If you run a small business, you’ve probably got enough on your plate without adding another certificate to the list.

But perhaps one of your customers has asked whether you have Cyber Essentials. Maybe it has appeared in a tender document or your insurance broker has mentioned it. Or you might simply be wondering whether your business is doing enough to protect itself from cyber attacks.

So, is Cyber Essentials genuinely useful, or is it just another box-ticking exercise?

The honest answer is that it can be extremely worthwhile, but probably not for the reason you think.

What actually is Cyber Essentials?

Cyber Essentials is a government-backed certification scheme designed to help organisations protect themselves against common cyber threats.

It focuses on five practical areas:

• Firewalls and protecting your internet connection.

• Secure settings on computers and other devices.

• Keeping software and systems up to date.

• Controlling who can access company accounts and information.

• Protecting devices against viruses and other malicious software.

None of this is particularly glamorous. But these are exactly the sorts of gaps that criminals look for.

Think of it as checking that your doors are locked, your windows are closed and you know who has keys to the building.

Why would a small business need it?

There’s still a common assumption that cyber criminals are mainly interested in large organisations. Unfortunately, attackers rarely sit down and carefully decide whether your business is important enough to target. Many attacks are automated, looking for weak passwords, outdated software or accounts without adequate protection.

A small business can be just as vulnerable as a larger one and often has fewer resources to recover if something goes wrong.

A compromised Microsoft 365 account, fraudulent payment request or lost access to important files can cause a huge amount of disruption, even if you only have a handful of employees.

Cyber Essentials helps you address those basic risks before they turn into expensive problems.

Is it really just a questionnaire?

The standard Cyber Essentials certification involves completing a self-assessment questionnaire, which is reviewed by an independent assessor.

That sounds straightforward, but the questions tend to reveal things a business might not have considered.

For example:

• Are all company laptops running supported operating systems?

• Are important security updates being installed promptly?

• Is multi-factor authentication enabled on Microsoft 365 and other cloud accounts?

• Do staff have unnecessary administrator access?

• Are former employees’ accounts properly disabled?

• Are personal devices being used to access company information?

• Do you actually know which devices are connecting to your systems?

For many business owners, the value is not the certificate itself. It’s finally getting clear answers to those questions.

Does Cyber Essentials cover Microsoft 365?

Yes. Cloud services used to store or process business information are part of the assessment.

That includes services such as Microsoft 365, so your email, document storage and account security cannot simply be ignored because they are hosted in the cloud.

Under requirements introduced in 2026, multi-factor authentication must be enabled for cloud services wherever it is available. Missing MFA can result in an automatic assessment failure.

The updated requirements also place greater emphasis on installing critical security updates promptly. IASME explains the current Cyber Essentials requirements here.

This matters because many small businesses assume that having Microsoft 365 automatically means everything has been secured correctly. It doesn’t. The settings still need to be configured and managed.

Can it help you win business?

Potentially, yes.

Some government contracts require Cyber Essentials and larger organisations increasingly ask suppliers to demonstrate that they take cybersecurity seriously.

Even when certification is not compulsory, it can give prospective customers confidence that you have sensible security measures in place.

If you handle sensitive information or provide services to businesses with stricter security requirements, the certificate can help you answer those awkward procurement questions without having to start from scratch every time.

How much does Cyber Essentials cost?

The standard certification fee depends on the size of your business:

• 0–9 employees: £320 plus VAT.

• 10–49 employees: £440 plus VAT.

• 50–249 employees: £500 plus VAT.

• 250 or more employees: £600 plus VAT.

Certification lasts for 12 months, so it needs to be renewed annually. Current pricing is available from IASME.

Those prices cover the assessment itself. If you need help preparing, fixing security issues or updating older equipment, there may be additional costs.

However, if the process uncovers unsupported laptops, missing MFA or unnecessary administrator access, resolving those problems would be worthwhile even without the certificate.

Is cyber insurance included?

Potentially, yes.

UK organisations with an annual turnover below £20 million that certify their entire organisation are entitled to cyber liability insurance arranged through the scheme.

The policy includes access to incident response support, with a total liability limit of £25,000. You should always check the policy terms and whether the cover is sufficient for your business, but it is a useful additional benefit. The National Cyber Security Centre explains the included cover.

What is the difference between Cyber Essentials and Cyber Essentials Plus?

Standard Cyber Essentials is based on a verified self-assessment.

Cyber Essentials Plus includes the same security requirements, but an assessor also carries out technical checks to confirm that the controls are working.

For many smaller businesses, standard Cyber Essentials is a sensible starting point. Cyber Essentials Plus may be more appropriate if a customer requires it, your business handles particularly sensitive information or you want a higher level of independent assurance.

Does certification mean we can’t be hacked?

No and anyone suggesting otherwise is overselling it!

Cyber Essentials helps protect against common attacks, but it does not guarantee that your business is completely secure.

You still need to think about staff awareness, suspicious emails, backups, incident response and what would happen if an important account was compromised.

The certificate is a useful foundation, not an excuse to stop paying attention.

So, is Cyber Essentials worth it?

For many small businesses, yes.

If you need it for a contract, the commercial benefit is obvious. But even if nobody has asked for it, working towards certification can highlight weaknesses that might otherwise go unnoticed.

The most valuable outcome isn’t the badge on your website. It’s knowing that someone has checked the basics, fixed the gaps and made your business a harder target.

Thinking about Cyber Essentials but not sure where to start? We can review your current setup, explain what needs attention and help you prepare for certification.