If a customer, tender or insurer has asked whether you hold Cyber Essentials, you're not alone. This UK government-backed scheme has become a common requirement for small businesses, schools, charities and care providers. The good news is that it's designed for organisations like yours. You don't need an in-house IT department to pass, but you do need your systems in reasonable shape before you apply.
Here's what it involves, what drives the cost and how to give yourself the best chance of passing first time.
What is Cyber Essentials?
Cyber Essentials is a certification scheme backed by the National Cyber Security Centre (NCSC). It shows that your organisation has a set of basic but effective security controls in place, the kind that protect against the most common online attacks. The scheme is delivered through IASME and a network of certification bodies across the UK.
There are two levels:
- Cyber Essentials: an online self-assessment questionnaire, which an independent assessor reviews and marks.
- Cyber Essentials Plus: the same requirements, plus a hands-on technical audit. An assessor checks a sample of your devices and accounts to confirm your controls actually work.
Both certificates last 12 months, so you'll need to renew each year. Cyber Essentials Plus has to be completed within a set window after you achieve the basic certificate.
The five technical controls
The questionnaire is built around five areas. Each one is straightforward on paper, but small gaps often trip people up.
Firewalls
Secure configuration
Security update management
User access control
Malware protection
It's also worth knowing that staff-owned phones and laptops used to access work email or files are usually in scope. This catches many small organisations out.
What does Cyber Essentials certification cost?
This is the question most people search for, and the honest answer is that it depends. The cost has three parts.
The assessment fee
Cyber Essentials Plus costs noticeably more because it involves an assessor's time to carry out testing. Prices vary between certification bodies and depend on how many devices, locations and systems need checking.
Getting your systems ready
Your time
One helpful extra: qualifying small UK organisations that certify their whole organisation may receive cyber liability insurance included with the standard certificate. Check the current terms when you apply.
How to pass first time
Most failures come from preparation, not the questionnaire itself. A sensible approach looks like this:
- Decide your scope. Usually it's simplest and most valuable to include your whole organisation.
- List every device, user account, cloud service and piece of software you rely on.
- Remove or upgrade anything unsupported.
- Turn on automatic updates and confirm they're actually installing.
- Enable MFA on Microsoft 365 and other cloud services.
- Separate admin accounts from day-to-day accounts and change any default passwords.
- Check that every device has firewall and malware protection switched on.
- Review the question set before you submit. You can read the questions in advance, which makes it easier to spot gaps.
Answer honestly. The assessor is looking for evidence that the controls genuinely exist, and for Cyber Essentials Plus they'll test them directly.
Do you need help?
Many organisations complete Cyber Essentials on their own, but plenty find it far less stressful with an IT provider preparing their systems and guiding them through the questions. A good provider will carry out a gap analysis, fix the issues, set up ongoing patching and device management, and help keep you compliant for renewal next year. That matters, because Cyber Essentials isn't a one-off exercise. The controls have to stay in place all year round.
If you need Cyber Essentials for a contract, tender or insurance renewal, Cloud 4 Sure can help you work out what's needed and get your systems ready. Get in touch with our team or book a free IT health check, and we'll give you a clear picture of where you stand.