January is the month when owner-managed SMEs in Sussex and Kent start looking at their IT support arrangements with fresh eyes. Contracts reviewed, access rights audited, and the questions that were put on hold over December finally get asked again. One question, increasingly, is about Cyber Essentials.

It is not a technical question. It is a judgment call about whether a provider can be trusted with your data. The problem is that most SMEs do not know how to interpret an IT provider's Cyber Essentials status — whether they hold a certification themselves, and what that status actually tells you about the security of your business.

This article explains why an IT provider's Cyber Essentials certification should be on your shortlist when evaluating support partners, what the government scheme actually covers, and how to use that information to make a proper decision rather than a familiarity one.

[[toc]]

What is Cyber Essentials and who backs it?

Cyber Essentials is a government-backed, industry-supported scheme designed to help organisations protect themselves against the most common online threats. It is maintained by the National Cyber Security Centre and delivered through IASME, the organisation appointed by the Department for Science, Innovation and Technology to run the certification programme.

The scheme sits at the centre of the UK's national cyber resilience strategy. It is not optional extra insurance — it is the minimum standard recommended by the Government for organisations of all sizes that want a baseline level of cyber security hygiene.

There are two certification levels:

• Cyber Essentials — a combination of self-assessment and independent audit against five core technical controls.

• Cyber Essentials Plus — the same five controls, but with independent technical verification testing.

The five controls that underpin both levels are: firewalls, secure configuration, security update management, user access control, and malware protection. These are not theoretical principles. They are the controls that prevent the majority of common cyber attacks, including the most widely deployed ransomware variants.

The GOV.UK Cyber Essentials scheme overview confirms that these five controls are grounded in practical, evidence-based defence against the techniques most frequently used by threat actors targeting SMEs.

Why should an IT provider hold Cyber Essentials certification?

This is the question worth sitting with. An IT provider manages systems, processes, and data on your behalf. They have access to the same accounts, infrastructure, and intelligence as your staff — often more, because they work across multiple client environments simultaneously.

When a provider does not hold Cyber Essentials certification, you are operating on trust alone. When they do hold certification, you have evidence that they take the same baseline controls seriously as the NCSC recommends.

There are four practical reasons why this matters.

Your data passes through their environment

Every piece of data you back up, every ticket they log, every remote session they run — it all passes through the provider's own systems. If those systems lack basic controls, your data sits inside a weakened environment. That does not mean an attacker will get in. It means the door is easier to open.

Cyber Essentials certification requires documented evidence that firewalls are configured, configuration baselines are maintained, patches are applied, access is controlled, and malware protection is active. It is not a pass/fail discussion. It is proof that the provider's own house is in order.

The provider's access to your networks creates supply chain risk

The NCSC has long flagged supply chain risk as one of the most significant threats to small organisations. Even if your own controls are adequate, a compromised IT provider — or a provider whose security falls below the minimum standard — becomes a route into your business that bypasses your own defences entirely.

Cyber Essentials certification at least tells you that the provider has addressed the controls relevant to this risk. Cyber Essentials Plus adds independent technical verification, which is worth understanding when a provider handles sensitive data or regulated work.

Certification signals operational maturity

A business that takes the Cyber Essentials assessment seriously tends to approach security more systematically than one that does not. The process requires documented policies, evidence of controls, and annual renewal. That is a signal about the provider's discipline.

It is not a perfect signal — no certification is a perfect signal. But it is one you can verify rather than guess at.

Many of their other clients probably hold it

Your provider is not operating in a vacuum. If they service clients in regulated sectors, work with government contracts, or support partners who require suppliers to be certified, then the provider's own Cyber Essentials status is likely a business requirement — not a marketing choice. Understanding whether they hold that certification helps you read the market context.

How to evaluate a provider's Cyber Essentials status

When you ask an IT provider about their certification, you should expect a clear answer. Here is what to look for.

Do they hold current certification — or did they hold it?

