Cyber Essentials Certification: UK SME Guide

Cyber Essentials certification is the UK government-backed way of showing customers, insurers and buyers that your organisation has the basic technical protections in place. If you have just been asked for a certificate in a tender, a supplier questionnaire or an insurance proposal, this guide takes you from "what is Cyber Essentials?" to holding a valid certificate.

It is written for owners, directors and operations leads at UK SMEs, not for security specialists. We cover what the scheme is, who needs it, what it costs in broad terms, how the process runs, how long it takes and how renewal works. Our team at NetMonkeys helps businesses prepare for assessment through our Cyber Essentials support, so the practical advice below reflects what tends to trip organisations up.

What is Cyber Essentials certification?

Cyber Essentials is a UK scheme, developed by the National Cyber Security Centre (NCSC), that sets out five technical controls which protect against the most common internet-based attacks. The government describes it as the minimum standard of cyber security it recommends for organisations of every size. You can read the NCSC's own summary on the NCSC Cyber Essentials overview.

The NCSC owns the technical standard. IASME, the NCSC's delivery partner for the Cyber Essentials scheme, runs the certification process and licenses the Certification Bodies that assess organisations. Its own information is on the IASME Cyber Essentials page.

The standard focuses on practical basics: how your network is protected, how devices are set up, how quickly updates are applied, who can access what, and how malware is stopped. It does not require a full security management system, which is why it suits smaller businesses.

What certification covers

Certification applies to the scope you define. That can be the whole organisation or a clearly bounded part of it, and it covers laptops, desktops, servers, mobile devices, network equipment and the cloud services your staff use. Anything outside the scope should be separated and justified to the assessor. Defining scope carefully at the start saves rework later.

Why the scheme exists

Most attacks that hit small businesses are not sophisticated. They exploit unpatched software, weak or reused passwords, open services and unprotected devices. The scheme targets exactly those gaps. A certificate tells a buyer that the basics are covered and that someone senior has signed off the answers.

The five Cyber Essentials technical controls

Every Cyber Essentials assessment is built around the same five controls. Understanding them early makes the rest of the process far easier.

Multi-factor authentication

Multi-factor authentication (MFA) is now a central expectation. Under the current question set, MFA is expected on cloud services and for administrative access, and patchy rollout is a common reason for a failed first submission. If your business runs on Microsoft 365, switching MFA on for every user is usually the single most valuable preparation step. Our Microsoft 365 support team handles this regularly.

Which version applies now

The NCSC lists Requirements for IT infrastructure v3.3 as effective from 27 April 2026, replacing v3.2. Assessments are run against the current question set, so always download the latest documents from the NCSC resources page before you start, rather than relying on older guides.

Cyber Essentials vs Cyber Essentials Plus

There are two levels. Both assess the same five controls, but they differ in how the evidence is gathered.

Most organisations begin with the standard level, then move to Plus if a contract or customer demands it. We explain the differences in more depth in our article on the difference between Cyber Essentials and Cyber Essentials Plus, and the audit itself is covered in our guide to the Cyber Essentials Plus audit.

Is Cyber Essentials mandatory?

For most private businesses, no. There is no general law requiring every company to hold Cyber Essentials. The requirement tends to arrive through contracts, not legislation.

The exception is public sector supply. Since 2014, central government has required suppliers bidding for certain types of contract to hold Cyber Essentials or Cyber Essentials Plus, or to demonstrate equivalent controls. The current policy is set out in Procurement Policy Note 09/23, which updates the earlier note. Which level applies depends on the contract, so read the tender documents carefully.

In practice, a certificate is often a commercial requirement even where it is not a legal one:

• Public sector and framework tenders that handle personal data or ICT services.
• Larger customers who add it to supplier due diligence.
• Insurers who ask about baseline controls when pricing cover.
• Defence and critical supply chains, where certification is often a minimum entry point.

We look at this in detail in our guide to Cyber Essentials for tenders and insurance.

Who needs Cyber Essentials and what are the benefits?

