What is Cyber Essentials? A Plain-English Guide for Business Owners

Introduction

Ever been asked about Cyber Essentials and felt like someone was speaking in code? 

You’re definitely not alone. This government scheme has been popping up everywhere, from tender processes and supplier meetings to that one email you’ve been avoiding because it says cybersecurity on it. 

But here’s the thing: it’s actually not nearly as scary or complicated as it sounds.

So, what is Cyber Essentials? Let’s find out.

The Great Cybersecurity Reality Check

Picture this: every time there’s a major data breach in the news, it gets described as the work of “elite hackers” using “sophisticated techniques.” 

Sounds terrifying, right? Like cyber ninjas scaling digital walls with their advanced hacking katanas.

But here’s the dirty little secret the cybersecurity industry doesn’t shout about: most successful attacks are embarrassingly simple. 

We’re talking about the digital equivalent of someone walking through your front door because you left it wide open, not because they picked some high-tech lock.

Remember those Nigerian prince emails that flooded everyone’s inbox a decade ago? 

They barely work anymore because we all got wise to them (okay, some people still fall for them, but that’s natural selection at this point). The scammers had to up their game. 

That’s exactly what Cyber Essentials is trying to do for businesses: make the basic attacks so pointless that the bad guys have to work much harder for their money (or, more likely, move on to another target).

What is Cyber Essentials?

Don’t let the official-sounding name fool you. Cyber Essentials is basically asking you five straightforward questions that any business owner should be able to answer:

1. What stuff do you actually have? (Computers, phones, that printer from 2015 that somehow still works)
2. Is your stuff up to date? (You know, those annoying update notifications you keep postponing). Check out our article on the importance of keeping operation systems updated.
3. Who can access what? (Does Dave from accounts really need admin rights to everything?)
4. Are things set up sensibly? (Default passwords are not your friend)
5. Do you have basic protection? (Antivirus isn’t just for your nan’s laptop)

If you can tick these boxes without breaking into a cold sweat, you’re probably closer to Cyber Essentials than you think.

Once you’ve got your Cyber Essentials certification, it’s valid for 12 months, meaning it needs renewing annually. 

Cyber Essentials vs. Cyber Essentials Plus: What’s the Difference?

Here’s where it gets interesting (if you like cybersecurity, like us). Cyber Essentials comes in two flavours: regular and extra crispy.

Cyber Essentials (The Trust Fall Version)

This is the “I trust you, mate” approach. You fill out a questionnaire online, basically promising that you do all the right things. 

An assessor reads your answers and, assuming you haven’t written something like “password security is for weaklings,” they give you a shiny certificate.

Cost? A few hundred quid (£300+VAT to be precise for companies with 1-9 employees). Time? A few hours if you’re prepared. 

It’s like the honour system, but with official paperwork.

Cyber Essentials Plus (The “Prove It” Version)

This is where someone actually rocks up (digitally speaking) and says, “Show me.” They’ll poke around your systems, run vulnerability scans, and generally verify that you weren’t just making things up on the questionnaire.

Cost? Anywhere from £900 to £6,000, depending on who you ask and how complicated your setup is. It’s like the difference between saying you can cook and actually having Gordon Ramsay taste your food.

Additionally, you must have completed Cyber Essentials before proceeding with Cyber Essentials Plus, which must be completed within 90 days of completing the former.

Need help preparing for you Cyber Essentials Plus audit? Well, you’re in luck, cause we have an article on that.

Do You Actually Need Cyber Essentials Certification?

The million-pound question. Here’s the honest answer: Cyber Essentials, yes; Cyber Essentials Plus, maybe.

You Definitely Need It If:

• Government contracts are in your future (they’re not messing around with this stuff)
• Your biggest client just sent you a very polite but firm email mentioning “compliance requirements”
• You’ve been putting it off so long that everyone else in your sector has it

If you happen to run a law firm, we have a GDPR compliance checklist that you’re going to love!