Cyber Essentials certification requires annual renewal. A certificate that expired two years ago is not current. Ask for the date of their most recent certification and the certificate number, which you can verify against the IASME register of certified organisations.

Is it Cyber Essentials or Cyber Essentials Plus?

Cyber Essentials Plus involves independent technical testing of the five controls, not just documentary evidence. For an IT provider, Cyber Essentials Plus is the more meaningful certification — it means someone has actually tested their controls rather than accepting their own word that they are in place.

This distinction matters most when you handle sensitive client data or operate in a sector where supply chain security is a commercial requirement.

Can they explain how certification affects YOUR service?

A good answer goes beyond "we are certified." It should explain how the provider's certification interacts with the services they deliver to you — what the five controls cover in practice, how the provider's patch management differs from yours, and how they handle remote access to your environments.

If the answer is vague, take it as information. Certifications exist on paper; what matters is whether the provider's own people understand how those controls apply to the work they do for you.

Does the provider use certification to reassure prospects?

Be clear-eyed here. A provider that uses Cyber Essentials certification as a primary selling point may be compensating for other weaknesses. Conversely, a provider that simply has it and can demonstrate it matters is operating in a more measured way. The quality of the answer tells you more than the badge itself.

What Cyber Essentials does NOT tell you

An honest evaluation of any IT provider requires you to understand the limits of their certification status. Cyber Essentials is a baseline scheme. That is deliberately the case — it is meant to be achievable for organisations of all sizes.

It does not cover advanced threat detection, incident response capabilities, penetration testing, or the kinds of controls that sit above a baseline. It does not guarantee that a breach will not happen. It does not assess the quality of a provider's customer service, response times, or strategic planning.

The scheme also does not cover the services the provider delivers to you directly. Your own Cyber Essentials certification — and your provider's — address two different security boundaries. The provider's certification tells you about their house. Your own certification tells you about yours. Both matter.

That distinction is worth understanding before you assume that a certified provider automatically means a secure partnership. It does not. It means the provider has demonstrated they meet a recognised minimum standard — nothing more, nothing less.

How your own security baseline fits in

One of the most overlooked aspects of the Cyber Essentials question is that your provider's certification only addresses half the equation. You still need to know whether your own organisation meets the same five controls.

The NCSC's guidance on Cyber Essentials is clear: achieving certification is not a one-off event. It requires annual renewal, ongoing monitoring, and evidence that controls are maintained, not just checked at reassessment time.

For a 10 to 25 seat owner-managed business, this usually means answering five practical questions:

• Are all devices on a firewall-protected network?

• Are operating systems and applications kept up to date with security patches?

• Is malware protection active and updated on every endpoint?

• Is user access controlled, with strong authentication for everyone who touches business data?

• Is secure configuration the standard, not the exception?

If you cannot answer these confidently — and most owner-managed SMEs cannot at this level of detail — then your provider's Cyber Essentials certification, while valuable, does not remove your own responsibility.

The starting point for understanding your position is a structured baseline assessment. A Security Triage Call is the approved first step: a conversation that maps your current IT Security Baseline against the five controls and identifies the gaps before they become commercial liabilities.

Cyber Essentials and your business — practical implications

There are commercial consequences to a provider's certification status that extend beyond the question of whether their systems are secure.

Customer confidence

The IASME benefits analysis for Cyber Essentials confirms that businesses using the certification within their supply chain risk management report increased efficiency and cost savings in the due diligence process. Requiring evidence of standardised minimum expectations reduces the time spent assessing suppliers — and having Cyber Essentials certification yourself means you are not the ones who slow the process down.

When you are the customer, this works the other way: knowing your provider holds certification means you do not need to spend weeks completing their security questionnaire. The certification itself is the answer to a standard set of questions.

Contract requirements

A growing number of UK government contracts require suppliers to have Cyber Essentials certification. Many of the UK's largest banks and financial institutions have also incorporated Cyber Essentials into their supplier requirements. If your business bids for these types of contracts, your provider's certification status becomes a commercial question — not just a technical one.

