Does my small business need Cyber Essentials?

You almost certainly need Cyber Essentials if you bid for UK government contracts, work with the NHS or public sector bodies, handle sensitive personal data, or are applying for cyber insurance. It is also strongly recommended for any small business that wants a structured security baseline.

What is the difference between Cyber Essentials and Cyber Essentials Plus?

Cyber Essentials is a self-assessment questionnaire reviewed by an independent assessor. Cyber Essentials Plus goes further: an assessor independently tests your controls rather than taking your word for it. Most small businesses start with Cyber Essentials and add Plus if a client requires it.

How much does Cyber Essentials certification cost?

Cyber Essentials self-assessment certification currently costs £300 plus VAT for most small businesses. Cyber Essentials Plus costs more due to the hands-on testing involved. An IT support provider can help you prepare and complete the assessment, reducing the time investment significantly.

What are the five controls covered by Cyber Essentials?

The five Cyber Essentials controls are: firewalls (protecting internet-facing devices), secure configuration (removing unnecessary features and changing default passwords), user access control (minimum necessary access per account), malware protection (antivirus and application control), and patch management (applying security updates within 14 days of release).

What is the difference between Microsoft 365 Business Standard and Business Premium?

Business Standard includes the full Office apps, Teams, Exchange email, SharePoint, and OneDrive. Business Premium adds enterprise-grade security: Microsoft Defender for Business, Intune device management, Azure AD Premium P1 for conditional access, and information protection. Almost all of the price difference is in security and device management.

How much does Microsoft 365 Business Premium cost?

At the time of writing, Microsoft 365 Business Premium costs around £26 per user per month on an annual commitment, compared to approximately £10.30 for Business Standard. The extra cost covers significant security features including Defender for Business and Intune device management.

Does a small business need Microsoft 365 Business Premium?

Almost every small business handling client data, financial records, or personal data should be on Business Premium. If your staff use personal phones or laptops to access work email, if you hold sensitive data, or if a ransomware attack would seriously disrupt operations, Business Premium is the right choice.

Can you mix Business Standard and Business Premium licences?

Yes. Microsoft allows you to mix licence tiers within the same tenancy. A common approach is to put directors and finance staff on Business Premium (higher security) and other staff on Business Standard, which reduces overall costs while protecting the highest-risk accounts.

How much should a small business spend on IT?

For most small businesses with 5 to 50 staff, IT running costs typically land between £100 and £200 per employee per month, all-in. Below that, most businesses are underspending and paying for it in risk and downtime. This figure includes licences, support, hardware refresh, connectivity, and cyber security.

What are the main IT costs for a small business?

The main IT cost categories are: Microsoft 365 or Google Workspace licences (£20-£30 per user per month), managed IT support (£40-£70 per user per month), cyber security add-ons (£5-£15 per user per month), hardware refresh budget, connectivity (broadband and backup), and line-of-business software.

What IT costs do small businesses most often forget to budget for?

The most commonly overlooked IT costs are: hardware refresh (laptops every 3-4 years), a backup broadband line, cyber security training, the cost of occasional IT projects (office moves, migrations), and the time cost of managing IT internally rather than outsourcing it.

Does a small business need a password manager?

Yes. Most small business account breaches happen through password reuse, weak passwords, or shared credentials with no audit trail. A business password manager gives every account a unique, randomly generated password, central admin control, and one-click offboarding when a staff member leaves.

What is the best password manager for a small business?

1Password Teams is the most recommended for ease of use and quality of mobile and desktop apps. Bitwarden Teams is an excellent cheaper alternative (open source, around £4 per user per month). Both support shared vaults, central admin, and emergency access.

How much does a business password manager cost?

Business password managers typically cost between £4 and £8 per user per month. For a 10-person team that is £40 to £80 per month, making it one of the most cost-effective security investments a small business can make.

Are password managers safe for a business?

Yes. Reputable business password managers use end-to-end encryption, meaning even the provider cannot see your passwords. They are significantly safer than Excel files, sticky notes, or shared credentials. Using MFA on the password manager itself adds an additional layer of protection.

