. We recommend pairing it with a tested disaster recovery plan and a simple incident response plan your team can follow.

How we can help

Our cyber security experience comes from protecting hyperscale data centres from cyber attack. We bring that rigour, right-sized, to UK businesses: a readiness review, help fixing the gaps, and support through Cyber Essentials and Cyber Essentials Plus.

Related articles