Cyber Essentials for Small Businesses: What It Is, What It Costs and How to Pass First Time

Cyber Essentials is the UK government's baseline cyber security standard, run by the National Cyber Security Centre (NCSC) and delivered through its partner IASME. It certifies that your business has five basic technical controls in place. The NCSC's own description is that it is "the minimum standard of cyber security recommended by the Government for organisations of all sizes."

It comes in two levels:

• Cyber Essentials is a self-assessment. You answer a questionnaire about your systems, a senior person signs it, and a qualified assessor reviews the answers. Most small businesses complete it in a few weeks.
• Cyber Essentials Plus covers the same five controls, but an assessor tests them: vulnerability scans of your devices, checks that patches are actually installed, that malware protection works, and that a phishing email with a dodgy attachment is handled correctly. It must be completed within three months of passing the self-assessment.

What it is not: a guarantee against attack, a full security audit, or a replacement for backups, monitoring and staff awareness. It is a floor, not a ceiling. It is also not a legal requirement for most businesses; it is a contractual one when a customer, a public-sector buyer or the MOD asks for it.

Certificates are valid for 12 months, so it is an annual cycle.

Every device in scope counts: laptops, desktops, servers, phones and tablets that access company data, including staff-owned phones with work email on them. Remote workers are explicitly in scope under the current question set.

The question set in force since 28 April 2025 is version 3.2, known as Willow. If you certified before then, three changes matter most:

1. Vulnerability fixes, not just patches. The requirement is now to apply any fix the vendor recommends for a high or critical vulnerability within 14 days, whether that is a patch, a configuration change or a registry fix. "We are waiting for the next update cycle" is no longer an answer.
2. Passwordless authentication is recognised. Biometrics, security keys, one-time codes and push notifications are all acceptable instead of a password, provided any passwordless method is FIDO2 compliant.
3. Remote and home working is spelled out. Staff working from home, hotels and cafés on untrusted networks are in scope, and the controls have to reach their devices.

The other perennial: unsupported software fails you. Windows 10 reached the end of free support in October 2025. A business with Windows 10 machines and no paid Extended Security Updates cannot pass. This is the single most common reason we see a first attempt fail.

IASME's assessment fee for Cyber Essentials is tiered by organisation size. NCSC states it starts at £320 + VAT; the published tiers are:

Figures are IASME's list prices as reported in September 2026; confirm with your certification body when you book.

Cyber Essentials Plus is quoted individually because it depends on how many devices and locations have to be tested. UK certification bodies commonly charge in the low thousands of pounds for a small business, on top of the self-assessment fee.

The bigger cost is usually remediation: replacing unsupported machines, buying a licence that includes device management and Defender, and the engineering time to enforce MFA and patching properly. For a business already on Microsoft 365 Business Premium with devices in Intune, that work is mostly configuration. For a business on older kit with no management tooling, it can be the largest line.

Included insurance. A UK-domiciled organisation with turnover under £20m that certifies its whole organisation is automatically entitled to cyber liability insurance arranged through IASME, with a total liability limit of £25,000 and a 24-hour incident helpline. It is not a substitute for a proper cyber policy, but it is real cover for the price of the assessment.

• Contracts. Central government contracts that involve handling personal or sensitive information require it, and the MOD requires it from suppliers handling its information. Increasingly, larger private-sector customers ask for it in supplier questionnaires.
• Insurance. Some insurers price or condition cyber cover on it; all of them ask the same questions it answers.
• It forces the basics. The five controls are the ones that stop the majority of commodity attacks: phishing that steals a password without MFA, ransomware that lands on an unpatched laptop, a leaver whose account is still active.
• It is a credible badge. Unlike a self-declared "we take security seriously", a certificate is issued by a third party against a public standard and can be checked on the NCSC's register.

What it will not do is protect you from a targeted attack, recover your data after ransomware, or tell you that someone is inside your systems right now. Those need backups and monitoring, which are separate conversations.

The sequence we use with clients:

1. Scope. Decide whether the whole organisation is in scope (it should be, for the insurance and for credibility) and list every device, cloud service and user.
2. Gap check. Compare each of the five controls with what is actually in place. The usual gaps: MFA not enforced for everyone, admin rights on everyday accounts, an unsupported PC in a corner, no evidence of patch timelines, staff phones with work email and no management.
3. Fix the gaps. In a Microsoft 365 business this is largely Entra ID and Intune configuration, plus replacing anything unsupported.
4. Answer the questionnaire from evidence, not memory. Assessors mark answers against the standard; vague answers are marked down. We answer on the client's behalf or alongside them.
5. Book Plus within three months if you are going for it, so the self-assessment does not have to be repeated.

Common reasons for failing: unsupported operating systems, MFA not on every cloud service, no documented joiner and leaver process, personal devices in scope without controls, and answers that describe intentions rather than what is configured today.

We prepare businesses for Cyber Essentials and Cyber Essentials Plus as part of our managed service, and as a standalone project for businesses that just need to get over the line. In practice that means the gap check, the configuration work in Microsoft 365 and Intune, the evidence for patching and MFA, and the questionnaire answered properly.

The settings Cyber Essentials asks for are the same ones we put in place as standard for every client, which is why our clients tend to find the annual renewal uneventful. If you want to see how your Microsoft 365 setup measures up first, our Microsoft 365 licensing and security guide explains which licence gives you the tooling, and the free IT Health Check benchmarks where you stand today.