Any organisation that uses computers, email and cloud services can benefit. It is most commonly pursued by firms that sell to larger organisations or the public sector.

Sectors we see asking for it

• Manufacturers supplying larger customers or defence supply chains.
• Construction firms bidding on public projects.
• Law firms and accountants handling client data.
• Technology and professional services businesses answering supplier questionnaires.

The main benefits

• Eligibility to bid: many tenders and frameworks cannot be entered without a certificate.
• Customer confidence: a recognised, independently reviewed badge answers security questions quickly.
• Fewer successful attacks: the five controls address the common routes attackers use.
• Insurance: IASME states that organisations with a turnover under £20m that certify their whole organisation automatically receive cyber liability insurance arranged through IASME. Check the current terms and exclusions before relying on it.
• A clear baseline: the process documents your devices, accounts and suppliers, which is useful in its own right.

Our article on supply chain risk lessons from recent retail breaches shows why larger buyers are asking suppliers for this evidence.

How to get Cyber Essentials certification, step by step

IASME describes five stages. The process is the same whether you handle it yourself or use a Certification Body for support.

Self-led or supported?

You can complete the assessment yourself using free resources, or pay a Certification Body or Cyber Advisor for help. The NCSC also notes that eligible SMEs can claim a free 30-minute consultation with an NCSC-assured Cyber Advisor. Supported routes suit businesses without in-house IT, where the technical questions are the hard part. If that is you, our Cyber Essentials service helps you prepare and fix gaps before you submit.

How long does Cyber Essentials take?

The assessment itself is quick, but the preparation is not. The timeline depends on how much remediation you need.

IASME allows up to six months from purchase to complete the assessment, so there is no need to rush a submission that is not ready. A well-prepared small business can often be certified within a couple of weeks, whereas a firm with older machines and no MFA may need longer to fix issues first. Cyber Essentials Plus adds its own audit step on top.

If you have a tender deadline, work backwards from it and leave time for fixes. Allow extra time if hardware needs replacing, because procurement and setup often take longer than the assessment. Where several people hold the information you need, such as an office manager for broadband and an IT contact for laptops, gather answers in one place before you begin the questions.

Common reasons applicants fail, and how to avoid them

Most failures come from preparation gaps rather than from the form itself. Watch for these:

• Unsupported operating systems or software. Windows 10 reached end of support in October 2025, so check the position carefully using our guide to the Windows 10 end of life and ESU programme.
• Missing or inconsistent MFA on email, remote access and cloud administration accounts.
• Patching gaps where critical and high-risk updates are not applied within 14 days.
• Vague scope. Partial scoping is allowed, but you must be able to justify what is left out.
• Shared admin accounts or admin rights used for daily work.
• Unmanaged personal devices accessing company data without being assessed.

A short internal review, or a lightweight cyber security audit, before you pay for the assessment is a sensible way to catch these. Our Cyber Essentials requirements checklist walks through each control in detail.

Renewing your Cyber Essentials certificate

Certification is valid for 12 months, so you need to reassess every year to stay certified. There is no extended grace period to rely on, and a lapsed certificate can put tender eligibility or insurance terms at risk.

• Diarise renewal at least two months before expiry.
• Update your device, user and cloud service lists as your business changes.
• Re-check against the current question set, because requirements change.
• Keep MFA, patching and account reviews running all year, not just at assessment time.

Organisations with ongoing managed IT support find renewal far simpler because patching, device management and access reviews are already in place. Smaller firms without a dedicated team can get the same coverage through small business IT support.

For costs, see our breakdown in Cyber Essentials cost in the UK.

Conclusion: Cyber Essentials certification is a practical first step

Cyber Essentials certification gives UK SMEs a clear, affordable way to prove the basics are covered, and for many contracts it is the entry ticket. The process is manageable: understand the five controls, fix gaps such as MFA and unsupported devices, complete the self-assessment, and renew every year.

If you would like help preparing, our team can review your environment and guide you through the Cyber Essentials process. You can also contact us for a conversation about your deadline.

Frequently asked questions