What it is
Cyber Essentials was launched by the UK government in 2014 and is run by the National Cyber Security Centre (NCSC), with certification delivered through IASME and its network of certification bodies. It is deliberately basic by design: it checks that five technical controls are in place, because those five stop the large majority of untargeted, opportunistic attacks that hit small businesses.
There are two levels. Cyber Essentials is a self-assessment questionnaire, verified by an assessor. Cyber Essentials Plus covers the same controls but adds a hands-on technical audit of your devices and systems by an assessor. Both certificates last twelve months.
The five controls
- Firewalls: every device and your internet connection sit behind a properly configured firewall, with no unnecessary services open to the internet.
- Secure configuration: default passwords changed, unused accounts and software removed, auto-run disabled, devices locked when idle.
- User access control: each person has their own account, administrator rights are only used for administration, and multi-factor authentication is on for cloud services.
- Malware protection: supported anti-malware software on every device, kept up to date, or app allow-listing on devices that support it.
- Security update management: all software is licensed and supported, and updates that fix high or critical vulnerabilities are applied within 14 days.
What it costs
Cyber Essentials self-assessment is priced by the size of the organisation. At the time of writing IASME lists it at £320 + VAT for micro organisations (0–9 staff), £440 + VAT for small (10–49), £500 + VAT for medium (50–249) and £600 + VAT for large (250+). Cyber Essentials Plus is quoted individually by a certification body according to the size and complexity of your network, and typically runs into the low thousands. Check the IASME website for current prices before budgeting.
The bigger cost is usually the work to meet the controls: replacing unsupported devices, turning on multi-factor authentication everywhere, and removing admin rights people have had for years. For a well-run small business that is a few days of effort; for one that has never looked, it can be more.
Who needs it
- Anyone bidding for central government contracts that involve handling personal data or providing certain IT services; it has been a requirement since 2014, and many councils, NHS bodies and large companies now ask their suppliers for it too.
- Businesses whose customers or insurers ask about security. The certificate is a simple, recognised answer.
- Any business that wants a sensible baseline. Even if nobody asks, the five controls are the minimum that stops the common attacks, and working through them finds problems you did not know you had.
Certified organisations with a turnover under £20 million are also usually offered cyber liability insurance as part of the scheme; check the current terms on the IASME site.
Getting ready: a practical checklist
- List every device that touches business data: laptops, phones, servers, and home computers used for work. Anything running an unsupported operating system has to go or be upgraded.
- Turn on multi-factor authentication for email, cloud storage, accounting software and any admin consoles.
- Give everyone their own login; remove shared accounts and old staff accounts.
- Take administrator rights away from day-to-day accounts. Keep a separate admin account for the rare times it is needed.
- Turn on automatic updates everywhere you can, and keep a note of anything that has to be updated by hand.
- Check the router or firewall: change the default password, close any port forwarding you do not need, and disable remote administration from the internet.
- Make sure every device has supported anti-malware software and that it updates itself.
- Agree the scope: whole organisation is simplest and is what most customers expect.
The assessment itself
You register with a certification body, answer the questionnaire online (it covers the five controls in detail and needs a senior person to sign it), and an assessor reviews the answers. Clarifications are normal. Once passed, you receive the certificate and can display the badge; renewal is annual. For Cyber Essentials Plus, the assessor then tests a sample of your devices and your external IP addresses within three months of the self-assessment.
Where the website fits
Cyber Essentials is about your organisation’s devices and accounts rather than your public website, but the two overlap: the website’s hosting, admin logins and update process are part of your systems, and a hacked site is a common way for attackers to get a foothold or to damage a business’s reputation. Good hosting with automatic updates, strong admin authentication and monitoring makes the website one less thing to worry about on the questionnaire.