Cyber Essentials is the UK government-backed certification showing your business has five baseline security controls in place: firewalls, secure configuration, access control, malware protection and software updates. For most Norfolk and Suffolk SMEs it takes a few weeks of preparation, costs a few hundred pounds for the assessment itself, and is increasingly a condition of winning contracts, not just a nice-to-have. This guide explains the whole thing without the jargon.
What is Cyber Essentials, in plain English?
It's a checklist with a badge. The National Cyber Security Centre (NCSC) defined the five security controls that stop the majority of common, untargeted cyber attacks; certification is you demonstrating, via a self-assessment questionnaire that's independently reviewed, that your business actually has them in place.
That "majority of common attacks" point is why it exists. Most breaches of small businesses aren't sophisticated: they're an unpatched laptop, a guessable password without MFA, an ex-employee account nobody disabled. Cyber Essentials is the government saying "close these doors first", and the certificate is proof to customers, insurers and regulators that you have.
What are the five controls?
Every question in the assessment hangs off one of these:
- Firewalls. Your internet connection and devices sit behind a properly configured boundary, with no services exposed by accident.
- Secure configuration. Default passwords changed, unused software and accounts removed, auto-run disabled; devices set up deliberately rather than as they came out of the box.
- User access control. People have the access they need and no more; admin rights are restricted, and multi-factor authentication protects cloud accounts.
- Malware protection. Every device runs supported anti-malware protection, or only runs approved applications.
- Security update management. Operating systems and applications are supported and patched, with high-risk updates applied within 14 days.
Reading the list, you can see the real nature of the work: it's housekeeping, not wizardry. The effort is in knowing every device and account you have (the inventory is where most businesses discover surprises) and tightening the ones that drifted.
What's the difference between Cyber Essentials and Cyber Essentials Plus?
Same five controls; different level of proof. Cyber Essentials is a verified self-assessment. Cyber Essentials Plus adds an independent technical audit where an assessor actually tests your devices.
| Cyber Essentials | Cyber Essentials Plus | |
|---|---|---|
| How it's assessed | Self-assessment questionnaire, independently reviewed | The same, plus hands-on technical testing by an assessor |
| Typical assessment cost | Around £320 to £600 +VAT, tiered by business size | Commonly £1,400 to £2,500+ depending on size and scope |
| Timescale | Days to a few weeks including preparation | CE first, then the audit within 3 months |
| Who asks for it | Supply chains, insurers, many public-sector contracts | MoD and sensitive public work, security-conscious clients |
Our advice for most firms: get Cyber Essentials first, see what the process surfaces, then decide whether your contracts or clients justify Plus. We've more detail on both on our Cyber Essentials and Cyber Essentials Plus pages.
Why are Norfolk and Suffolk businesses being asked for it?
Because certification rolls downhill through supply chains. Central government requires it of suppliers handling certain data; those suppliers require it of theirs; and insurers and larger customers have copied the pattern.
In practice around here that means: firms tendering for public-sector work, businesses supplying larger manufacturers or defence-adjacent companies, professional firms whose clients audit them, and anyone renewing cyber insurance and finding the questionnaire has grown teeth. Certification also brings included cyber insurance for smaller organisations (currently £25,000 of cover for UK organisations under £20m turnover that certify the whole organisation and opt in). For a certificate costing a few hundred pounds, it's one of the few compliance items that can directly win you work.
What trips businesses up in the assessment?
Five patterns account for most failures and delays:
- Unknown devices. The laptop in a drawer that still syncs email, the director's home PC with VPN access. Everything in scope must meet the controls.
- Unsupported software. An old Windows version on the machine that runs the label printer, a server past end-of-life. If the vendor no longer patches it, it fails.
- MFA gaps. Multi-factor authentication is required on cloud services; "we have it on most accounts" isn't a yes.
- Admin rights everywhere. Day-to-day work done on administrator accounts is an automatic problem.
- BYOD blind spots. Personal phones accessing company email are in scope, which surprises nearly everyone.
None of these is hard to fix; they're hard to find if nobody's maintained an inventory. That's typically where an IT provider earns their keep in the process, and it's fair to say (disclosure: this is Snap IT's site, and certification support is part of our package) that a provider who already manages your devices can usually get you through in a fraction of the time, because the inventory and controls are their day job. If you're assessing providers for this, our checklist of questions to ask an IT provider before you sign includes the security questions that matter.
How do you get started?
Three steps, whoever helps you:
- Inventory. List every device, account and cloud service the business uses. Honestly, including the awkward ones.
- Gap check. Walk the five controls against the inventory and fix what falls short: retire the unsupported, enable MFA, pull back admin rights, confirm patching.
- Assess. Complete the questionnaire through a certification body and fix anything the review bounces back.
Email security isn't formally one of the five controls, but it belongs in the same housekeeping sweep: our guide to SPF, DKIM and DMARC for Norwich businesses covers the records that stop your domain being impersonated, and our free email security checker will show you where yours stand right now. And if you're weighing certification as part of choosing or changing provider, the bigger picture lives in our guide to choosing an IT support company in Norwich and Norfolk.
Frequently asked questions
How much does Cyber Essentials cost?
The assessment itself is tiered by business size, from around £320 +VAT for the smallest firms. The real cost is preparation: fixing whatever the five controls surface, which ranges from nothing (well-managed environments) to retiring old kit and rolling out MFA.
How long does certification take?
A well-prepared SME can go from starting the questionnaire to certified inside a week or two. Businesses starting from scratch should allow four to eight weeks, most of it remediation rather than paperwork.
Does Cyber Essentials expire?
Yes, it's annual. Recertification each year keeps the badge valid, and since the controls are baseline hygiene, staying compliant year-round is the realistic way to hold it.
Is Cyber Essentials a legal requirement?
No, but it's a contractual one for much UK government work and increasingly for private supply chains and insurance. For everyone else it's voluntary, which is precisely why holding it says something.
Do personal phones and home PCs count?
If they access company data or email, yes, they're in scope and must meet the controls. This is the scoping question that catches most small businesses out, so settle it early.
Can we do it ourselves without an IT company?
Absolutely, especially for a small, simple, cloud-based setup; the questionnaire is designed to be answerable by a competent business owner. The value of help scales with your complexity and with how far your current setup is from the controls.
Should we go straight to Cyber Essentials Plus?
Only if a contract or client requires it. Otherwise certify at the standard level first; Plus reuses all that work and adds the audit, so nothing is wasted by starting there.
