Cyber Essentials for Small Business: What You Actually Need
Quick Answer
Most UK small businesses need standard Cyber Essentials, not Cyber Essentials Plus. Standard certification proves that five baseline technical controls are in place. It starts at £320 + VAT for the smallest organisations. Choose Cyber Essentials Plus if a customer, contract or tender requires it. Plus adds hands-on technical testing and is priced by quote based on your size and complexity.
The main trade-off is assurance versus effort and cost. Standard certification is a verified self-assessment. Plus adds independent testing of your actual systems. Neither guarantees you will never be breached. Both show that you have closed the most common gaps that attackers exploit.
What Matters Most: The Five Controls
Every assessment is built around five technical controls. If you understand these, you understand the scheme.
Firewalls
Boundary and software firewalls protect every in-scope device. Default admin passwords must be changed, and unnecessary inbound rules must be removed.
Secure Configuration
Remove unused software and accounts, change default credentials, disable auto-run and lock devices when they are left unattended.
Security Update Management
Use only supported, licensed software. Apply high-risk and critical updates within the deadline set by the scheme.
User Access Control
Give each person only the access they need. Use separate admin accounts and multi-factor authentication (MFA) wherever it is required.
Malware Protection
Use anti-malware software or application allow-listing on in-scope devices, configured to prevent malicious code from running.
Cloud Services and MFA
Cloud services are in scope if they hold or process your organisation’s data. That includes Microsoft 365, Google Workspace, accounting platforms and CRMs. You cannot exclude them because a supplier runs the servers. Under v3.3, authentication to cloud services must always use MFA. In practice, any user account without MFA on a cloud service is a likely failure point.
How We Researched This
This guide is based on the NCSC Cyber Essentials requirements v3.3, the published NCSC/IASME pricing and scheme information, and the free readiness resources. We have not taken any business through certification as part of this article and have not tested any certification body’s service. Treat it as a plain-English summary of the scheme, not as a substitute for the official question set.
What to Look For: Cyber Essentials vs Plus
When you compare certification bodies, look for clear scope advice, fair pricing for Plus testing and realistic retest terms.
Price & Value
Pricing checked 7 October 2026: standard Cyber Essentials starts at £320 + VAT, rising with organisation size. Plus has no fixed list price and is quoted individually.
The value goes beyond the certificate itself. UK organisations with turnover under £20m that certify their whole organisation are entitled to arranged cyber liability insurance, subject to scheme terms. Before you pay anything, use the free NCSC/IASME Readiness Tool and download the question set. Together they show where you stand.
Preparation Checklist
- Inventory everything: laptops, phones, servers, software and every cloud account.
- Remove unsupported software: for example, old operating systems that no longer receive updates.
- Patch promptly: apply high-risk and critical updates within the deadline set by the scheme. Turn on automatic updates where you can.
- Enforce MFA: on every cloud service, with no exceptions.
- Separate admin accounts: no one should browse the web or read email while signed in as an administrator.
- Remove unused accounts and privileges: including those of leavers and old supplier logins.
- Configure firewalls: change default router passwords and close unnecessary ports.
- Confirm malware protection: make sure it is active on every in-scope device.
- Scope home and remote workers: devices they use for work are generally in scope.
- Collect evidence: screenshots, policies and device lists that support your answers.
Frequently Asked Questions
Does certification mean we are secure?
No. It shows that baseline controls were in place when you were assessed. You still need ongoing patching, backups and staff awareness. Our Cybersecurity & Privacy hub covers the wider security stack, while our password manager guide explains one practical route to stronger unique credentials and account recovery.
Can we certify only part of the business?
Yes, but the boundary must be clearly defined. Certifying only part of the business may also affect your eligibility for the included insurance.
Are personal phones in scope?
Generally yes, if staff use them to access organisational data or services such as email. Check the current requirements for the exact wording.
Final Verdict
Sole traders and small teams should start with the free Readiness Tool, fix the gaps it finds, then apply for standard Cyber Essentials. Businesses bidding for public-sector or supply-chain work should check the tender requirements and budget for Plus if testing is specified. Whichever route you take, MFA on cloud services and disciplined patching will make the biggest difference.
Your Next Step
Complete the free NCSC/IASME Readiness Tool this week and work through the checklist above before booking your assessment.
Further reading: official Cyber Essentials requirements
For the current assessment question set and technical requirements, use the UK National Cyber Security Centre Cyber Essentials resources. The NCSC lists requirements version 3.3 as effective from 27 April 2026. Check the version applying to your application before making compliance claims.
