Cyber Essentials: What It Is and Whether Your Business Needs It

If a customer has asked for a Cyber Essentials certificate, or you have seen it on a tender form, you may be wondering what it involves and whether it is worth the effort. This guide explains the scheme in plain terms and the practical points that tend to trip small businesses up.

What Cyber Essentials is

Cyber Essentials is a UK government backed certification scheme showing that your business has a set of basic security controls in place. It is overseen by the National Cyber Security Centre (NCSC), part of GCHQ, and delivered by IASME, the NCSC's delivery partner. IASME licenses a network of certification bodies, and one of these will assess your business.

There are two levels.

• Cyber Essentials is based on a self assessment questionnaire. You answer questions about how your IT is set up, a senior person signs to confirm the answers are accurate, and a certification body assesses your answers against the scheme's requirements. This level does not include independent technical testing.
• Cyber Essentials Plus covers the same controls but adds hands-on technical testing. An assessor checks a sample of your devices and systems to confirm your setup works as described.

Most small businesses start with the basic level and move to Plus if a contract demands it.

The five controls in plain English

The scheme is built around five technical controls. None of them is exotic: they are the basics that help stop many common attacks, such as automated attempts to exploit weak passwords and known software flaws.

• Firewalls. Devices that connect to the internet should be protected by a properly configured firewall, whether in your office router or built into a laptop. Default admin passwords must be changed and unnecessary services switched off.
• Secure configuration. Default settings may need changing before devices and software meet the requirements. That means removing unused software and accounts, changing default passwords and making sure devices lock when left alone.
• Security update management. Software and firmware must be supported and kept up to date. Updates fixing high-risk or critical vulnerabilities must be installed within 14 days of release. This includes fixes with a CVSS score of 7 or above and those where no severity rating is published. Automatic updates make this much easier.
• User access control. People should only have access to what they need. Administrator accounts should be separate from everyday ones, and leavers' accounts removed. Multi-factor authentication must be enabled on cloud services for all users, not just administrators.
• Malware protection. Devices need protection against malicious software, for example through anti-malware software or by restricting which applications can run.

Why businesses get certified, and its limits

Often the reason is simple: a customer asks for it. Some central government contracts require Cyber Essentials, particularly where suppliers handle personal information or provide certain IT services. Some larger companies ask suppliers for it too, because a weak supplier can become a route into their own systems.

It can also help with cyber insurance. Whether it affects your cover or premium depends on the insurer, so ask yours directly. IASME's website explains any insurance linked to certification and who is eligible.

The less obvious benefit is that working through the requirements makes you fix things that have been put off: the old laptop nobody updates, the shared admin password, the former employee who still has an email login.

Certification has limits, though. It is not a legal requirement for businesses generally, it is not proof of UK GDPR compliance and it does not guarantee you will not be attacked. Your data protection security duties remain risk-based, and the ICO explains what they involve. Backups, staff awareness and incident planning also matter but sit largely outside the five controls.

Your situation may be slightly different. ask a question below ↓ and our editorial team will reply with our advice.

Common sticking points

• Certificates last a year. The assessment is redone at each renewal, so diary the date well in advance.
• The requirements change. They are updated periodically, along with the question set. Check the current versions on the NCSC and IASME websites rather than relying on last year's answers.
• Cloud services are in scope. Online email, file storage and accounting accounts all count, so make sure multi-factor authentication is switched on for everyone.
• Home working. Personal phones or laptops used for work email or company files are generally in scope and need appropriate firewall protection. The employee's own home router is generally outside scope. Devices used only for multi-factor authentication have a specific exception, so check the current requirements for the detail.
• Unsupported software fails. Anything no longer receiving security updates, such as an old version of Windows, an out-of-date phone or an ageing router, must be replaced or removed from the assessed scope. Excluding it means appropriately segregating it and documenting the exclusion clearly. Simply moving it to another Wi-Fi network does not solve the problem.

How to get started

1. Read the current requirements on the NCSC website.
2. Decide what the certificate will cover. It can be the whole organisation or a clearly defined part, but some customers require whole-organisation certification, and exclusions must not make the certificate misleading.
3. List everything in scope: computers, phones, tablets, servers, routers, cloud services and personal devices used for work.
4. Check each item against the five controls and fix what falls short, starting with unsupported software and missing updates.
5. Use the IASME website to find a certification body and review the current question set.
6. Complete and submit the questionnaire honestly, and deal with any queries raised.
7. If you need Plus, book the testing early. It must be completed within three months of your basic certification, so plan both stages together.

Basic certification has published pricing based on organisation size, set out on the IASME website. Plus testing and preparation support vary between certification bodies, so compare a few and check whether VAT is included, how retests work and whether help with fixing problems is part of the price.

If you have an IT support provider, ask them to check your setup against the current requirements and identify any remediation costs. If you manage your own IT, the NCSC publishes free guidance for small businesses on each control.

Whether you need Cyber Essentials depends on your customers, your insurer and how much you rely on your IT. A certificate shows that the assessed scope met the scheme's requirements at the time of assessment. It is a reasonable baseline, not a sign that every security risk has been dealt with.