Cyber Essentials for small businesses

What it is and who asks for it

Cyber Essentials is a government-backed certificate that you renew every year, showing your business has the basic protections in place against the most common online attacks.

A current certificate lets your business bid for UK government contracts (opens in a new tab) that involve handling personal or financial data, and some customers and insurers ask their suppliers for it too.

What gets checked

Cyber Essentials checks five basic controls:

Firewalls: controlling what can reach your devices and network from the internet
Secure configuration: removing default passwords and settings you don't need
Security updates: keeping software and devices up to date
User access control: making sure people only have the access they need
Malware protection: stopping harmful software from running

Source: NCSC (opens in a new tab)

Cyber Essentials in numbers

92%
less likely to make a cyber insurance claim: organisations with Cyber Essentials, compared with those without
Source: NCSC, “A decade of Cyber Essentials”, November 2024 (opens in a new tab)
5%
of businesses hold Cyber Essentials, the government's baseline certificate
Source: Cyber Security Breaches Survey 2025/26 (DSIT) (opens in a new tab)

Our approach

Guided by the NCSC Cyber Action Toolkit

The National Cyber Security Centre's Cyber Action Toolkit gives small businesses a free, step-by-step security plan across three levels. Working through it takes time, so we carry out the actions for you, record the evidence as we go, and then take you on to Cyber Essentials, the government-backed certificate.

Read about the Cyber Action Toolkit on the NCSC website (opens in a new tab)

Level 1Foundation
Level 2Improver
Level 3Enhanced
ThenCyber Essentials

How we get you certified

Check. We review your setup against the Cyber Essentials requirements.
Fix. We close the gaps, from updates and firewalls to accounts and devices.
Prepare. We prepare your answers and evidence for the assessment.
Certify. You submit the assessment to a certification body, and we support you until your certificate is issued.

Our Certified bundle

The Cyber Essentials certification fee is set by IASME, the certification body, not by us, and is charged at cost: currently £320 for up to 9 staff and £440 for 10–49, plus VAT.

See full pricing for every bundle

Certified

Everything in Secure, plus support through Cyber Essentials, the government-backed certificate.

Best for: Winning contracts and tenders that ask for Cyber Essentials.

1–5 staff: £3,240Secure plus £990or 12 interest-free monthly payments of £270
6–15 staff: £4,980Secure plus £1,230or 12 interest-free monthly payments of £415
16–25 staff: £7,260Secure plus £1,740or 12 interest-free monthly payments of £605

Feature and cost check: we switch on useful features you already pay for and flag anything you could cancel.
Everything in Secure
Cyber Essentials readiness and support through certification with an accredited certification body
External attack surface review: checking what an attacker can see about your business from the internet
Ready-made answer pack for insurers and customers

The Cyber Essentials Plus audit isn't included; we offer it at cost.

Ask about Certified

Cyber Essentials questions

Common questions about Cyber Essentials

How long does it take?

Typically 4 to 6 weeks from starting with us to receiving your certificate, depending on how much needs fixing first.

How much does it cost?

Our Certified bundle includes the work to get you ready. The Cyber Essentials Plus audit isn't included; we offer it at cost. The certification fee is set by IASME, the certification body, and charged at cost: currently £320 for up to 9 staff and £440 for 10–49, plus VAT.

Is it a one-off?

No. A certificate is valid for 12 months, so you renew each year. We can handle the renewal for you: £250 for 1–5 staff, £375 for 6–15 and £500 for 16–25 staff, plus IASME's certification fee, charged at cost, plus VAT.

What's the difference between Cyber Essentials and Cyber Essentials Plus?

Both cover the same five controls. Cyber Essentials Plus adds hands-on testing by an assessor to check the controls work in practice. We can prepare you for either. The Plus audit isn't included in our Certified bundle; we offer it at cost.

Guides

Free guides

A client has asked for Cyber Essentials. Do I need it?
What Cyber Essentials is, when you actually need it, what it costs and how long it takes, written for small business owners who've just been asked for it.
Will I fail Cyber Essentials under the 2026 rules?
The Cyber Essentials question set changed in April 2026, and missing two-step sign-in on cloud services is now an automatic fail. What that means for a small business on Google Workspace or Microsoft 365.

All guides

Ready to get it done properly?

Book a free setup review See prices