Cyber Essentials: what it is and why it matters
Most business owners have heard the phrase “Cyber Essentials” at some point, usually in a tender document, a client contract, or a conversation with an insurer. But not everyone can say with confidence what it actually involves, or whether it applies to them.
It does, and it’s simpler, and more useful, than most people expect.
What Cyber Essentials actually is
Cyber Essentials is a UK government-backed certification scheme that checks whether a business has the basic technical controls in place to defend against the most common cyber attacks. The National Cyber Security Centre introduced it because most successful attacks on small and medium businesses don’t involve sophisticated hackers or zero-day exploits. They involve gaps that are entirely preventable: unpatched software, weak passwords, poorly configured firewalls, and devices with no proper access controls.
The certification covers five technical control areas:
- Firewalls and internet gateways
- Secure configuration of devices and software
- User access control
- Malware protection
- Security update (patch) management
There are two levels. Cyber Essentials is a self-assessed questionnaire, verified by an external assessor. Cyber Essentials Plus adds a hands-on technical audit, where an assessor tests your systems directly rather than relying on your own answers.
Why it’s worth doing properly
We wouldn’t blame anyone for assuming Cyber Essentials is a compliance formality: a form to fill in so a box can be ticked on a tender. Some businesses do treat it that way, and it shows. Get it right, though, and it becomes something more useful: a genuine check on whether your basics actually hold up.
It also opens doors. Government contracts increasingly require it as a condition of bidding. Insurers ask for it. Larger clients use it as a filter when choosing suppliers, because it gives them a quick, credible signal that a smaller supplier takes security seriously. For businesses trying to win that kind of work, not having it can be a quiet, invisible reason a tender goes nowhere.
What the process looks like
For most SMEs, the standard route starts with a readiness review: working through the five control areas honestly, not in theory but in practice. Where are updates actually being applied? Who has admin rights on which devices, and does that still make sense? Is the firewall configuration something anyone remembers setting up, or was it left on default?
That review usually surfaces a handful of gaps. Some are quick fixes: an overdue update, an account that should have been disabled months ago. Others need more thought, particularly around access control in businesses that have grown quickly or been through staff changes without tidying up permissions behind them.
Once those gaps are closed, the formal assessment is a questionnaire, reviewed and verified by an accredited assessor. It’s not an exam you can fail by accident once the groundwork’s been done properly.
The common misconception
The most persistent myth we hear is some version of “we’re too small to be a target.” It’s understandable: most people picture cyber attacks as targeted operations against large organisations. In practice, most attacks are automated and indiscriminate. They scan for weaknesses, not specific companies, which means a five-person consultancy and a five-hundred-person manufacturer can be equally exposed if the same basic gaps exist in both.
Cyber Essentials exists because those gaps are common, and because closing them stops the majority of attacks that businesses actually face, not the rare, sophisticated ones that make headlines.
Where to start
If you’ve never looked at Cyber Essentials properly, or you tried it once and found the process confusing, the starting point is the same: an honest look at where you stand against those five control areas. That’s usually enough to tell you how much work is involved and how quickly you could be certified.
We work with businesses through the whole process, from that initial review through to the assessment itself, and we’re happy to have a straightforward conversation about what it would take for yours.