Cyber Essentials Explained: Who Actually Needs It and What It Costs

Cyber Essentials has been around for over a decade, backed by the UK government, and is widely recognised as the baseline standard for small business cyber security. And yet the number of businesses that have actually achieved it remains surprisingly low.

Part of the problem is that it is not always well understood. What does it actually cover? Is it worth the effort? And who genuinely needs it versus who is just being told they should get it?

Here is a straightforward breakdown.

What Cyber Essentials Actually Is

Cyber Essentials is a certification scheme that focuses on five technical controls:

• Firewalls
• Secure configuration
• Access control
• Malware protection
• Patch management

These five areas cover the most common attack vectors, the routes through which the vast majority of successful cyber attacks happen.

It is not a comprehensive security audit. It is not going to uncover every vulnerability in your systems. What it does is verify that your basic hygiene is in order, that you have locked the doors and windows before worrying about the alarm system.

There are two levels. Cyber Essentials is self assessed and verified by a certifying body. Cyber Essentials Plus covers the same controls but is independently tested by a technical assessor. CE Plus is more rigorous and more credible, but CE is a solid and meaningful starting point.

Who Needs It

If you supply goods or services to central government, you need it. It is a mandatory requirement for any contract that involves handling personal information or providing certain technical products and services to HM Government.

Beyond the mandatory cases, Cyber Essentials is increasingly expected by larger clients as part of procurement and due diligence. If you are a supplier to NHS trusts, financial services firms, or large corporates, you may find it is being asked for as a condition of doing business.

Even if nobody is asking for it, achieving Cyber Essentials is genuinely worth doing. It forces you to look at your setup honestly, fix things that should have been fixed, and creates a documented record of your security posture that matters to insurers.

What It Costs

The certification fee itself starts at around £300 for Cyber Essentials. Cyber Essentials Plus is more, the technical assessment costs vary by provider and business size, but typically runs from several hundred to a few thousand pounds.

The harder cost to estimate is remediation. If your systems are in good shape, preparation might take a day or two of internal time. If there are gaps, outdated software, weak access controls, missing MFA, the work to fix them is what drives the real cost.

A good IT partner will be able to give you an honest pre-assessment before you start the formal process, so you are not paying for a certification you are not yet ready to pass. See our readiness guide for what to check first.

Common Misconceptions

"It's just a box ticking exercise." Not really. The five controls it covers are genuinely the things that stop most attacks. Passing Cyber Essentials means your basics are solid, and most businesses that get breached did not have solid basics.

"It's too complicated for a small business." The self assessed version is a questionnaire, not a technical audit. With the right help, most small businesses can get through it without drama.

"We're too small for it to matter." As we covered in why SMEs are now the primary target, size is not the protection it used to be. Being certified sends a signal to clients, insurers, and (less helpfully) attackers.

The Honest Verdict

Cyber Essentials is worth doing. Not because it makes you invulnerable, but because it makes you significantly harder to attack cheaply, signals to clients that you take security seriously, and gives you a credible baseline to build on.

If you are not sure whether you would pass today, that is a good reason to find out. Get in touch for a free readiness conversation.