Cyber Essentials Certification: A Small Business Guide
Cyber Essentials is the UK government-backed scheme that proves your business has the basic security controls in place. This guide is for UK small businesses, and for suppliers to UK organizations, who want to understand the five controls, choose between the Basic and Plus levels, and get through certification without surprises.
Key takeaways
- Cyber Essentials covers five technical controls: firewalls, secure configuration, user access control, malware protection and security update management.
- The Basic level is a self-assessment questionnaire verified by a certification body. Cyber Essentials Plus adds hands-on technical testing by an assessor.
- High-risk or critical security updates must be applied within 14 days of release.
- Certificates must be renewed every 12 months, and some UK government contracts require certification.
Cyber Essentials is a UK government-backed certification scheme, delivered through IASME, that sets a baseline for protecting an organization against common internet-based attacks. It does not try to cover everything in security. Instead, it focuses on a handful of controls that stop a large share of everyday threats, such as attacks on unpatched software, guessed or stolen passwords and malware.
For a small business, that narrow focus is a strength. The requirements are specific enough to act on, the certificate is widely recognized, and working through the questions often reveals gaps you did not know you had. This guide explains what is involved, how to prepare and what to expect. Requirements are updated from time to time, so always check the current question set and guidance from IASME and the NCSC before you apply.
Why small businesses get certified
There are three common reasons to pursue Cyber Essentials, and most businesses have at least one.
- Contracts: some UK government contracts require Cyber Essentials, and many larger organizations ask their suppliers for it during procurement.
- Customer trust: the certificate gives customers a recognized signal that you take security seriously, which can help in sales conversations.
- Better security: preparing for the assessment forces you to tidy up accounts, update devices and document how your systems are set up.
Even if nobody asks you for it, the five controls are a sensible checklist for any small business. Many of them overlap with our general cybersecurity checklist, but Cyber Essentials is more precise about what "done" looks like.
The five Cyber Essentials controls
Each control comes with specific requirements in the official question set. Here is what each one means in practice for a small office.
1. Firewalls
Every device that connects to the internet should be protected by a correctly configured firewall. That usually means the firewall in your router or office network, plus the software firewall built into each computer, which matters most when laptops are used outside the office. Change default admin passwords on routers and firewalls, and block services you do not need from being reached from the internet.
2. Secure configuration
Devices and software often come with settings that favor convenience over security. Secure configuration means removing or disabling software and accounts you do not use, changing default passwords, turning off features that run files automatically, and making sure devices lock or require authentication before anyone can use them.
3. User access control
People should have only the access their role requires. Administrator accounts should be used only for admin tasks, not for email or web browsing. Accounts must be removed or disabled when people leave, and strong authentication, including multi-factor authentication for cloud services where it is available, protects logins.
4. Malware protection
Devices need protection against malicious software. This is commonly anti-malware software kept up to date, and the scheme also recognizes approaches such as allowing only approved applications to run. Built-in tools on modern operating systems can be enough when configured and kept updated.
5. Security update management
Software must be licensed, supported by the vendor and kept up to date. This is often where small businesses find their biggest gaps, such as an old laptop running an unsupported operating system or a router that no longer receives updates.
Common mistake
Forgetting one old device. A single unsupported laptop, tablet or phone used for work can stop you passing, because unsupported software cannot receive security updates. List every device that accesses company data or email, including personal phones if they are in scope, and replace or remove anything that is out of support.
Cyber Essentials vs Cyber Essentials Plus
There are two levels. Both cover the same five controls; the difference is how your answers are checked.
Cyber Essentials (Basic)
- Self-assessment questionnaire completed online
- Answers verified by a certification body
- Quicker to complete and simpler to prepare for
- A good first step for most small businesses
Cyber Essentials Plus
- Same controls, plus hands-on technical testing by an assessor
- Assessor checks a sample of your devices and systems
- Gives stronger assurance to customers who ask for it
- Needs more preparation and evidence
Most small businesses start with the Basic level, then move to Plus if a customer or contract requires it. Prices vary by organization size and by level, so get current figures from IASME or a certification body rather than relying on old quotes.
Cloud services and home workers
Small businesses often assume Cyber Essentials is only about computers in the office. In practice, the cloud services you rely on, such as email, file storage and accounting software, are usually part of the picture, and so are the laptops and phones your team uses at home. You remain responsible for the settings you control in those services, such as user accounts, admin rights and MFA, even though the provider runs the underlying systems.
