Cyber Essentials Certification for Small Business

Cyber Essentials certification for small business is the UK government's baseline standard for proving your company protects itself against the most common cyber attacks. It's a self-assessed questionnaire backed by an external scan, and most small businesses can complete it in a few weeks without hiring specialist staff.

What Is Cyber Essentials Certification?

Cyber Essentials is a government-backed certification scheme, run by the National Cyber Security Centre (NCSC), that checks a business has five basic technical controls in place to block the most common internet-based attacks. It exists because most successful cyber attacks on small businesses use simple, widely available tools rather than sophisticated hacking.

You complete a self-assessment questionnaire through an accredited certification body, they run an external vulnerability scan of your systems, and if you pass, you receive a certificate valid for 12 months. Many public sector contracts and larger corporate clients now require suppliers to hold it before they'll sign a deal.

Why Cyber Essentials Certification Matters for Small Business

Cyber Essentials certification for small business matters because smaller companies are targeted precisely because they tend to have weaker defences than larger organisations, and a single breach can be enough to put one out of business. Certification forces the basic protections that stop the majority of these attacks before they succeed.

• It's often a contractual requirement for government and enterprise supply chains
• It signals to customers and insurers that you take data protection seriously
• It can reduce cyber insurance premiums, since it proves baseline controls are in place
• It closes the gaps attackers rely on most: weak passwords, unpatched software, and misconfigured firewalls

For a small business without an in-house IT team, certification also doubles as a health check. Going through the questionnaire usually surfaces gaps nobody knew existed, like an old admin account still enabled or a router still running its factory password.

The Five Technical Controls You Need in Place

Every Cyber Essentials assessment checks the same five technical controls, and getting all five right is what determines a pass. These cover firewalls, secure configuration, user access control, malware protection, and patch management.

• Firewalls: a properly configured firewall or equivalent on every internet-facing device and network boundary
• Secure configuration: devices and software set up to reduce vulnerabilities, with default passwords changed and unnecessary accounts removed
• User access control: accounts limited to what people actually need, with admin rights kept to a minimum
• Malware protection: anti-malware software or application allow-listing on every device that can access the internet
• Security update (patch) management: software kept up to date, with critical security updates applied within 14 days of release

Most small businesses fail on secure configuration and patch management rather than the more technical controls, because these depend on ongoing discipline rather than a one-off setup.

Cyber Essentials vs Cyber Essentials Plus for Small Business

Cyber Essentials is self-assessed against the five controls, while Cyber Essentials Plus adds a hands-on technical audit where an assessor tests your systems directly rather than taking your word for it. Most small businesses start with the standard certification and only move to Plus if a client or contract specifically requires it.

Standard Cyber Essentials is the right starting point for most small businesses because it's faster, cheaper, and covers the same five controls that stop the majority of common attacks. Cyber Essentials Plus becomes worth the extra cost once you're bidding for larger contracts, handling sensitive data, or an insurer asks for independently verified evidence rather than a self-declaration.

How Much Does Cyber Essentials Certification Cost for a Small Business?

Cyber Essentials certification cost for a small business typically runs from around £300 plus VAT for a micro business with fewer than 10 staff, up to around £400 plus VAT for a small business with 10 to 49 staff, based on the standard IASME assessment fee. Cyber Essentials Plus costs considerably more, since it involves an assessor's time on-site or remotely testing your systems, rather than a paper-based review.

The certification fee itself is often the smallest part of the real cost. If your systems have gaps, the time and any tooling needed to close them before you apply, patching devices, tightening access, updating firewall rules, usually costs more than the assessment. This is where working with an existing IT provider pays off, because most of the groundwork is something they should already be maintaining.

How to Get Cyber Essentials Certification: The Process Step by Step

Getting Cyber Essentials certified for a small business involves choosing an accredited certification body, completing their self-assessment questionnaire, passing an external vulnerability scan, and receiving your certificate, usually within a few weeks from start to finish.

1. Choose a certification body: any body accredited by IASME on behalf of the NCSC can issue the certificate
2. Review the five controls: check your firewalls, device configuration, access permissions, malware protection, and patching against the requirements before you apply
3. Complete the questionnaire: answer the self-assessment honestly; a qualified internal reviewer needs to check the answers before submission
4. External vulnerability scan: the certification body scans your internet-facing IP addresses for known weaknesses
5. Receive your certificate: valid for 12 months, after which you recertify to keep it current

If the scan finds an issue, most certification bodies allow a short window to fix it and resubmit before failing you outright, so it's rarely a one-shot process.

Frequently asked questions

How long does Cyber Essentials certification take for a small business?

Cyber Essentials certification for small business usually takes two to four weeks, from choosing a certification body to receiving the certificate. The timeline mostly depends on how many gaps the five controls reveal and how quickly they can be closed.

Is Cyber Essentials certification mandatory for small businesses?

Cyber Essentials isn't a legal requirement for most small businesses, but it's mandatory for suppliers on many UK government contracts and increasingly requested by larger corporate clients and insurers. Even without a contractual push, it's widely recommended as the minimum standard for protecting customer data.

What happens if my small business fails Cyber Essentials assessment?

If your business fails, the certification body will tell you exactly which control didn't meet the standard, and most allow a short remediation window and one free resubmission to fix it and resubmit without paying again. Common failure points are unpatched software and unnecessary admin accounts.

Do I need Cyber Essentials Plus as well as Cyber Essentials?

Not usually. Standard Cyber Essentials is enough for most small businesses unless a specific client, contract, or insurer requires the independently verified audit that Cyber Essentials Plus provides. Read our comparison of Cyber Essentials and Cyber Essentials Plus for a fuller breakdown.

Can a small business do Cyber Essentials certification without an IT provider?

Yes, a small business can complete Cyber Essentials certification without an external IT provider, though it takes longer if nobody in-house is confident reviewing firewall rules, access permissions, and patch status. Many small businesses find it faster and less stressful to have their existing IT support handle the technical preparation.

How Cloud Plus Can Help

Cyber Essentials certification for small business is far easier when someone is already maintaining your firewalls, patching, and access controls day to day, rather than scrambling to fix them just before an assessment. Cloud Plus works with UK small businesses to close the gaps the five controls check for, and to keep them closed after the certificate is issued.

Get a quote for Cyber Essentials support and we'll tell you honestly where your systems stand before you apply.

Related reading: Cyber Essentials Certification UK: Your Complete Guide and Cybersecurity for Small Business UK.