MFA stands for multi-factor authentication (also called two-factor authentication or 2FA). It means proving your identity with more than just a password: typically a password plus an approval on your phone. If an attacker steals your password, they still cannot log in without also having your phone.

Why does a small business need MFA?

MFA blocks approximately 99% of password-based attacks. Passwords are routinely stolen through data breaches, phishing, and malware. With MFA enabled, a stolen password alone is not enough for an attacker to access your Microsoft 365 email, files, or Teams. It is free, built into Microsoft 365, and takes minutes to set up.

What is the best MFA method for a small business?

Authenticator apps (such as Microsoft Authenticator) are the recommended method for most small businesses: free, secure, and work offline. Physical security keys (YubiKey) are the strongest option for directors and finance staff. SMS text codes are better than nothing but should be avoided for high-privilege accounts.

Does MFA slow down logging in?

On a trusted device, MFA typically only asks for approval once every 30 days. The actual friction is around ten seconds on a new device login. Most businesses find staff stop noticing within a week. The security benefit far outweighs the minor inconvenience.

Is MFA free with Microsoft 365?

Yes. Basic MFA using the Microsoft Authenticator app is included in all Microsoft 365 business plans at no extra cost. More advanced features like conditional access (requiring MFA only from untrusted locations) are available in Business Premium.

Blog

News, advice and guides for small business IT in Kent and the South East.

A modern laptop with a glowing green padlock icon, representing Cyber Essentials certification

Written by Trevor Whittle on 27 March 2026.

What is Cyber Essentials and Does Your Business Need It?

Cyber Essentials is the UK government-backed cyber security certification scheme. It was developed by the National Cyber Security Centre (NCSC) to give businesses a clear baseline of cyber security controls and a way to demonstrate to clients that those controls are in place.

If you've been asked about Cyber Essentials by a client, a partner, or your public liability insurer, this article covers what it is, what it involves, and whether it's the right thing for your business.

Two grey archive boxes side by side, the larger one outlined in green, symbolising Microsoft 365 Business Standard and Business Premium licensing choices

Written by Trevor Whittle on 06 March 2026.

Microsoft 365 Business Standard vs Business Premium: Which Do You Need?

Microsoft 365 is the backbone of how most small businesses work. Email, documents, Teams meetings, shared files, the lot. Yet almost every new client I take on is either on the wrong plan or is paying for seats they don't use.

The two plans most small businesses end up choosing between are Business Standard and Business Premium. They look similar on the surface, but the difference is significant, and it's not really about features. It's about security.

Small business owner at a desk with a spreadsheet on the laptop, a calculator and a handwritten budget notepad

Written by Phil on 27 February 2026.

What to Put in a Small Business IT Budget

"How much should we be spending on IT?" is one of the questions I'm asked most. Most small business owners either guess too low (and end up firefighting every month) or too high (because their current provider charges for everything on an ad-hoc basis). Neither is comfortable.

Here's how I break a sensible IT budget down for a small UK business. These are the real numbers I use when I quote new clients, not made-up benchmarks.

Laptop screen showing a password manager interface with colourful entries on a tidy desk

Written by Phil on 20 February 2026.

Password Managers for Small Business: Why You Need One and How to Choose

Every small business I start working with has the same problem. Passwords live in one of three places: a shared Excel file, a single sticky note under the keyboard, or someone's head ("ask Sharon, she knows them"). None of these scale, and all of them fail badly the first time Sharon is on holiday and the bank locks the account.

A proper password manager is the single cheapest security upgrade you can make. Here's why, what it does, and how to actually get one rolled out without your team revolting.

Hands holding a smartphone showing a six-digit authentication code next to a laptop login screen

Written by Phil on 13 February 2026.

What is MFA? A Plain-English Guide for Small Businesses

Of all the security advice I give small business owners, turning on MFA is the single most important one. It blocks roughly 99% of the password-based attacks I see in the wild. It's free, built into Microsoft 365, Google Workspace, banking apps, and most business software. And yet at least a third of the businesses I start working with still don't have it enabled for everyone.

So here is MFA without the jargon: what it is, why it matters, and how to set it up properly so it actually protects you without driving your team mad.