Cyber Essentials is a UK government backed certification scheme that shows your business has the basic controls in place to defend against the most common cyber attacks. It is affordable, quick to achieve with the right help, and increasingly expected by customers and required to win certain contracts. This guide explains what it is, the five controls, the two levels, and how to get certified.
In short, Cyber Essentials is a government backed certification that proves your business has the basic controls in place to stop the most common cyber attacks. You can read the official scheme detail on the NCSC Cyber Essentials pages.
What is Cyber Essentials?
Backed by the National Cyber Security Centre, Cyber Essentials sets out a baseline of security controls that stop the large majority of everyday cyber attacks. Certifying proves to customers, insurers and partners that you take security seriously, and it is often a condition of working with government and larger organisations.
The five controls
- Firewalls: secure your internet connection so only trusted traffic gets in.
- Secure configuration: set up devices and software safely, removing default passwords and unused features.
- User access control: give people only the access they need, and protect admin accounts.
- Malware protection: defend against viruses and other malicious software.
- Security update management: keep operating systems and applications patched and up to date.
None of these are exotic. They are the fundamentals that, done consistently, close the doors most attackers walk through.
Cyber Essentials versus Cyber Essentials Plus
There are two levels. Cyber Essentials is a verified self-assessment: you complete a questionnaire about your controls, which is reviewed and certified. Cyber Essentials Plus covers the same five controls but adds a hands-on technical audit by an assessor, who tests your systems to confirm the controls really work. Plus carries more weight and is often required for higher-value or public sector contracts.
Why bother getting certified?
- Win more business: many contracts, especially public sector, require it.
- Reduce your risk: the controls block the most common attacks.
- Reassure customers: it is visible proof you protect their data.
- Support insurance: some cyber insurance policies expect it and it can improve terms.
- Build good habits: it puts a security baseline in place you can build on.
How to get Cyber Essentials certified
- Review your current setup against the five controls and find the gaps.
- Fix the gaps, such as enabling firewalls, tightening access, and getting patching under control.
- Complete the assessment, the questionnaire for Cyber Essentials or the audit for Plus.
- Certify and maintain it, renewing each year and keeping the controls in place day to day.
Most businesses get there faster and more cheaply with an IT partner who knows the scheme, closes the gaps for you and handles the paperwork. Our free cyber security audit is a simple way to see where you stand before you start.
How ATS Connection can help
We guide West Sussex businesses through Cyber Essentials and Cyber Essentials Plus, from the initial gap review to certification, and keep the controls in place afterwards as part of your managed IT support. Get a quote or call 01903 255 159.
Frequently asked questions
What is Cyber Essentials?
It is a UK government backed certification, supported by the National Cyber Security Centre, that shows your business has five basic security controls in place to defend against common cyber attacks.
What is the difference between Cyber Essentials and Cyber Essentials Plus?
Cyber Essentials is a verified self-assessment questionnaire. Cyber Essentials Plus covers the same controls but adds a hands-on technical audit by an assessor who tests that the controls actually work.
How much does Cyber Essentials cost?
The certification itself starts from a modest fee for the base level, with Cyber Essentials Plus costing more due to the audit. The main cost is usually the work to close any gaps first.
How long does Cyber Essentials take?
With the right help, many businesses achieve base Cyber Essentials within a few weeks, depending on how much needs fixing. Cyber Essentials Plus takes a little longer because of the audit.
Do I need Cyber Essentials?
If you handle customer data, want to reassure clients, or bid for contracts, especially public sector work, it is well worth having, and it is often a formal requirement.