Getting ready for Cyber Essentials as a small business
Cyber Essentials is a UK government-backed scheme that shows you've put five basic security controls in place. This guide explains what's involved and how to get ready, in plain English.
Cyber Essentials is a UK government-backed scheme that shows you've put five basic security controls in place. For a small business, it's a practical way to protect your data and to show clients and insurers you take security seriously. This guide explains what's involved and how to get ready, in plain English.
Cyber Nova AI helps you prepare for Cyber Essentials. It doesn't award or certify it. Follow the steps here to get ready, then apply for certification through an accredited Cyber Essentials body when you're set.
What Cyber Essentials actually is
Cyber Essentials is a certification. You confirm that your business meets five security controls, and a certification body checks your answers. It's run for the government by IASME, working with the National Cyber Security Centre (NCSC).
There are two levels:
- Cyber Essentialsa self-assessment. You answer a set of questions about your setup, and it's reviewed and verified.
- Cyber Essentials Plus the same five controls, plus a hands-on technical check by an assessor.
Most small businesses start with Cyber Essentials and move to Plus later if a client or contract asks for it. For a broader overview of the scheme, read our full Cyber Essentials guide.
Why it's worth doing
You don't need to be technical, and you don't need to fix everything at once. Work through the controls one at a time.
The five controls, for a business
- 1
Firewalls protect the boundary between your business network and the internet. Turn on the firewall on your router and your devices, and close anything you do not use.
- 2
Secure setup set devices up safely before use: change default passwords, turn off features nobody needs, and use one standard secure setup for every new device.
- 3
User access give people only the access they need. Keep everyday accounts separate from admin accounts, and remove access when someone leaves.
- 4
Malware protection put reputable security software on every business device and keep it switched on.
- 5
Security updates keep operating systems and software up to date. Turn on automatic updates where you can, and have a simple process for the rest.
Your free checklist on this site turns each of these into small, guided steps for your devices.
How the assessment works
- 1Get your five controls in place (that's what the checklist is for).
- 2Choose a certification body and buy the assessment through the official Cyber Essentials site.
- 3Complete the self-assessment questions honestly.
- 4Once you pass, your certificate is issued.
Costs and exact steps are set by the scheme, so check the official site for current details. Cyber Essentials is usually renewed each year.
Where GDPR and the ICO fit
Cyber Essentials is about security controls. Data protection law is separate but related, so it's worth knowing:
- If your business handles people's personal data, you likely need to pay a data protection fee to the Information Commissioner's Office (ICO), unless you're exempt. Check your status on the ICO website.
- UK GDPR expects you to keep personal data secure. The same five controls that get you ready for Cyber Essentials also help you meet that expectation.
We can't give legal advice. For your specific duties, check the ICO's guidance or speak to a qualified adviser.
Your next step
Create your free account, choose the business setup, and you'll get a checklist tailored to your devices. Work through it at your own pace. By the end you'll have the five controls in place and be ready to sit the assessment.
Create your free account