Cyber Essentials guide

Cyber Essentials for small UK businesses

Cyber Essentials is the UK government's baseline for cyber security, run by the National Cyber Security Centre (NCSC) with IASME as its delivery partner. It certifies that five technical controls are in place across your devices and cloud services. This guide is for a firm of one to twenty people with no IT department: what the five controls are, what certification costs and how long it takes, the free tool that tells you how far off you are, and the insurance that comes with the certificate.

Last checked 9 November 2026 against the NCSC's Cyber Essentials pages and Requirements for IT Infrastructure v3.3, IASME's Cyber Essentials, insurance and Readiness Tool pages, and GOV.UK's Cyber Essentials funding package of 3 November 2026. This is general information. Tagnator is not part of, approved by or endorsed by the NCSC or IASME; only an IASME certification body can assess you.

1. What it is and why a small firm bothers

The NCSC calls Cyber Essentials "the minimum standard of cyber security recommended by the Government for organisations of all sizes". It is a self-assessment: you answer a published question set about your IT, the owner or a director signs that the answers are true, and an assessor marks them. A pass gives you a certificate that lasts 12 months, a listing on the NCSC's certificate search, and the right to use the Cyber Essentials mark.

Small firms do it for three reasons. A customer or a public-sector tender asks for it: since 2014 central government has required suppliers on contracts that handle personal or OFFICIAL data to hold Cyber Essentials or Cyber Essentials Plus, and many larger companies ask the same of their suppliers. It fixes the handful of things that most attacks on small firms exploit: unpatched software, no MFA on email, admin rights everywhere. And it comes with cyber insurance for the smallest firms at no extra cost.

There are two levels. This guide is about the basic self-assessment. Cyber Essentials Plus adds a technical audit by an assessor; our guide Cyber Essentials or Cyber Essentials Plus? compares them.

2. The five controls

The NCSC's Requirements for IT Infrastructure v3.3 (April 2026) sets out five technical controls. In plain terms, for a small firm:

Firewalls. Every device sits behind a firewall: the one in your office router or a cloud firewall, and the software firewall built into Windows and macOS, switched on everywhere including laptops at home. The router's default password is changed, and nothing from the internet is allowed in unless there is a written reason for it.
Secure configuration. Devices and cloud services are set up with only what you need: unused software, services and accounts removed; auto-run of downloaded files off; screens that lock when left; and any service you expose to the internet protected by MFA, a strong password rule or a lockout after failed logins.
Security update management. Every operating system and application is still supported by its maker and set to update automatically. Updates that fix critical or high-risk vulnerabilities, which the NCSC defines as those the vendor calls critical or high risk or scores 7 or more on CVSS v3, or whose severity the vendor does not state, are installed within 14 days of release. That includes the firmware of your router and firewall. Software the maker no longer supports is removed.
User access control. Each person has their own account, created only after someone in charge approves it, with the access their job needs and no more. Administrator accounts are separate from everyday accounts, tracked and reviewed. Leavers' accounts are removed. Passwords are at least 8 characters with MFA, or 12 characters, or 8 characters with a block on common passwords. Every cloud service that offers MFA has it switched on for every user and every administrator.
Malware protection. Every computer, laptop, tablet and phone has anti-malware software that updates and scans automatically, or allows only approved applications to be installed, or both; phones and laptops usually need both.

Backing up your data is not one of the five controls, though the NCSC "highly recommend" it. Nor is training, a policy or a risk assessment: Cyber Essentials tests technical settings, not paperwork. The paperwork helps you keep the settings in place and answer the questions that ask you to describe a process.

3. What has to be covered

The certificate covers "the whole of the IT infrastructure used to carry out your organisation's business", or a well-defined and separately managed sub-set. For a small firm, whole organisation is the normal answer and the only one that qualifies for the insurance. That means:

every laptop, desktop, server, tablet and phone that accesses company data or services, including staff-owned devices that read company email or files; a personal phone used only for calls, texts or an authenticator app is out of scope;
every home and remote working device; the home router is out of scope, which is why the device's own firewall must be on;
every cloud service you use, from Microsoft 365 or Google Workspace to accounting, CRM and file storage. The Requirements say cloud services "cannot be excluded from scope";
your office router or firewall.

The practical first step is a list: every device with its make and operating system version, every cloud service, and every account with administrator rights. The question set asks for exactly that, and most of the other answers follow from it.

4. What it costs

IASME sets the assessment fee by size: £320 plus VAT for 0 to 9 employees, £440 for 10 to 49, £500 for 50 to 249 and £600 for 250 or more. That is the whole cost if you do the assessment yourself, which IASME calls the self-led route.

On 3 November 2026 the government launched the Cyber Essentials First Step Fund, a 75% discount for small and medium-sized organisations applying for their first certificate, so that a micro or small firm pays £80 to £110 plus VAT and no SME pays more than £125 plus VAT. IASME's conditions: a UK-based micro or SME organisation that has not held Cyber Essentials in the last four years, subject to eligibility and available funding, with the assessment registered and bought by 31 March 2027. A second scheme, the Cyber Resilience Pledge grant, covers 100% of the fee plus a Cyber Advisor for selected suppliers referred by large organisations that have signed the government's pledge; you cannot apply for it yourself, your customer refers you.

