Is Cyber Essentials worth it for small businesses?

What is Cyber Essentials?

Cyber Essentials is a UK government-backed certification scheme managed by the NCSC (National Cyber Security Centre). It defines five basic technical controls that, when properly implemented, protect organisations against the vast majority of common cyber attacks.

The five controls are firewalls, secure configuration, user access control, malware protection and patch management. If these sound straightforward, that is by design. Cyber Essentials deliberately concentrates on the fundamentals, because most successful attacks exploit basic security failures rather than sophisticated vulnerabilities.

Two levels of certification

There are two tiers. Cyber Essentials is a self-assessment questionnaire verified by an accredited certification body. The certification fee is set by IASME and varies with organisation size, ranging from £320 to £600 plus VAT depending on headcount. Cyber Essentials Plus adds hands-on technical verification, in which an assessor actively tests your systems. It costs more, typically £1,500 to £3,000 depending on size, but carries greater weight.

For most small businesses, the base Cyber Essentials certification is the right starting point.

Who actually needs it?

If you want to bid for UK central government contracts that involve handling personal data or providing certain technical services, Cyber Essentials is mandatory. This has been the case since 2014 and enforcement has tightened significantly.

Beyond the public sector, an increasing number of larger private sector organisations now require it from their suppliers as part of their own security due diligence. If you're selling to enterprise clients, expect to be asked for it.

The honest case for smaller businesses

Even if you are not pursuing government contracts, Cyber Essentials offers genuine value. Preparing for it compels you to examine your security posture properly, and many businesses discover gaps they were unaware of along the way. Unpatched devices, shared admin accounts and email without MFA are all common findings.

There's also the insurance angle. Organisations that achieve Cyber Essentials certification (and have a turnover under £20m) may also qualify for bundled cyber insurance through the certification scheme, depending on eligibility. That alone can offset the certification cost.

What does preparation actually involve?

The gaps we encounter most often during assessments are MFA not being enforced on every account (particularly email), devices running outdated software or operating systems, excessive user privileges (staff holding admin rights they do not need) and firewall configurations that have not been reviewed since installation.

None of these are difficult to fix, but they take time to address properly, and getting them wrong means failing the assessment. Working with someone who has been through the process makes it considerably more manageable.

Our view

For most UK small businesses, Cyber Essentials is worth doing. The cost is modest, the process improves your actual security, it opens doors commercially, and it's a credible signal to clients that you take data protection seriously. For many businesses, the question is less whether to do it and more how to approach it efficiently.