What is Cyber Essentials?

Cyber Essentials is a UK government-backed certification scheme, run by IASME on behalf of the National Cyber Security Centre (NCSC), part of GCHQ. It confirms that a business has five basic technical controls in place — firewalls, secure configuration, user access control, malware protection and security update management — to defend against the most common internet-based attacks. It is delivered as a self-assessment questionnaire, verified by an accredited certifying body, and results in a certificate and badge valid for 12 months. For most UK SMEs it is the entry point into structured cyber security, and increasingly a precondition for winning contracts and securing cyber insurance.

You complete a self-assessment questionnaire describing how the five controls are implemented across every device, network and cloud service in scope — including laptops, phones, servers and services like Microsoft 365. An accredited certifying body reviews your answers and asks follow-up questions where anything is unclear. Once satisfied, they issue certification. There is no on-site visit or technical scan at the basic level; that step is added for Cyber Essentials Plus, which independently verifies the same controls through vulnerability scans and device checks rather than relying on self-reported answers alone.

Because it closes the gaps that cause most SME breaches, and it opens doors commercially. Certification is mandatory for many UK government contracts, increasingly requested by larger private-sector clients during procurement, and often required — or rewarded with lower premiums — by cyber insurers. Beyond compliance, the five controls it enforces genuinely block the bulk of opportunistic, automated attacks aimed at small businesses, such as credential stuffing and unpatched remote access exploitation. It is a low-cost way to demonstrate credibility to customers, suppliers and insurers while meaningfully reducing your actual risk.

The certification body fee for Cyber Essentials is fixed nationally and scales with organisation size, typically a few hundred pounds for a small business. The larger and more variable cost is remediation — closing gaps in patching, multi-factor authentication, admin account controls and device configuration before you apply. Many SMEs already meet most requirements and only need targeted fixes, keeping total cost modest. Cyber Essentials Plus, with its independent technical audit, costs more than the basic level because it includes on-site or remote scanning and device sampling rather than a paper-based review.

For a well-prepared SME, certification typically takes two to eight weeks from start to finish. Most of that time is spent on preparation — fixing gaps in patching, enabling multi-factor authentication, tidying admin accounts and correcting device configuration — rather than on the assessment itself, which is usually reviewed within a few working days once submitted. Businesses starting from a weaker position, with legacy devices or no consistent patching process, should budget closer to the upper end. Using a support partner to run gap analysis up front usually shortens the timeline significantly.

Yes — it was specifically designed with small and medium businesses in mind, unlike heavier frameworks such as ISO 27001. The five controls are achievable without a dedicated IT security team, and many SMEs already meet most of them through standard use of Microsoft 365, modern firewalls and up-to-date devices. A five-person consultancy and a 200-person manufacturer both certify against the same scheme. It is proportionate, affordable and recognised across sectors, making it the natural starting point for any UK SME that has not yet formalised its cyber security.

Cyber Essentials is a self-assessment questionnaire verified by a certifying body based on your written answers. Cyber Essentials Plus covers the same five controls but adds an independent technical audit, including vulnerability scans and hands-on checks across a representative sample of your devices. Plus provides much stronger assurance because it verifies what is actually configured rather than what is reported, which is why it is often specified in higher-value contracts and by insurers wanting more confidence. Most businesses start with basic Cyber Essentials and move to Plus once their controls are consistently in place.

Cyber Essentials is narrower and faster than ISO 27001. It focuses on five specific technical controls rather than a full information security management system covering policy, risk assessment, physical security and governance. ISO 27001 requires ongoing internal audits and typically takes months to implement, whereas Cyber Essentials can be achieved in weeks and is renewed annually through a lighter process. Many SMEs treat Cyber Essentials as the practical baseline and only pursue ISO 27001 later if a client or sector specifically requires the broader management system it certifies.