Cyber Essentials for business — Is it enough for your company?
Your email gets spoofed. Someone clicks a link. A contractor’s weak password opens a door. These are standard, expensive interruptions for many UK firms with 10–200 staff.
Too often I see decision-makers treat Cyber Essentials like a tick-box badge: get the certificate, hang it on the website, and call it done. That approach keeps you vulnerable to the same basic attacks that cause downtime, invoice fraud and lost customer trust. Use the four criteria below to judge whether Cyber Essentials meaningfully reduces risk, or is just a sticker.
1. Which risks does it actually reduce?
Criterion first: be precise about the threat picture you care about. Cyber Essentials is deliberately narrow. It targets common, low-complexity threats — things like unpatched software, weak credentials, basic misconfiguration and missing antivirus. If your top worries are credential theft, simple ransomware or basic phishing, Cyber Essentials can cut the chance of a successful attack.
It will not, on its own, stop a targeted breach from a determined attacker, nor will it replace a tailored incident response plan. Think of it as clearing the floor: it removes the easy footholds that let many attacks spread. If your firm stores unusually sensitive personal data or manages critical infrastructure, you should expect additional controls beyond Cyber Essentials.
2. How credible is the certification?
Certification matters, but credibility varies. Cyber Essentials has an official UK scheme with recognised assessors. The value you get depends on who conducts the assessment and how strictly they check controls. A sloppy self-assessment or a perfunctory test by an assessor won’t catch hidden gaps.
Ask for details: what evidence did the assessor review, which systems were tested, and were multi-site operations sampled? Also check whether the certificate meets the expectations of your customers or insurers — some suppliers or tenders specifically request a Cyber Essentials Plus certificate rather than the basic level.
3. How much time, cost and internal effort will it take?
Decision-makers want a clear cost–benefit picture. Cyber Essentials can be relatively inexpensive and quick if your environment is already tidy, but costs rise when discovery identifies unsupported systems, undocumented services, or numerous user accounts with elevated privileges.
Budget for three things: the assessor fee, internal time to prepare (inventory, patching, configuration changes), and follow-up work where you find gaps. Expect at least a few days of concentrated IT effort in a straightforward setup, and several weeks if you need to replace legacy kit or tighten account management. Factor in the recurring cost of re-assessment and the labour to keep controls current.
4. What happens at assessment and during ongoing maintenance?
Understanding the assessment process avoids surprises. Basic Cyber Essentials is a questionnaire-style assessment; Cyber Essentials Plus adds technical verification. That means Plus will include on-site or remote testing of endpoints and network configuration. Know in advance whether your chosen route required by customers is Plus or standard.
After certification, controls drift. Patches are delayed, contractors add unmanaged devices, staff reuse passwords. A certificate without processes is a fast-expiring confidence trick. Your maintenance plan should cover routine patching, a single sign-on or password policy, asset inventory updates, and an incident response checklist that staff can follow if something goes wrong.
Putting these criteria together when comparing options
When you compare doing Cyber Essentials in-house, using a reseller or hiring an external adviser, score each option against the four criteria above:
- Coverage: Does the option address the specific risks that keep you awake? If your main problem is basic credential misuse, a minimal route may suffice; if not, choose a fuller approach.
- Credibility: Who conducts the assessment and how thorough is their evidence gathering? Prefer assessors who show sample reports and explain their test coverage.
- Cost and effort: Ask for a clear quote that separates assessor fees from preparatory work. Insist on a short discovery engagement so you can see where time will be spent.
- Assessment and maintenance process: Confirm whether the service includes a follow-up plan to keep controls effective after certification.
Use a simple scoring system: give each option a 1–5 on each criterion, then total the scores. That arithmetic cuts through sales language and highlights where a cheap certificate will cost you more later in remediation or reputational damage.
One practical note on procurement: when a tender or customer asks for Cyber Essentials, read the requirement carefully. Some request Cyber Essentials Plus, others accept the basic level. Match the certification level to the contractual requirement — not just what looks cheapest.
If you want a quick next step, start with a short discovery: a two-hour walkthrough with the person who manages your systems and a list of your internet-facing assets. That session usually uncovers the three to five items that will determine whether Cyber Essentials is a fast win or a longer project.
For help mapping your current posture to the Cyber Essentials criteria and getting a realistic quote, see our more on Cyber Essentials certification. At the end of one short engagement you’ll have clearer costs, a timeline, and the confidence that certification will actually reduce your risk and reassure customers.
Pick the option that buys you fewer service disruptions, lower remediation bills and more credibility with customers — not just the cheapest badge. If you want, start with the discovery meeting above; it typically saves time and money compared with a rushed assessment that finds unexpected issues mid-process.
