Cyber Essentials is the United Kingdom's government-recommended baseline for cyber security. Developed by experts at the National Cyber Security Centre (NCSC) and delivered through IASME, it sets out five technical controls that any organisation—regardless of size—can implement to defend against the most common internet-based attacks.

For a 10–25 seat business running Microsoft 365, Cyber Essentials is not an abstract compliance exercise. It is a practical framework that aligns closely with the everyday security measures every owner-managed business should already have in place. Understanding what it requires—and when to act—gives you the clarity to plan your certification or, at minimum, strengthen your IT security baseline well before a customer or insurer asks.

What Is Cyber Essentials, Exactly?

Cyber Essentials is a certification scheme, not a consultancy. It defines five technical controls and provides a structured self-assessment or supported assessment process. The scheme is managed by IASME, which acts as the NCSC's official Cyber Essentials Delivery Partner, operating a network of over 400 certified assessment bodies across the UK.

The certification itself comes in two levels:

• Cyber Essentials — a self-assessment verified by an independent assessor. Pricing is tiered, starting from £320 plus VAT, depending on organisation size.

• Cyber Essentials Plus — the same five controls, but with independent technical testing of your actual systems to verify they are properly implemented.

Both levels assess the same five technical controls. The difference lies in how those controls are verified.

The scheme exists because the NCSC observed that most cyber attacks on small businesses are basic in nature — comparable to a thief trying an unlocked door. Cyber Essentials ensures that door is locked.

The Five Technical Controls Explained

Every version of Cyber Essentials — basic and Plus alike — assesses the same five technical controls. Here is what each one means in practical terms for a typical SME running M365.

1. Firewalls

A firewall creates a barrier between your network and the internet. For a small business, this means your boundary firewall (usually built into your broadband router or office appliance) must be configured to block unnecessary inbound traffic, and any software firewalls on endpoints must be enabled.

In an M365 environment, the boundary firewall protects your office network, while device-level firewalls (such as Windows Defender Firewall) provide an extra layer on each laptop and desktop.

2. Secure Configuration

Devices must be set up securely to minimise the number of pathways available to an attacker. In practice, this means disabling unnecessary services, removing default passwords, applying security benchmarks to operating systems, and using Mobile Device Management tools such as Microsoft Intune to enforce consistent, secure configurations across every device in your organisation.

A device that has not been intentionally hardened — with default settings, unused ports open, or administrative accounts mixed with everyday user accounts — presents an avoidable risk.

3. Security Update Management

Software vulnerabilities are a frequent entry point for attackers. Cyber Essentials requires that operating systems, applications, and firmware are kept up to date with the latest security patches.

For an M365-centric business, this typically means automating Windows and macOS updates, keeping M365 applications current, and ensuring there is no device on your network that is exempt from patching without a documented, time-limited justification.

4. User Access Control

This control asks whether you know who has access to what, and whether that access is appropriate. In a small business context, it means:

• Enabling multi-factor authentication (MFA) on all user accounts, with special emphasis on admin and privileged accounts.

• Separating administrative accounts from everyday user accounts — administrators should log in with dedicated admin credentials, not their standard login.

• Maintaining a clear process for onboarding new staff and offboarding departing staff, including revoking access promptly.

• Removing guest access or external sharing from M365 unless a documented business need exists.

5. Malware Protection

Cyber Essentials requires that active, up-to-date malware protection is running on every in-scope device. This typically means a properly configured endpoint protection solution — such as Microsoft Defender for Endpoint (included in many M365 business plans), SentinelOne, or a comparable EDR solution — with real-time scanning enabled and definitions current.

Legacy or ad-hoc antivirus installations across different endpoints do not meet the requirement. Consistency is the key.

Why February Matters for SMEs in Sussex and Kent

April is a common target date for Cyber Essentials certification. Many SMEs plan around the start of the new financial year, and suppliers increasingly expect certification as a pre-requisite for new contracts.

If you are aiming for an April certification date, February is the right time to understand what is involved. The self-assessment process alone can take several hours if you have never tackled it before, and your organisation may need to close real gaps — something like enabling MFA across every account or standardising patching policy — before you even begin the assessment.

Planning ahead removes the last-minute rush and gives you space to implement changes properly rather than scrambling at the last moment.

Self-Assessment Versus Supported Assessment

Cyber Essentials offers two pathways to certification:

Self-led means you register directly through IASME, complete the online assessment questionnaire yourself, and have it verified by an independent assessor. This is cost-effective and works well if someone in your organisation has the technical confidence to answer the question set accurately.

Supported assessment means you engage a Certification Body licence by IASME. A qualified assessor walks you through the process, helping you understand what each question means and ensuring your answers reflect your actual environment.

Either route leads to the same certification. The choice depends on your internal technical capability and how much guidance you want.

How Cyber Essentials Fits With Your IT Security Baseline

You do not need Cyber Essentials certification to benefit from its five controls. In fact, aligning your organisation to these controls — what we call an IT Security Baseline — is valuable whether or not you ever pursue formal certification.

A CE-aligned environment means your business is protected against the most common attack vectors, more likely to satisfy customer security questionnaires, and better positioned for insurance reviews. The baseline is also the foundation of how our managed service operates.

If you want to understand where your business currently stands against a CE-style IT security baseline, a Security Triage Call provides a high-level diagnostic. It covers the core Cyber Essentials domains and gives you a clear sense of what is in place, what is missing, and what needs attention first.

Book a Security Triage Call

What Cyber Essentials Is Not

It is worth stating clearly what this scheme does not do.

Cyber Essentials does not guarantee protection against all cyber threats. It addresses the most common internet-based attacks. Targeted or advanced threats require additional controls beyond the baseline.

It does not provide ongoing monitoring or support. The certification is a point-in-time assessment of whether you have the five controls in place.

It does not replace a comprehensive cybersecurity strategy. For small businesses, a CE-aligned IT Security Baseline is a necessary starting point — not a finish line.

Frequently Asked Questions

How long does it take to prepare for Cyber Essentials?

Preparation time varies by organisation. A well-organised 10–25 seat business with its IT under reasonable control typically needs between four and eight weeks to close gaps, prepare the self-assessment answers, and submit for certification. If you have no prior exposure to the framework, factor in additional time for research and discussions with your IT provider.

Do we need Cyber Essentials Plus?

Cyber Essentials Plus adds independent technical testing to the self-assessment process. Most SMEs start with the standard Cyber Essentials route. You may need Cyber Essentials Plus if a customer contract explicitly requires it, or if your business handles sensitive data and you want independently verified assurance that your controls are working in practice.

Is Cyber Essentials the same as ISO 27001?

No. Cyber Essentials is a baseline technical controls scheme focused on defending against common internet-based threats. ISO 27001 is a comprehensive information security management system standard that covers people, processes, and technology across a much broader scope. They serve different purposes and operate at different levels of depth.

Can we achieve Cyber Essentials without an IT provider?

Technically, yes — through the self-led route. In practice, completing the assessment accurately and implementing the five controls properly usually requires technical expertise that most small business owners do not have in-house. Working with a Cyber Advisor or a Certification Body tends to produce better results and a more realistic understanding of your security posture.

Does Cyber Essentials guarantee we will not be hacked?

No scheme can guarantee that. Cyber Essentials ensures you have the five foundational controls in place, which reduces your exposure to the most common automated attacks. It is a necessary baseline, not a silver bullet.