Cyber Essentials is the UK Government backed scheme that shows your business has the basic security controls in place. Here is how it works, what it costs and how to prepare.
If you have ever filled in a client security questionnaire or tendered for public sector work, you have probably been asked whether you hold Cyber Essentials. For many small businesses it is the first formal security certification they consider, and with good reason: it focuses on the basic controls that stop a large share of common, opportunistic attacks.
This guide explains what Cyber Essentials is, what the five controls involve, how certification works, what it costs and how to prepare without it taking over your month.
Cyber Essentials is a UK Government backed scheme, run by the National Cyber Security Centre (NCSC), that sets out a minimum standard of security for organisations of any size. The NCSC works with IASME as its delivery partner, and IASME licenses a network of certification bodies that carry out assessments.
There are two levels:
The questions themselves are updated periodically, and each version has a name. At the time of writing the current question set is called Danzell, which replaced the previous Willow set for assessments purchased from 27 April 2026. IASME publishes the current questions on its website so you can read them before you start, which we recommend.
Everything in Cyber Essentials comes back to five technical controls. In plain English:
| Control | What it means in practice |
|---|---|
| Firewalls | Every device and internet connection is protected by a properly configured firewall, with default admin passwords changed and unnecessary services closed. |
| Secure configuration | Computers and cloud services are set up securely: unused software and accounts are removed, default passwords are changed and devices lock when left unattended. |
| Security update management | Operating systems and software are supported by the manufacturer and security updates rated high or critical are applied within 14 days of release. |
| User access control | People only have the access they need, admin accounts are used only for admin tasks and multi factor authentication is switched on for cloud services wherever it is available. |
| Malware protection | Devices are protected by antivirus or endpoint protection, or by restricting which applications can run. |
The scope normally covers all the computers, laptops, phones, tablets, servers, network equipment and cloud services your business uses, including personal devices that staff use to access work email or data. Unsupported software, such as an old version of Windows that no longer receives updates, is one of the most common reasons businesses are not ready to certify.
Once certified, your business appears on the public register of certified organisations, and you can use the Cyber Essentials badge.
For the basic self assessment, IASME publishes fixed prices by organisation size. According to IASME's published pricing at the time of writing, it costs £320 plus VAT for micro organisations with up to 9 employees, £440 plus VAT for small organisations with 10 to 49 employees and £500 plus VAT for medium organisations with 50 to 249 employees. Check IASME's website for current figures, as prices are reviewed from time to time.
Cyber Essentials Plus is not a fixed price. It is quoted by the certification body and depends on the size and complexity of your IT, because the assessor needs to test a sample of your devices.
Bear in mind that the fee is only part of the cost. The bigger investment is usually the preparation: replacing old equipment, upgrading software and the time spent putting the controls in place. The good news is that this work genuinely improves your security, whether or not you certify.
The assessment itself does not take long once you are ready. The time is in getting ready, and that depends entirely on your starting point. A business with modern, well managed devices and Microsoft 365 already secured may be ready quickly. One with older computers, shared admin passwords and no multi factor authentication will need longer.
Certification is valid for 12 months. To stay on the register you need to recertify every year, answering the question set that is current at the time. Because the requirements are updated, it is worth checking what has changed a few months before your renewal date.
For some organisations it is a requirement. UK Government Procurement Policy Note 014 asks central government departments, their agencies and NHS bodies to require Cyber Essentials, or Cyber Essentials Plus, for contracts that carry certain risks, such as handling personal information or supplying some ICT services. The buyer decides which level is needed for each contract. Larger private companies increasingly ask their suppliers for it too.
Even where nobody demands it, Cyber Essentials is a sensible framework for a small business. It gives you a clear list of things to get right, an independent check that you have done them and a straightforward answer when clients, partners or insurers ask about your security.
You can certify on your own, and some businesses do. In practice most small businesses find it easier with help, because the work is technical and the question set assumes you know exactly what is on your network. A good IT provider can:
Cyber Fits helps businesses in Sunderland and across the North East prepare for Cyber Essentials and Cyber Essentials Plus. We are not a certification body ourselves; we do the preparation work so that you are ready when you apply to one. Find out more on our Cyber Essentials page, or book a free IT review and we will tell you honestly how close you are and what needs to change.
Both cover the same five controls. Cyber Essentials is a self assessment that an assessor reviews. Cyber Essentials Plus adds a hands on technical audit in which the assessor tests a sample of your devices and accounts. You need basic Cyber Essentials first, and IASME states the Plus audit must be completed within three months of it.
Certification is valid for 12 months. You need to recertify each year against the requirements that are current at the time to remain on the register of certified organisations.
Generally, yes, if staff use them to access work email, files or business apps. They must meet the same requirements, such as running a supported operating system and receiving security updates. Check the current IASME guidance for the exact rules on personal devices.
Yes. If your answers show that a requirement is not met, the assessment will not pass. Common reasons include unsupported software, missing multi factor authentication on cloud services and updates not applied in time. Preparing properly beforehand avoids most of these.
No. Certificates are issued by certification bodies licensed by IASME. Cyber Fits helps clients prepare their IT so they are ready to apply.
Our guides are written by the team who support businesses across the North East every day. If anything here raises a question about your own setup, ask us.
Cyber security
Multi factor authentication is one of the most effective security steps a small business can take. Here is how the different methods compare and how to roll MFA out across Microsoft 365 without upsetting your team.
IT strategy
Windows 10 reached end of support on 14 October 2025, and the first year of Microsoft's paid Extended Security Updates for organisations ends on 13 October 2026. Here is what that means and the options for businesses still running Windows 10.
Cyber security
Phishing is the most common cyber attack UK businesses face. This guide covers the warning signs, newer tricks such as AI written emails and QR codes, and exactly what to do if someone clicks.
Book a free, no obligation IT review. We will look at your setup, tell you honestly what needs attention and give you a clear fixed monthly price.
