"Cyber Essentials is the UK government backed certification that proves your business has five core security controls in place: firewalls, secure configuration, access control, malware protection and security update management. Certification is annual, self assessed at the standard level, and achievable within days when the groundwork below is done first.
What is Cyber Essentials?
Cyber Essentials is a certification scheme backed by the UK government and overseen by the National Cyber Security Centre. It certifies that your organisation has implemented five technical controls that stop the large majority of common, untargeted attacks. There are two levels: Cyber Essentials, a verified self assessment, and Cyber Essentials Plus, which adds an independent technical audit of the same controls.
Is Cyber Essentials mandatory?
It is not a legal requirement, but it is a contractual one in growing parts of the economy. Central government contracts involving personal data require it, the Ministry of Defence requires it throughout its supply chain, and a rising number of local authorities, universities, insurers and large private customers ask for it in procurement. For many West Midlands businesses the certificate pays for itself the first time it keeps you in a tender.
The Cyber Essentials checklist: the five controls
1. Firewalls. Every internet connection must sit behind a correctly configured firewall, with no unmanaged services exposed and default passwords changed.
2. Secure configuration. Remove unused software and accounts, change default settings, disable auto-run, and require authentication before anyone reaches organisational data.
3. User access control. Give each person their own account with only the access their role needs. Administrator accounts must be separate from day to day accounts, and leavers must be removed promptly.
4. Malware protection. Every in-scope device needs active anti-malware protection, or an approved alternative such as application allow listing, kept up to date.
5. Security update management. High risk and critical updates applied within fourteen days of release, on operating systems and applications alike, with unsupported software removed or isolated.
What do assessors look for?
The self assessment asks you to declare, precisely, how each control is met across every device and service in scope, including home working equipment and mobile devices. The most common first time failures are unsupported operating systems still in use, shared admin accounts, and update policies that exist on paper but cannot be evidenced. Scope honestly: excluding a network you still use does not remove the risk, and assessors check the boundaries.
How long does Cyber Essentials take, and how long does it last?
With the controls already in place, the self assessment itself can be completed in a few days. The realistic timeline for most SMEs is two to six weeks, most of it spent closing gaps the checklist exposes. The certificate lasts twelve months, and annual recertification keeps you on the current version of the requirements.
Getting help with Cyber Essentials
Most of the effort in Cyber Essentials is the preparation, not the paperwork. Our consultancy team runs the gap analysis, fixes the failures before you submit, and manages the assessment end to end, so the certificate arrives without the scramble.
Frequently asked questions
What is the difference between Cyber Essentials and Cyber Essentials Plus?
The controls are identical. Cyber Essentials is a verified self assessment; Plus adds an independent audit including vulnerability scans and device testing. Contracts specify which level they require.
Does Cyber Essentials cover home workers?
Yes. Devices used by home workers to access organisational data are in scope, which catches many businesses out on their first submission.
Is Cyber Essentials worth it if no contract requires it?
The five controls are simply good security, and certification includes cyber insurance for eligible smaller organisations. It is one of the cheapest credibility signals a small business can buy.
Can we do Cyber Essentials ourselves?
Yes, if you have the technical knowledge to evidence each control accurately. Where IT is outsourced, your provider should be doing most of this already; ours is built into our cyber security service.
LeapIT prepares Birmingham and West Midlands businesses for Cyber Essentials and Cyber Essentials Plus, from gap analysis to certification. If a tender needs a certificate, talk to us about the fastest safe route to passing first time.
