Cyber Essentials is a UK government-backed scheme covering a deliberately small set of controls. Its value is proportionate: it will not stop a determined targeted attacker, and it addresses the commodity attacks that account for most incidents affecting small organisations.

The five control areas

  • Firewalls: boundary protection configured deliberately rather than by default.
  • Secure configuration: removing default accounts, unnecessary software, and unused services.
  • User access control: unique accounts, least privilege, prompt removal, and MFA on cloud services.
  • Malware protection: anti-malware, or allow-listing, consistently deployed.
  • Security update management: supported software, patched within defined timescales.

What certification involves

Cyber Essentials is a self-assessment questionnaire verified by a certification body. Cyber Essentials Plus adds independent technical testing of the same controls — vulnerability scanning and verification on a sample of devices. Both are annual, and the basic tier is achievable within weeks for an organised small business.

Where the work usually is

Rarely in buying anything. It is in producing an accurate asset inventory, confirming everything is on supported versions, removing accounts nobody noticed, and documenting what you actually do. Most organisations discover unsupported software and orphaned accounts during preparation, which is itself the benefit.

Why bother

Increasingly it is a contractual requirement, particularly for public sector work and for supplying larger organisations. Some insurers reflect it in pricing. And independent of the certificate, the five areas are a sensible minimum standard — passing means you have closed the gaps behind most commodity attacks.

The limits, stated plainly

It does not cover incident response, backups, logging, staff training, or supplier risk. A certified organisation can still be badly exposed on any of those. Treat it as a floor you clear rather than a programme you complete, and pair it with the fundamentals it omits.