What it is
Cyber Essentials is a UK government-backed scheme, run with the National Cyber Security Centre, that certifies you've got the basic protections in place against the most common internet attacks. It's required for some government contracts, and more and more larger customers ask their suppliers for it.
The five controls
- Firewalls — every device connected to the internet sits behind one that's properly set up.
- Secure configuration — default passwords changed, unnecessary software and accounts removed.
- Security update management — devices and software are still supported, and critical updates are installed within 14 days.
- User access control — people only have the access they need; admin accounts are separate; MFA on cloud services.
- Malware protection — antivirus (Microsoft Defender counts) or apps limited to approved sources.
Cyber Essentials vs Cyber Essentials Plus
- Cyber Essentials is a self-assessment questionnaire, checked by a certification body.
- Cyber Essentials Plus adds a hands-on technical audit of your devices and systems.
Both are renewed every year.
Common trip-up Any computer or phone used for work that's no longer getting security updates — an old Windows 10 PC, say — means you can't pass. Check this first.
Do you need it?
If you bid for public-sector work or a customer asks, yes. If not, it's still a useful, affordable way to prove to customers that you take their data seriously — and preparing for it closes the gaps most attacks use. I can help you get ready and work through the questions.