You Probably Want It If:

• You like having official certificates to wave at potential clients
• You want someone else to double-check your cybersecurity homework
• You’re genuinely not sure if your security setup would survive scrutiny
• You enjoy the peace of mind that comes with ticking compliance boxes

Here’s Why You Should At Least Get Cyber Essentials

Here’s the thing: even if nobody’s explicitly asking for it yet, Cyber Essentials is just good business sense. 

It’s like having a tidy office or answering your emails promptly. Nobody might demand it, but it shows you’ve got your act together.

Your employees feel more confident working somewhere that takes security seriously. Your customers get that warm fuzzy feeling knowing their data isn’t being stored on a Post-it note. And investors? They love seeing businesses that think ahead rather than scramble to catch up when requirements suddenly appear.

Busting the Myths (Because There Are Always Myths)

Myth 1: “This makes us unhackable!” Ha. No. This is like saying you’ve locked your front door, so your house is now Fort Knox. Cyber Essentials covers the basics (very important basics, but still just the basics). You wouldn’t cancel your home insurance just because you lock up at night.

Myth 2: “It’s impossibly complicated for small businesses.” The whole point was to make it accessible for small businesses. The government didn’t create this to torture sole traders and SMEs. If it feels overwhelming, you’re probably overthinking it.

Myth 3: “We need expensive consultants to do this.” For standard Cyber Essentials? Probably not. It’s designed to be DIY-friendly. If someone’s quoting you thousands just to fill out the basic questionnaire, they’re either doing a lot more than Cyber Essentials or they’re trying to pull the wool over your eyes and get you paying far more than you should be.

Your Action Plan (The Non-Boring Bit)

Ready to tackle this? Here’s your step-by-step guide to Cyber Essentials glory:

Step 1: The Reality Check. Can you list all your computers, phones, and software? Do you know if they’re up to date? If you’re nodding confidently, you’re already winning.

Step 2: Pick Your Adventure. Standard version unless someone specifically demands the Plus version. Start simple, upgrade later if needed. And remember, if you go for the Plus, it must be completed within 90 days of the basic certification. 

Step 3: Channel Your Inner Control Freak. This is one of the rare occasions where being pedantic about documentation actually pays off. Embrace it.

Step 4: Remember it’s Annual. Like car insurance or that gym membership you “use”, this needs renewing every year. Put it in your calendar now.

Step 5: Don’t Stop Here. Think of this as your cybersecurity learner’s permit, not your PhD. There’s more to explore once you’ve mastered the basics. How about developing an effective cybersecurity policy to back up your Cyber Essentials? Or, since you’ve already done one vulnerability scan (if you do Cyber Essentials Plus), why not do them regularly? The benefits of conducting regular vulnerability scans are massive! 

The Real Talk Section

Look, cybersecurity doesn’t have to be the business equivalent of eating vegetables: necessary but joyless. Cyber Essentials is actually one of the more sensible things to come out of government IT policy in recent years.

It’s not trying to turn you into a cybersecurity expert overnight. It’s not demanding you understand blockchain or artificial intelligence or whatever the latest buzzword is. It’s just asking you to get the fundamentals right, which, let’s be honest, is something every business should be doing anyway.

The best part? Once you’ve got it, you get to put it on your website, mention it in proposals, and generally use it as proof that you take this stuff seriously. In a world where “we take cybersecurity very seriously” has become the corporate equivalent of “thoughts and prayers,” having actual certification is refreshingly concrete.

The Bottom Line (Finally!)

Cyber Essentials isn’t going to solve all your security problems, but it’s a pretty decent starting point. 

Think of it as cybersecurity training wheels: not particularly glamorous, but they’ll stop you from falling off your bike while you’re learning to ride.

The question isn’t really whether it’s worth doing (it is), but rather when you’re going to stop putting it off. Because let’s face it, if you’ve read this far, you’re probably going to end up doing it eventually anyway.

So why not make it this month’s project? Future you will thank present you for getting it sorted, and you’ll have one less compliance headache to worry about. Plus, you’ll finally have an answer for those awkward questions about your cybersecurity posture.

And who knows? You might even enjoy the process. Stranger things have happened.

If you’re looking for more ways to protect your business, check out our article on protecting your business from ransomware.