Cyber Essentials Certification: What UK Small Businesses Need to Know

Cyber Essentials certification is a UK government-backed scheme that helps small businesses protect themselves against the most common online threats. If you handle client data, are considering government contracts, or simply want to demonstrate that your business takes security seriously, this certification is worth understanding.

What is Cyber Essentials?

Cyber Essentials is a certification scheme run by the National Cyber Security Centre (NCSC) and delivered by IASME. It gives businesses a structured way to implement basic cyber defences and prove they’ve done so to clients, partners, and insurers.

It’s built around five technical controls: firewalls, secure system configuration, user access management, malware protection, and keeping software up to date. These address the majority of attacks that hit UK businesses every year — mostly opportunistic, automated threats rather than sophisticated targeted hacks.

Cyber Essentials vs Cyber Essentials Plus

There are two levels of certification, and the difference matters.

The basic Cyber Essentials is a self-assessment. You complete a questionnaire confirming that the five controls are in place, a senior officer signs it off, and an external assessor reviews it. It’s suitable for most small businesses starting out with formal security accreditation.

Cyber Essentials Plus goes further. An accredited assessor carries out a technical audit of your actual systems — running vulnerability scans, testing configurations, and verifying that your self-assessment matches reality. It carries more credibility, particularly when bidding for larger contracts or supplying regulated industries.

How much does Cyber Essentials certification cost?

The basic certification starts at around £300–£500 +VAT for most small businesses. Pricing is tiered by organisation size, so a 5-person company pays less than a 50-person one.

Cyber Essentials Plus involves a technical audit, so costs are higher — typically £1,500 to £3,000 +VAT depending on the size and complexity of your IT setup.

One financial benefit worth knowing: UK businesses with a turnover under £20 million that achieve Cyber Essentials covering their entire organisation automatically receive £25,000 of cyber liability insurance at no extra cost, including access to a 24-hour incident response helpline.

Is Cyber Essentials mandatory for small businesses?

For most businesses, it’s not legally required — but it can become effectively mandatory in practice. Any business bidding for UK central government contracts that involve handling personal data or providing certain IT or technical services must hold Cyber Essentials as a condition of eligibility.

Beyond public sector work, it’s increasingly requested by large private-sector clients and insurers. Some cyber insurance providers offer better premiums to certified businesses. And from a practical standpoint, completing the certification often surfaces security gaps that weren’t previously visible.

How to get Cyber Essentials certified

From registration to receiving your certificate, most businesses complete the process in two to four weeks — though you have up to six months from registration to submit if you need time to bring your controls up to standard first.

A good IT support provider can guide you through preparation. They’ll assess your current setup against the five controls, identify any gaps, and help you through the self-assessment or technical audit depending on the level you’re targeting. If your current IT support company doesn’t offer Cyber Essentials support, it may be worth comparing what else is available.

Compare IT support providers and get free, no-obligation quotes.