Cyber Essentials: what it requires and whether it is worth it

The five controls, in plain English

Firewalls: every device must sit behind a properly configured boundary or software firewall, default administrative passwords must be changed, and services must not be exposed to the internet without justification.

Secure configuration: remove or disable what you do not need — unused accounts, default accounts, preinstalled software, unnecessary services. Devices should not ship into use in their out-of-the-box state.

Security update management: everything in scope must be supported by its vendor and patched. High and critical severity updates must be applied within fourteen days of release. Unsupported software must be removed or isolated from the internet.

User access control: accounts are assigned to named individuals, permissions follow least privilege, administrative accounts are used only for administrative tasks, and access is removed when people leave. Multi-factor authentication is required for cloud services.

Malware protection: anti-malware on devices, or application allow-listing, or isolation — one of the approved approaches, applied consistently.

• Firewalls — boundary and device-level, no default passwords
• Secure configuration — remove unnecessary accounts, software and services
• Security update management — supported software, high-risk patches within 14 days
• User access control — named accounts, least privilege, MFA on cloud services
• Malware protection — anti-malware, allow-listing or isolation

Basic versus Plus

Cyber Essentials is a self-assessment questionnaire. You answer it honestly, a senior person signs it off, and a certifying body reviews the answers. Nobody comes to test your systems. This makes it fast and inexpensive, and it makes the value entirely dependent on your honesty — the questionnaire is a forcing function to find out what your environment actually looks like.

Cyber Essentials Plus covers the identical control set but adds independent technical verification: a sample of devices is tested, vulnerability scans are run, and email and web-based malware handling is checked. It is more expensive and takes longer, and it is the level larger clients and government contracts increasingly specify.

The sensible order is basic first, then Plus at the next renewal. Attempting Plus cold, without having done the remediation the self-assessment reveals, is how businesses end up paying for a failed assessment.

Where small businesses actually fail

Failures cluster in a few predictable places, and almost none of them are exotic.

Unsupported software is the most common outright fail: a Windows version past end of support, an old Server 2012 box in a cupboard, a phone no longer receiving security updates. There is no partial credit — unsupported software in scope fails the assessment.

Scope confusion is the second. Businesses forget that Microsoft 365 is in scope, that personal phones used for work email are in scope, and that home working laptops are in scope. Defining scope too narrowly to make certification easier is both a failure risk and self-defeating.

Then the everyday ones: staff working from local administrator accounts, mobile devices with no update policy, ex-employee accounts still active, and MFA missing on one or two cloud services because they were rolled out by a different department.

What it is worth, honestly

Cyber Essentials is a baseline, not a security programme. It will not stop a determined targeted attack and it says nothing about backup, incident response, staff awareness, business email compromise procedures or supplier risk. Treating the certificate as evidence that you are secure is a mistake.

What it does well is specific and valuable: it makes you inventory your estate, it exposes the unsupported software everyone had forgotten, it forces MFA across cloud services, and it produces a document a client procurement team will accept. For many UK small businesses the commercial reason — winning or keeping contracts — is the honest primary driver, and that is a perfectly legitimate reason to do it.

It also tends to pay for itself in adjacent ways: cyber insurance premiums and terms frequently improve with certification, and the licence and account clean-up it forces usually recovers real money.

Preparing efficiently

Read the current requirements document before you start — it is published and it changes annually. Then inventory everything in scope: every device, every cloud service, every user. Most of the effort is here, and most of the surprises are too.

Work through the five controls against that inventory and write down the gaps. Fix the unsupported software first, because it is the automatic fail and usually the slowest to resolve. Then complete the questionnaire. Give yourself four to six weeks for a first certification; the questionnaire itself takes hours, but the remediation it reveals rarely does.