Beyond the fee, the cost is your time and any fixes: replacing a laptop whose operating system is out of support, paying for a mobile device management tool if you want to control phones centrally, or an hour of an IT provider's time to set MFA and update policies in your cloud admin console. If you want help with the questions, IASME offers 30 minutes free with an NCSC assured Cyber Advisor, and certification bodies and Cyber Advisors charge for more.

Cyber Essentials Plus, the audited level, is quoted separately by the certification body and needs the basic certificate first.

5. How long it takes

The assessment itself is a questionnaire in eight sections: your company, scope, insurance, and one section for each of the five controls. If the controls are already in place and you have your asset list, the answers take a few hours spread over a few days, plus the time for the owner or a director to read them before signing. The assessor then marks them; if some answers fall short you get feedback and can correct them.

The time that matters is the preparation. For a firm of one to twenty people with everything in Microsoft 365 or Google Workspace, a month is realistic: a week to list devices and services, a week to fix the automatic fails (updates and MFA), a week for accounts, device settings and malware protection, and a week to answer and gather evidence. A firm that still has an unsupported server or a shared admin login will need longer, because the fix has to be done, not described.

Keep the evidence. The certificate lasts 12 months and the renewal is the same questionnaire, with your previous answers kept in the portal to update.

6. The free Readiness Tool

Before you pay, use the Cyber Essentials Readiness Tool at getreadyforcyberessentials.iasme.co.uk. It is free, run by IASME for the NCSC, and takes you through interactive questions covering the main parts of the requirements. Where your answer shows a gap, it links to guidance on how to close it, and at the end it gives you "a list of actions outlining what steps you need to take to prepare". IASME's users describe it as understandable for people who are not technical. Completing it does not mean you will pass, and it does not submit anything; it is a private rehearsal.

Alongside it, IASME publishes the full question set free so you can prepare answers in a spreadsheet and paste them into the portal. Our guide to the question set explains each section and the five answers that fail the assessment outright.

7. The insurance that comes with it

A UK-domiciled organisation with a turnover under £20m that achieves self-assessed Cyber Essentials covering its whole organisation is entitled to cyber liability insurance arranged by IASME, at no extra cost. The questions in section A3 of the assessment ask whether you qualify and want it; the answers do not affect your result.

IASME's summary of the policy, which is underwritten by American International Group UK Limited and administered by Sutcliffe & Co Insurance Brokers:

a total limit of indemnity of £25,000, with a 24-hour helpline to report an incident that provides crisis management and incident response up to that limit;
covered: liability claims from digital media activities and security and privacy breaches; event management costs such as legal, IT, data recovery, notification and credit monitoring; extortion threats; regulatory investigation defence costs and fines where insurable; business interruption and network interruption losses;
not covered: money stolen by electronic means or cyber fraud; and retentions (excesses) apply.

IASME itself says the £25,000 limit "might be sufficient for a small breach or incident but inadequate for a serious problem or more than one incident", and advises talking to your broker; higher limits are available on request. Treat it as a starting point and an incident helpline, not a reason to drop existing cover. A partial-scope certificate, a Plus-only certificate or a turnover over £20m does not qualify.

8. A plan for a small firm

Week 1: list. Every device with its operating system version, every cloud service, every admin account. Run the Readiness Tool.
Week 2: the automatic fails. Turn on automatic updates everywhere, check router and firewall firmware, replace or remove anything out of support, and enforce MFA for every user and administrator of every cloud service.
Week 3: accounts and settings. Separate admin accounts, remove shared and unused accounts, lock screens, check anti-malware on every device and decide how phones are controlled.
Week 4: answer. Prepare answers in the free question set, collect a screenshot or record for each, get the owner or a director to read and sign, and submit.

Our Cyber Essentials Preparation Kit (£39 plus VAT) gives a small organisation the asset register for step 1, a walkthrough of every question number with the evidence to keep, and the short policies and approval forms behind the processes the questions ask you to describe. It is independent of the NCSC and IASME and does not include the questions themselves, which are free.

9. Sources

Cyber Essentials overview, NCSC: "the minimum standard of cyber security recommended by the Government", the five controls, the two routes and the insurance.
Cyber Essentials: Requirements for IT Infrastructure v3.3, NCSC, April 2026: backing up, scope, BYOD, home working, cloud services, and the requirements for each control.
Cyber Essentials, IASME: prices by size, the self-led and supported routes, the 75% discount conditions and the free 30 minutes with a Cyber Advisor.
Cyber Essentials funding package and the press notice, GOV.UK, 3 November 2026: the First Step Fund (75%) and the Cyber Resilience Pledge grant (100%), and the £80 to £125 plus VAT figures.
Cyber Liability Insurance, IASME: eligibility, the £25,000 limit, what is and is not covered, the insurer and the administrator.
Cyber Essentials Readiness Tool, IASME: what the tool does and produces.
PPN 014: Cyber essentials scheme, GOV.UK: the government contracts that require Cyber Essentials or Plus since 2014.