If you've received a supplier questionnaire recently, been asked to bid for a government contract, or had a client ask about your cyber security posture, there's a good chance you've encountered the words "Cyber Essentials" — and wondered what you actually need to do about them.
Cyber Essentials is a UK government-backed certification scheme, developed by the National Cyber Security Centre (NCSC), that helps businesses of all sizes protect themselves against the most common cyber threats. It's not as complex or costly as many businesses assume. But it does require genuine technical controls to be in place — and this guide explains exactly what those are, how the process works, and how to approach it without wasting time or money.
What is Cyber Essentials?
New to the scheme? Start with our plain-English guide to what Cyber Essentials is and who needs it, then come back here for cost and process.
Cyber Essentials is a certification framework developed by the UK government, delivered through certification bodies licensed by IASME and overseen by the National Cyber Security Centre (NCSC). It was launched in 2014 and has become the baseline standard for UK business cyber security.
The scheme exists because the majority of successful cyber attacks exploit a relatively small number of well-understood vulnerabilities — misconfigured systems, unpatched software, weak passwords, and inadequate access controls. Cyber Essentials doesn't try to address every possible threat. It focuses on the foundational controls that, when properly implemented, eliminate or significantly reduce the risk of the most common attack types.
"Cyber Essentials isn't about achieving perfect security. It's about closing the doors that attackers walk through most often."
Two levels of certification
- Self-assessment questionnaire completed online
- Answers verified and reviewed by a certification body
- Suitable for organisations of any size
- Certificate valid for 12 months
- Meets basic government contract requirements
- Includes cyber liability insurance if eligible (UK turnover under £20m, whole organisation certified)
- Includes everything in Cyber Essentials
- Plus independent technical verification by assessors
- Assessors test your systems hands-on
- Higher assurance level for clients and partners
- Required for some higher-value government contracts
- Demonstrates security to a higher standard of evidence
For most UK SMEs pursuing Cyber Essentials for the first time, starting with the standard self-assessment certification makes sense. Cyber Essentials Plus is typically pursued once the standard level is achieved and where clients or procurement processes specifically require it.
The five technical controls
Cyber Essentials is built around five core technical control categories. Your organisation must demonstrate compliance with all five. Here's what each one actually means in practice:
How the certification process works
The process for Cyber Essentials (self-assessment level) is more straightforward than many businesses expect. Here's how it unfolds step by step:
Pre-assessment gap review
Before you formally begin, review your current IT environment against the five control requirements. This gap analysis tells you what's already in place and what needs to change before you submit. Most businesses find a handful of gaps — typically around MFA, patch management processes or device configuration.
Remediation
Address the gaps identified. Common remediation tasks include enabling MFA on Microsoft 365 or Google Workspace, removing end-of-life software, updating device configurations, reviewing firewall rules, and documenting patch processes. This stage takes most of the calendar time — typically 2–6 weeks depending on how much needs to change.
Register and complete the self-assessment questionnaire
Register with an IASME-licensed certification body. Complete the online questionnaire, which asks you to confirm and evidence your compliance with the five control areas. A typical questionnaire takes 2–4 hours to complete if you're well-prepared.
Assessor review
Your certification body reviews your submission. They may come back with clarifying questions. If your answers are satisfactory, they issue your Cyber Essentials certificate.
Certificate issued and published
Your certificate is valid for 12 months. You'll appear in the public Cyber Essentials certificate search hosted by IASME, which clients and partners can use to verify your certification. Set a reminder to renew before it lapses — maintaining an unbroken certification record is valued by many clients.
Why bother? The real business benefits
Many businesses approach Cyber Essentials as a compliance checkbox — something they need to get done to win a contract or satisfy a client. That's a valid reason to certify. But the benefits go beyond the certificate itself.
- Win more business. Cyber Essentials is increasingly requested by procurement teams across both public and private sector clients. Having it in place removes a common barrier to winning contracts.
- Reduce real risk. The five controls genuinely reduce your attack surface. The vast majority of successful cyber attacks exploit the exact vulnerabilities these controls address.
- Cyber liability insurance included. UK organisations with turnover under £20m that certify their whole organisation are entitled to cyber liability insurance arranged by IASME, including 24/7 incident response support.
- Staff and stakeholder confidence. Certification demonstrates to your team, your board and your clients that cyber security is taken seriously. That has genuine reputational and commercial value.
- A platform for growth. Once certified, your organisation has a documented security baseline to build from. It's much easier to implement additional security improvements when you have a clear record of what's in place.
Common questions answered
Is Cyber Essentials mandatory?
Cyber Essentials is mandatory for UK government contracts that involve handling personal data or sensitive government information. For all other businesses, it's not a legal requirement — but it is strongly recommended and increasingly expected by clients across many sectors.
What if we use cloud services — does that change what's in scope?
Yes. Cloud services are in scope for Cyber Essentials. If you use Microsoft 365, Google Workspace, or other SaaS tools, you need to confirm that they are configured securely (particularly around MFA and access controls) and that your organisation is using them in a compliant way. The good news is that major cloud platforms like Microsoft 365 make it straightforward to meet these requirements when properly configured.
Do we need to include all our devices?
Yes, in principle — all devices that can access your business systems or internet resources are in scope. However, you can define a specific assessment scope that excludes certain segments (such as operational technology or manufacturing systems) if they are properly separated from your business network.
What happens if we fail the assessment?
You won't "fail" in the way an exam works. If your submission has gaps, the certification body will identify them and you'll need to remediate before resubmitting. Working with an IT partner who knows the requirements makes this much smoother — we help businesses address issues before submission, not after.
How often do we need to renew?
Cyber Essentials certificates are valid for 12 months. Annual renewal is required. The renewal process is the same as the initial certification — though it's typically faster for organisations that have maintained their controls throughout the year.
How Techfident supports your Cyber Essentials journey
We've helped businesses across a range of sectors achieve Cyber Essentials certification — from professional services firms to manufacturers, charities and legal practices. We manage your Cyber Essentials engagement and agree the project brief with you directly. Our approach is practical and direct: our specialist cyber partner assesses where you are now, identifies exactly what needs to change, carries out remediation where appropriate and supports you through the questionnaire process, with Techfident managing the relationship and escalating or advising throughout.
We don't make Cyber Essentials more complicated than it needs to be. For most SMEs with a relatively modern IT environment, it's achievable within 4–8 weeks and at a cost that's proportionate to the benefits. If you're starting from a position where significant remediation is needed, we'll tell you that upfront — with a clear plan and timeline.
We can also support ongoing compliance: monitoring patch status, managing access controls, reviewing firewall configurations and helping you prepare for annual renewal — so maintaining your certification doesn't become a distraction from running your business. See our Cyber Essentials certification service for how we work.
Ready to start your Cyber Essentials journey?
Get a free gap assessment against the five Cyber Essentials controls. We'll tell you exactly where you stand, what needs to change, and how long it will take — with no obligation.
Get your free gap assessment View all services