A client has asked for Cyber Essentials. Do I need it?

What is Cyber Essentials?

Cyber Essentials is a government-backed certificate showing that your business has five basic protections in place against the most common online attacks:

• firewalls, controlling what can reach your devices from the internet
• secure configuration, removing default passwords and settings you don’t need
• security updates, keeping software and devices up to date
• user access control, making sure people only have the access they need
• malware protection, stopping harmful software from running

(NCSC: Cyber Essentials overview)

You answer an online questionnaire about how your business is set up, a board member or director signs a declaration that the answers are true, and an assessor marks it. The certificate lasts 12 months, so you renew it every year (IASME).

There’s also Cyber Essentials Plus, which covers the same five areas but adds hands-on testing by an assessor. Check which one your client is asking for. Most small-business requests are for the basic certificate.

Is Cyber Essentials mandatory?

Not by law. You need it when someone you want to work with makes it a condition:

• Government contracts: it’s required for central government contracts that involve handling certain personal information or providing certain technical products and services (GOV.UK: Cyber Essentials scheme overview).
• Customers and supply chains: larger businesses increasingly ask their suppliers for it, because a weak supplier is a way into their systems.
• Insurers: some ask about it on cyber insurance proposal forms.

It’s becoming more common. Certifications grew 17.5% to 39,790 in the NCSC’s 2025 annual review period (NCSC Annual Review 2025).

Is Cyber Essentials suitable for small businesses?

Yes. It was designed with small businesses in mind, and the questions are about things every business should have anyway: updates switched on, two-step sign-in, sensible admin rights, and antivirus. If you use Google Workspace or Microsoft 365 and a handful of computers and phones, most of the work is switching on settings you already pay for.

The hard part is usually knowing which settings the questions are asking about, and having the evidence ready. Some rules have recently become stricter. See Will I fail Cyber Essentials under the 2026 rules?

How much does Cyber Essentials cost?

There are two parts:

• The certification fee, which goes to IASME, the body that runs the scheme, not to us or any other IT provider. It’s set by the number of employees: £320 plus VAT for up to 9, £440 plus VAT for 10 to 49, £500 plus VAT for 50 to 249, and £600 plus VAT for 250 or more (IASME FAQ).
• The work to get ready, which you can do yourself or pay someone to do. It depends on how much needs fixing.

If your organisation is based in the UK, has a turnover under £20 million and certifies the whole business, you can also opt in to cyber liability insurance, included in the fee, with a £25,000 limit. It doesn’t cover money stolen through cyber fraud (IASME: cyber liability insurance).

How long does it take?

The questionnaire itself can be done in a day if everything is already in place. Getting everything in place is what takes the time. For a small business starting from scratch, a few weeks is typical.

How do I start?

1. Ask your client exactly what they need: Cyber Essentials or Cyber Essentials Plus, and by when.
2. Work through the NCSC’s free Cyber Action Toolkit. It’s a step-by-step security plan for small businesses, and it’s the best free starting point.
3. Read the current requirements and the question set on the IASME website before you apply, so there are no surprises.
4. Fix the gaps, then apply through an IASME certification body.

If you’d rather not do it yourself, we can check your setup, fix the gaps, prepare your answers and support you through to your certificate.