Is Cyber Essentials worth it for small businesses?

What is Cyber Essentials?

Cyber Essentials is a UK government-backed certification scheme managed by the NCSC (National Cyber Security Centre). It defines five basic technical controls that, when properly implemented, protect organisations against the vast majority of common cyber attacks.

The five controls are: firewalls, secure configuration, user access control, malware protection, and patch management. If those sound straightforward, that's intentional — Cyber Essentials deliberately focuses on the basics, because most successful attacks exploit basic security failures rather than sophisticated vulnerabilities.

Two levels of certification

There are two tiers. Cyber Essentials is a self-assessment questionnaire, verified by an accredited certifying body. The certification fee is set by IASME and varies by organisation size — between £320 and £600 + VAT depending on employee headcount. Cyber Essentials Plus adds a hands-on technical verification by an assessor who actually tests your systems — it costs more (typically £1,500–3,000 depending on size) but carries more weight.

For most small businesses, the base Cyber Essentials certification is the right starting point.

Who actually needs it?

If you want to bid for UK central government contracts that involve handling personal data or providing certain technical services, Cyber Essentials is mandatory. This has been the case since 2014 and enforcement has tightened significantly.

Beyond the public sector, an increasing number of larger private sector organisations now require it from their suppliers as part of their own security due diligence. If you're selling to enterprise clients, expect to be asked for it.

The honest case for smaller businesses

Even if you're not targeting government contracts, Cyber Essentials has real value. The process of preparing for it forces you to actually look at your security posture — many businesses discover during preparation that they have gaps they didn't know about. Unpatched devices, shared admin accounts, no MFA on email — these are common findings.

There's also the insurance angle. Organisations that achieve Cyber Essentials certification (and have a turnover under £20m) may also qualify for bundled cyber insurance through the certification scheme, depending on eligibility. That alone can offset the certification cost.

What does preparation actually involve?

The most common gaps we find during assessments are: MFA not enforced on all accounts (especially email), devices running outdated software or operating systems, overly permissive user access (people with admin rights who don't need them), and firewall configurations that haven't been reviewed since setup.

None of these are difficult to fix — but they take time to do properly, and doing them wrong means failing the assessment. Working with someone who's been through the process makes it significantly less painful.

Our view

For most UK small businesses, Cyber Essentials is worth doing. The cost is modest, the process improves your actual security, it opens doors commercially, and it's a credible signal to clients that you take data protection seriously. For many businesses, the question is less whether to do it and more how to approach it efficiently.