Cyber Essentials is the UK government’s own answer to a question many small business owners struggle with: what does “good enough” cyber security actually look like? Rather than leaving businesses to guess at an appropriate level of protection, Cyber Essentials sets out a clear, achievable baseline and offers formal certification to demonstrate it has been met.
This is the final spoke in our cyber security cluster. For the full checklist this fits into, see our pillar guide on the cyber security checklist for UK small businesses.
What Cyber Essentials Is
Cyber Essentials is a UK government-backed certification scheme, overseen by the National Cyber Security Centre, designed to help organisations protect against common cyber attacks. It is built around five technical control areas and is specifically designed to be achievable for small businesses without requiring specialist in-house expertise.
The Five Core Controls
| Control Area | What It Covers |
|---|---|
| Firewalls | Properly configured firewalls protecting the business network |
| Secure configuration | Devices and software set up securely, with default settings changed |
| Security update management | Software and systems kept up to date with security patches |
| User access control | Access limited appropriately, with strong authentication in place |
| Malware protection | Protection against viruses and other malicious software |
Cyber Essentials vs Cyber Essentials Plus
The standard Cyber Essentials certification is based on a self-assessment questionnaire, verified by an independent assessor. Cyber Essentials Plus goes further, including a hands-on technical audit of the business’s systems, offering a higher level of assurance but requiring more preparation and typically a higher cost. Most small businesses starting out begin with the standard certification.
Why a Small Business Might Pursue Certification
- Winning tenders and contracts. Many public sector and larger commercial contracts require Cyber Essentials certification as a precondition of bidding.
- Customer confidence. Certification provides a recognised, independently verified signal of security practice to customers and partners.
- Cyber insurance. Some insurers offer more favourable terms, or require certification as a condition, when assessing cyber insurance policies.
- A structured starting point. For a business without existing security expertise, the certification process itself provides a clear, practical roadmap to follow.
Preparing for Certification
Before starting the formal assessment, most of the preparation work involves confirming the actual scope, which devices, services, and locations will be included, since this affects what needs to be reviewed and evidenced. From there, working through each of the five control areas, addressing any gaps identified, puts the business in a strong position before the formal self-assessment questionnaire is submitted.
Common Gaps Businesses Discover During Preparation
| Common Gap | Why It’s Often Missed |
|---|---|
| Unsupported or outdated software still in use | Older systems kept running without a clear replacement plan |
| Default router or admin credentials unchanged | Assumed to be secure since they were never actively configured |
| Personal devices used for business without adequate controls | Not considered part of the business’s security scope |
| Inconsistent access control across cloud services | Access granted informally over time without a periodic review |
The Certification Process
- Confirm the scope of assessment, including devices, services, and locations to be included
- Review the business against each of the five control areas and address any gaps
- Complete the self-assessment questionnaire
- Submit for independent review by a certified assessor
- Receive certification, valid for twelve months before renewal is required
Frequently Asked Questions
Is Cyber Essentials certification mandatory for UK small businesses?
No, it is not legally mandatory for most businesses, though it is often a required precondition for specific contracts, particularly with public sector organisations or larger companies with their own supply chain security requirements.
How long does Cyber Essentials certification last?
Certification is valid for twelve months, after which it needs to be renewed through a fresh assessment to remain current.
Does achieving certification guarantee a business cannot be attacked?
No certification can guarantee complete protection against every possible attack. Cyber Essentials significantly reduces exposure to the most common attack methods, but ongoing vigilance and good practice remain important alongside certification.
How long does the certification process typically take?
Timelines vary depending on how much preparation is needed to address any gaps identified, but many small businesses with reasonably good existing practices can complete the process within a few weeks.
About the author: The Business To World editorial team covers practical business, banking, investment and property guidance for UK small business owners and entrepreneurs.