If you run a firm of about ten people, Cyber Essentials is probably the first security standard anyone has asked you about. A client's procurement team wants to see it, an insurer mentions it at renewal, or a tender lists it as a condition. This post explains what the scheme actually asks of you, in plain English, so you can decide how to approach it.
What Cyber Essentials is
Cyber Essentials is a UK government-backed scheme run by the National Cyber Security Centre. It sets out five technical controls that stop the most common, opportunistic attacks: the automated scanning and mass phishing that reaches every business, rather than the targeted attacks aimed at banks and governments. You certify by completing a self-assessment questionnaire, which is reviewed by an assessor at an accredited certification body. The certificate lasts twelve months, so it is an annual exercise, not a one-off.
The five controls in plain English
- Firewalls. Your internet connection and every device has a firewall turned on, and nothing is exposed to the internet that does not need to be. For most small firms this means the router's firewall plus the built-in firewall on each laptop.
- Secure configuration. Default passwords are changed, unused software and accounts are removed, and devices lock when left alone. New kit is set up deliberately rather than left as it came out of the box.
- Security update management. Operating systems, browsers and applications are still supported by their vendor and kept up to date. Updates that fix high or critical vulnerabilities are applied within 14 days of release.
- User access control. Each person has their own account, administrator rights are only used for administrator tasks, leavers are removed promptly, and multi-factor authentication (MFA) is on for cloud services.
- Malware protection. Every device runs anti-malware software, or only allows approved applications to run. Built-in tools such as Microsoft Defender count, provided they are switched on and updating.
What the scope now includes
The scheme has been updated several times and the current version is broader than many people remember. Three changes matter most for a small firm.
- Cloud services are in scope. Microsoft 365, Google Workspace, your accounting package, your case or practice management system: if your data lives there and your staff log in to it, the controls apply to it, and in particular the scheme expects MFA.
- Home-working devices are in scope. A laptop used at the kitchen table for work is a work device, and so is a personal phone with the company email on it. Home broadband routers are excluded, but the devices are not.
- MFA is mandatory for cloud services. Every user, not just the administrators. A password on its own is no longer acceptable for anything you reach over the internet.
The 14-day patching rule, and the evidence
The requirement that catches most firms out is patching. Any update rated high or critical must be installed within 14 days of the vendor releasing it. That covers phones, laptops, servers and the firewall itself. It is not enough to say that automatic updates are turned on. You need to be able to show it: a list of the devices you have, what each one is running, and that updates are actually landing. A device that is out of vendor support fails the control however well it still works, and old phones and laptops are the usual culprits.
What the self-assessment actually is
The self-assessment is an online questionnaire that walks through each of the five controls. The answers are in your own words. A typical question is how you make sure security updates are applied within 14 days, and the assessor wants to see a real process, not a promise. A director or senior owner signs a declaration that the answers are true. The assessor reviews the submission and may send questions back for clarification before the certificate is issued. Because it is a self-assessment, honesty matters more than polish. A certificate built on answers that are not true protects nobody, and Cyber Essentials Plus, the next level up, checks the same controls with an independent technical audit.
How long it takes
For a ten-person firm on a mainstream cloud suite with reasonably modern laptops, the work usually falls into three parts. First, an honest stocktake of what you actually have: every device, every cloud service, every account. Second, fixing the gaps, and the common ones are MFA not enforced for everyone, a couple of out-of-date or unsupported devices, shared administrator logins, and software nobody uses any more. Third, writing the answers and gathering the evidence. If one person owns it, two to four weeks is realistic. The certification body's review is usually a matter of days after that.
Two routes to get there
You can do it yourself. The NCSC publishes the requirements and a free readiness tool, and the questions are not hard if you have the facts to hand. The cost is your time, and the risk of an unclear answer bouncing back from the assessor.
The other route is a readiness sprint quoted up front. Ours is priced per engagement: a gap assessment against the five controls, hands-on help with the fixes, the evidence gathered, the questionnaire completed with you, and a readiness sign-off. The certification body's assessment fee is separate and paid to them, and they, not us, issue the certificate. Our job is to make sure that when you submit, you pass.
