Cyber Essentials Preparation: UK Business Guide

To prepare for Cyber Essentials, UK businesses must implement five core technical controls—boundary firewalls, secure configuration, user access control, malware protection, and patch management—and verify them through a self-assessment questionnaire. This article explains each control, the certification process, costs, common pitfalls, and practical steps to pass first time.

What Is Cyber Essentials?

Cyber Essentials is a UK government-backed certification scheme, managed by the National Cyber Security Centre (NCSC), that helps organisations protect against common cyber attacks. It focuses on five basic technical controls that, if properly implemented, block around 80% of everyday threats like phishing, malware, and brute-force attacks. There are two levels: Cyber Essentials (self-assessment) and Cyber Essentials Plus (includes independent technical testing). Many public sector contracts and Ministry of Defence suppliers now require Cyber Essentials as a minimum.

The Five Controls You Must Meet

The entire scheme rests on five technical areas. Each must be fully implemented and documented before you submit your self-assessment.

• Boundary firewalls and internet gateways: You must have a firewall or equivalent device that controls traffic between your internal network and the internet. Default passwords must be changed, and the firewall must be configured to deny all traffic that isn’t explicitly allowed.
• Secure configuration: All devices (laptops, servers, phones, routers) must be configured securely. This means removing or disabling unnecessary software, services, and user accounts, and changing default passwords.
• User access control: Users should only have the access they need to do their job. Administrative privileges must be restricted to a small number of named users, and standard users should not be able to install software or change system settings.
• Malware protection: You must have anti-malware software installed on all devices that need it, and it must be kept up to date. If you use a cloud-based email service, you must ensure it has malware filtering enabled.
• Patch management: All software and operating systems must be kept up to date with security patches. This includes third-party applications like Adobe Reader and Java, not just the OS.

How to Prepare: Step-by-Step

Preparation is a project, not a one-day task. Start at least 4–6 weeks before you plan to submit. Here is a realistic roadmap:

1. Inventory everything: List every device (laptops, desktops, servers, mobiles, tablets) and every piece of software (OS, apps, plugins) that connects to your network or processes company data.
2. Map your network: Draw a simple diagram showing your internet connection, firewall, routers, switches, and where devices connect. This helps you identify gaps.
3. Review user accounts: List all user accounts, their permissions, and whether any are shared or no longer used. Remove or disable dormant accounts.
4. Enable automatic updates: Turn on automatic patching for your operating systems and software. For third-party apps, use a patch management tool or manual checks.
5. Deploy anti-malware: Ensure every device has a reputable anti-malware product installed, with real-time scanning and automatic signature updates.
6. Configure your firewall: If you don’t have a managed firewall, work with an IT provider to set one up properly. Change the default admin password.
7. Test your controls: Before submitting, run a mock self-assessment using the official questionnaire (available from the IASME website) to find gaps.
8. Write your policies: You need a basic security policy (acceptable use, password policy, etc.) and an incident response plan. These are required for the assessment.

Common Mistakes and How to Avoid Them

Many businesses fail on their first attempt due to avoidable errors. Here are the most common:

• Ignoring mobile devices: If staff use personal phones or tablets to access email or company data, these are in scope. They need to be configured securely (passcode, encryption, remote wipe capability).
• Using default passwords on routers or firewalls: This is an automatic fail. Change them immediately.
• Forgetting third-party software: Old versions of Java, Flash, or PDF readers are a common gap. Uninstall anything not needed.
• Not patching legacy systems: If you have an old server that cannot be patched, you must isolate it or replace it. Cyber Essentials does not allow unsupported operating systems (like Windows 7) to be used for business data.
• Overlooking cloud services: If you use Office 365 or Google Workspace, you must ensure multi-factor authentication is enabled on all accounts. The scheme now requires MFA for cloud email and collaboration tools.

Costs and Certification Process

The cost of certification varies depending on company size and whether you use a consultant. The self-assessment fee is paid to a certification body (CB) and typically ranges from £300 to £500 for companies with fewer than 50 employees, and up to £1,000+ for larger ones. Cyber Essentials Plus costs more (usually £1,000–£2,000) because it includes an external vulnerability scan and on-site testing. You may also need to invest in IT support to fix gaps, which can cost from a few hundred to several thousand pounds depending on your starting point. The process itself is straightforward: you complete the online questionnaire, a CB reviews it, and if you pass, you receive a certificate valid for 12 months.

Why It Matters and How It Helps

Beyond meeting contract requirements, Cyber Essentials reduces your risk of a data breach and shows customers that you take security seriously. It also helps you get cyber insurance at a lower premium, as many insurers require or reward certification. The scheme is aligned with the UK’s National Cyber Security Strategy, and the NCSC recommends it as the baseline for all UK businesses.

Frequently Asked Questions

Do I need Cyber Essentials Plus?

Not unless a customer or contract specifically requires it. Cyber Essentials is the entry-level certification and is sufficient for most small businesses. Cyber Essentials Plus adds independent testing and is often required for larger public sector contracts or if you handle sensitive data.

How long does certification take?

The self-assessment questionnaire takes a few hours to complete once your controls are in place. The review by the certification body typically takes 1–2 weeks. Preparation time varies—if you already have good security practices, you could be ready in a week; if not, allow a month or more.

Can I do it without an IT consultant?

Yes, if you have in-house IT expertise. The questionnaire is detailed but not overly technical. However, many small businesses use a managed service provider (MSP) to implement the controls and help with the paperwork. This is often more cost-effective than trying to fix issues later.

What happens if I fail?

You will receive feedback on what you need to fix. You can then make the changes and resubmit. Most businesses pass on the second attempt. The fee is usually non-refundable, so it’s worth preparing thoroughly.

Does Cyber Essentials cover all cyber risks?

No. It protects against common, low-skill attacks. It does not protect against sophisticated targeted attacks, insider threats, or data loss from physical theft. You should still implement additional measures like backups, staff training, and encryption.

Is Cyber Essentials mandatory?

It is not legally mandatory, but many public sector contracts require it, and some private sector clients ask for it as a condition of working with them. It is also a requirement for the UK Government’s Cyber Security Procurement Framework.

Related

• Google Fiber Plan Changes: What Subscribers Should Know
• Automate Smart Bulbs Properly: Setup and Best Practices
• Gemini Pushed Me to Try Samsung Bixby?