If your provider does not hold certification, you may need to find an alternative support partner to access certain contracts. If your provider does hold it, you have one fewer thing to negotiate during procurement.

Insurance considerations

Some insurance companies offer incentives such as lower premiums to businesses that have achieved Cyber Essentials certification, as it indicates a lower risk profile. Additionally, any UK organisation with a turnover under £20 million that achieves Cyber Essentials certification covering their whole organisation is automatically entitled to Cyber Liability Insurance arranged by IASME.

The UK's leading insurers have published research showing that organisations with Cyber Essentials certification are 92% less likely to make a claim on their cyber insurance than those without — figures cited by the National Cyber Security Centre and confirmed in government publications.

When is the right time to raise this question?

There is no wrong time to ask about an IT provider's Cyber Essentials status. But January tends to be the most practical month for three reasons.

First, it is when contract reviews happen. If you are approaching the end of a support term, or your current term has fixed renewal dates coming up in the new year, this is the moment to ask.

Second, January is when owner-managed SMEs look at their arrangements with fresh eyes. The business has had a few weeks away from daily operations, and questions that were deferred during the busy autumn and festive period can finally be addressed.

Third, many providers run their own Cyber Essentials re-assessments in the new year. Knowing where you stand before they start their own reassessment cycle means you understand their current position rather than catching them between certifications.

This does not mean you need to wait until January. If you are evaluating a provider now, ask the question. If you are already working with one, add it to your next review. The timing is secondary to the fact that the question exists.

What next?

Understanding your IT provider's Cyber Essentials status is a single question that opens up a wider conversation about how your security is handled, who is accountable for what, and whether the arrangement you have in place matches the risks your business faces.

It is not a complete answer. It is not the only thing you should consider. But it is something you can verify, and it tells you something real about the provider's approach to the baseline controls that prevent the majority of common attacks.

The next step is either to ask your current provider for their certification details — certificate number, date, and level — or book a Security Triage Call to understand your own IT Security Baseline first. Once you know where you stand, the question of which provider to trust becomes easier to answer.

Frequently Asked Questions

What is the difference between Cyber Essentials and Cyber Essentials Plus?

Both levels cover the same five core technical controls: firewalls, secure configuration, security update management, user access control, and malware protection. Cyber Essentials requires a self-assessment form plus an independent audit of that assessment. Cyber Essentials Plus adds independent technical verification testing, where an assessor actually tests your systems to confirm the controls are in place. For an IT provider, Cyber Essentials Plus is the more meaningful certification because someone has tested their controls rather than accepting their own word.

Does an IT provider's Cyber Essentials certification guarantee our data is secure?

No. Cyber Essentials is a baseline scheme that addresses the most common cyber attacks. It does not cover advanced threat detection, incident response capabilities, or every possible security risk. It tells you the provider has demonstrated they meet a recognised minimum standard — nothing more, nothing less. It is one piece of information in a much wider evaluation.

How often does a provider need to renew Cyber Essentials certification?

Cyber Essentials certification requires annual renewal. This is deliberate — the scheme is designed to encourage organisations to regularly review and maintain their cyber security controls rather than achieving certification once and allowing standards to drift. When evaluating a provider, ask for the date of their most recent certification and the certificate number, which can be verified against the IASME register.

Should both our business and our IT provider hold Cyber Essentials?

Both matter, and they address different security boundaries. Your provider's certification tells you about their house — whether their own systems meet baseline controls. Your own certification tells you about yours. If your provider handles your data or manages your infrastructure, their controls directly affect your risk profile, so both certifications are relevant to your overall security posture.

Can a small UK business get Cyber Essentials certification for free?

UK organisations with an annual turnover under £20 million that achieve Cyber Essentials certification covering their entire organisation are automatically entitled to Cyber Liability Insurance arranged by IASME, the Cyber Essentials delivery partner. The certification itself still requires a fee payable to a Certification Body licence by IASME, but the included cyber insurance provides additional value. Any UK organisation can pursue certification — the insurance entitlement is an automatic benefit for eligible businesses.