Cyber Essentials in plain English

Cyber Essentials is a UK government-backed scheme that helps organisations protect themselves against the most common internet attacks. It was developed with the National Cyber Security Centre (NCSC) and is delivered through licensed certification bodies.

What it covers

Cyber Essentials focuses on five basic technical controls:

• Firewalls: protecting your network and devices from the internet.
• Secure configuration: removing unneeded software and changing default settings and passwords.
• User access control: only giving people the accounts and permissions they need.
• Malware protection: using anti-malware software or other safeguards.
• Security update management: keeping devices and software up to date.

Two levels

• Cyber Essentials: you complete a self-assessment questionnaire, which is checked by a certification body.
• Cyber Essentials Plus: includes the same basics plus a hands-on technical check of your systems.

Why bother

• It reduces the risk of common attacks.
• Some customers, public sector contracts and insurers ask for it.
• It gives you a sensible checklist to follow even if you do not certify.

How to start

1. Check the NCSC website for the current requirements and find an accredited certification body.
2. List your devices, accounts and cloud services, since the scheme covers all of these.
3. Fix gaps: updates, admin rights, two-step sign-in, backups, and firewalls.
4. Complete the questionnaire honestly and keep copies of your evidence.
5. Renew every year.

Prices and details change, so check the current information with the NCSC or the certification body, who can give you a quote.

When to get more help

Ask for help if the questions are confusing, if you cannot tell whether a device or cloud service is in scope, or if you want to get the technical side ready before you apply. We can help you prepare, though the certificate itself is issued by a certification body.