Home workers need the same controls as office staff: supported devices, automatic updates, malware protection and a software firewall on each computer. Before you start the questionnaire, ask each person which devices they use for work, including any personal phone that receives company email, and add them to your list. It is much easier to sort this out in advance than to discover it halfway through the assessment.
How to get certified, step by step
The process is straightforward if you prepare properly. Expect most of the work to happen before you open the questionnaire.
- Read the current requirements. Download the latest requirements document and question set from IASME or the NCSC. The questions change periodically, so make sure you use the current version.
- Decide your scope. Usually the whole organization. If you limit scope to part of the business, the boundary must be clearly separated, which is harder for small offices.
- List every device and service. Computers, phones, tablets, servers, routers, firewalls and cloud services such as email and file storage. Note the operating system, version and who uses each one.
- Fix the gaps. Replace unsupported devices, change default passwords, remove unused accounts, turn on automatic updates, enable MFA on cloud services and check malware protection.
- Choose a certification body. IASME lists licensed certification bodies. Many offer guidance or readiness checks.
- Complete the questionnaire honestly. Answer for your actual setup, not your intended one. A senior person signs off that the answers are true.
- Respond to feedback. The assessor may ask for clarification or point out answers that do not meet the requirements.
- Book Plus testing if needed. For Cyber Essentials Plus, the assessor tests a sample of devices after the Basic certification.
Pro tip
Keep your device list in a simple spreadsheet with columns for owner, operating system, version, update status, encryption and malware protection. It makes the questionnaire much faster, and you can reuse it every year at renewal.
Example
Imagine a fictional eight-person accountancy firm, Millbrook Accounts, bidding for a public sector contract that asks for Cyber Essentials. While building its device list, the office manager finds a reception PC running an operating system that no longer receives updates and a router still using its factory admin password. She replaces the PC, changes the router password, turns on MFA for the firm's email and removes two accounts belonging to former staff. The firm then completes the questionnaire with confidence and puts a reminder in the calendar for renewal.
Staying compliant all year
A certificate shows you met the requirements on the day of assessment. The real benefit comes from keeping those controls in place.
| Task | How often | Why it matters |
|---|---|---|
| Check updates on all devices | At least monthly, and promptly for critical releases | Meet the 14-day rule for high-risk updates |
| Review user accounts | When anyone joins or leaves, plus quarterly | Remove old access and excess admin rights |
| Update the device list | When devices are bought or retired | Keep scope accurate |
| Replace unsupported equipment | Before vendor support ends | Unsupported software fails the requirements |
| Renew certification | Every 12 months | Certificates expire after a year |
Cyber Essentials does not cover everything. It does not assess backups, staff training or incident response in depth, so pair it with a backup plan, regular security awareness training and a simple incident response plan. The NCSC publishes free guidance for small businesses that fills many of those gaps.
Your Cyber Essentials checklist
- Current requirements and question set downloaded
- Scope decided, usually the whole business
- Complete list of devices and cloud services
- Unsupported devices and software replaced or removed
- Default passwords changed on routers and devices
- Firewalls active on the network and every computer
- Admin accounts separate and used only for admin tasks
- MFA on cloud services where available
- Malware protection active and updating
- Process to apply critical updates within 14 days
- Renewal date in the calendar
Frequently asked questions
Do personal devices count for Cyber Essentials?
Devices that access company data or services, such as email, are generally in scope, including personally owned phones used for work. Check the current requirements for the detail on what is included and how to handle them.
How long does Cyber Essentials certification last?
Certificates must be renewed every 12 months. Set a reminder well before the expiry date so you have time to review your setup.
Can a business outside the UK get Cyber Essentials?
The scheme is designed for UK organizations but is used by suppliers that work with UK customers. Check with IASME or a certification body about your situation.
What happens if I fail the assessment?
Certification bodies explain which answers did not meet the requirements. Fix the gaps and follow their process for resubmission, which can vary between providers.
Related reading
The bottom line
Cyber Essentials turns five security basics into a clear, recognized standard. Start with an honest device list, fix unsupported equipment and default passwords, put a 14-day patching routine in place and choose the Basic or Plus level your customers need. Then keep the controls running all year, so renewal is a formality rather than a scramble.
