Cyber Essentials is the UK government-backed cyber security certification scheme. It was developed by the National Cyber Security Centre (NCSC) to give businesses a clear baseline of cyber security controls and a way to demonstrate to clients that those controls are in place.

If you've been asked about Cyber Essentials by a client, a partner, or your public liability insurer, this article covers what it is, what it involves, and whether it's the right thing for your business.

What does Cyber Essentials actually cover?

The scheme is built around five technical controls that the NCSC considers the most effective defences against the most common cyber attacks:

1. Firewalls
Your internet-facing devices must be protected by properly configured firewalls. This means reviewing default settings and ensuring only necessary ports and services are accessible.

2. Secure configuration
Devices and software should be configured securely from the start. Default passwords must be changed, unnecessary features disabled, and software set to apply security updates.

3. User access control
User accounts should have the minimum access necessary to do their job. Administrator accounts should only be used when needed. This limits the damage if an account is compromised.

4. Malware protection
Appropriate protection against malware (viruses, ransomware, etc.) must be in place. This can be a combination of anti-malware software and application control to prevent unapproved software running.

5. Patch management
Operating systems, software, and firmware must be updated within 14 days of security patches being released. Out-of-date software is one of the most common attack vectors.

Cyber Essentials vs Cyber Essentials Plus

There are two levels of certification:

Cyber Essentials is a self-assessment. You complete a questionnaire confirming that the five controls are in place. An independent assessor reviews your answers and certifies you if they're satisfied. The process takes a few hours of your time (plus preparation work).

Cyber Essentials Plus goes further. An independent assessor visits (or connects remotely) to test your controls themselves, rather than taking your word for it. It's more rigorous, more credible, and required for some higher-value contracts.

Most small businesses start with Cyber Essentials and consider Plus if a client specifically requires it.

Does your business need it?

You almost certainly need it if:

• You bid for UK government contracts (it's been mandatory for handling government data since 2014)
• You work with NHS organisations, local authorities, or other public sector bodies
• You handle sensitive personal data and need to demonstrate security to clients
• You're applying for cyber insurance (many insurers now require it or offer lower premiums for certified businesses)

You'd benefit from it even if you don't strictly need it if:

• Clients ask about your cyber security posture
• You want a structured baseline to benchmark your current security against
• You're growing and want to establish good security habits before complexity increases

You might not need it right now if:

• You're a sole trader working locally with no public sector clients and no sensitive data
• Your immediate priority is getting basic protections in place before thinking about certification

The honest answer is that most small businesses working with other businesses should be working towards Cyber Essentials. It's not expensive, it's not complicated to achieve if your fundamentals are in order, and it signals to clients that you take security seriously.

What does it cost?

The NCSC's certification fee starts at £300 for small organisations (up to 10 IP addresses). Costs rise with size and complexity of the network. Cyber Essentials Plus costs more due to the assessor's time for hands-on testing.

There's also preparation work to consider. If your current setup doesn't meet the five controls, you'll need to bring it into compliance before applying. This is where an IT support provider earns their fee: identifying the gaps and fixing them before the assessment.

How ClearPath can help

I can review your current setup against the Cyber Essentials requirements, identify what needs to change, and prepare your systems for certification. I can also help you complete the self-assessment questionnaire.

If you're unsure whether Cyber Essentials is right for your business, or you've been asked about it by a client and don't know where to start, get in touch for a no-obligation conversation.

ClearPath IT Services provides cyber security support for small businesses across Kent, Medway and South East London.