Cyber Essentials for small businesses: what it costs and what you get

If you run a small business in the UK, you have probably been asked at some point whether you are "Cyber Essentials certified". It tends to come up in a tender, a supplier questionnaire or a conversation with an insurer. This post explains what the scheme is, what it costs, what you get for it, and how to decide whether it is worth your time this year.

What Cyber Essentials actually is

Cyber Essentials is a government-backed scheme developed by the National Cyber Security Centre (NCSC). The NCSC describes it as the minimum standard of cyber security it would advise every organisation to achieve, and says it is aimed at organisations of all sizes. It focuses on protecting you against the most common internet-based threats rather than every possible attack.

It covers five technical controls:

• Firewalls: filters between your devices and the internet.
• Secure configuration: setting up computers and software so they are not needlessly vulnerable.
• Security update management: keeping software patched so known weaknesses are closed.
• User access control: people only get access to the data and services they need.
• Malware protection: detecting and stopping malicious software.

None of this is exotic. It is the sort of housekeeping that most owners know they should do and few have written down or checked.

Why it matters for a small business

Small firms are not too small to be targeted. The NCSC's small organisations guide says that 1 in 2 small businesses suffer a cyber incident every year, and that many of its recommended steps can be completed in as little as 5 minutes.

The government's Cyber Security Breaches Survey 2025 gives a sense of the everyday threat. It found that 42% of small businesses (down from 49% in 2024) and 35% of micro businesses (down from 40%) had experienced phishing attacks. Phishing is the fake email or text that tricks someone into handing over a password or paying a bogus invoice. Good basic controls are part of how a business reduces its exposure to this kind of attack.

The same survey shows awareness is still low. Only 9% of micro businesses and 23% of small businesses said they were aware of Cyber Essentials. If a competitor in your sector is certified and you are not, that can matter when a customer is comparing suppliers.

Two levels: Cyber Essentials and Cyber Essentials Plus

Both levels assess the same five controls. The difference is how they are checked.

• Cyber Essentials is a verified self-assessment. You answer questions about your set-up, and an assessor reviews your answers.
• Cyber Essentials Plus adds hands-on technical testing, carried out by a certification body, to confirm the controls work in practice.

For most very small businesses, the basic level is the sensible starting point. Plus is worth considering if a customer or contract specifically asks for it, or if you want a higher level of assurance.

What it costs

According to the NCSC, standard Cyber Essentials starts at £320 plus VAT, with tiered pricing based on organisation size. Cyber Essentials Plus is quoted individually, depending on the size and complexity of your network. Because the Plus price varies, ask for a written quote and check what it includes before you commit.

If you choose the supported route and hire a consultant to guide you through the questions, that will cost extra. Whether it is worth it depends on how comfortable you are with the technical questions, and whether anyone in the business looks after IT.

The insurance benefit

One of the more practical perks is cyber liability insurance. The NCSC states that any UK organisation with a turnover under £20 million that achieves certification covering its whole organisation is automatically entitled to cyber liability insurance. That includes 24/7 incident response support with technical, legal and crisis management services.

The wording matters: the certification has to cover the whole organisation, not just one office or one team. If you are tempted to narrow the scope to make the assessment easier, you may lose this benefit. Read the policy terms that come with your certificate so you know exactly what is and is not covered.

How to get certified

There are two routes, according to the NCSC:

• Self-led: you register with IASME, the NCSC's delivery partner, pay the fee, complete the self-assessment, obtain board sign-off and submit it for assessor review.
• Supported: you hire a certification body licensed by IASME to help you understand the questions and how they apply to your business. IASME coordinates more than 400 cyber security organisations across the UK.

You can also check whether a supplier or customer is certified using the certificate search on IASME's website, which is useful when you are the one asking the questions.

Is it worth it? What people are saying

Commentary from IT providers and trade press is largely positive. The common view is that Cyber Essentials is one of the most cost-effective credentials a small firm can hold, because it involves no lengthy audit or dedicated security team. Writers also point out that public sector bodies and large companies increasingly expect certification from their suppliers, and that the benefit is smaller for a purely consumer-facing business with no supplier obligations. Treat that last point as a judgement call, not a rule, because many of these articles are written by firms that sell certification support.

The NCSC's own supply chain guidance says the scheme gives organisations a clear and efficient way to gain assurance about suppliers, and can reduce time spent on repetitive security questionnaires. For a small supplier, one certificate can replace a lot of form-filling.

What to do this week

• Ask who is asking. Check whether any customer, tender or insurer has asked for certification, or is likely to.
• List your devices and accounts. Laptops, phones, cloud services and the people who use them. You cannot protect what you have not counted.
• Check your updates. Make sure operating systems, browsers and business apps are set to update automatically.
• Review who has access. Remove accounts for people who have left, and give staff only what they need.
• Read the NCSC small organisations guide. It takes minutes and covers backups, device protection and spotting scams.
• Get the current fee. Look at the NCSC and IASME pages for up-to-date prices and the latest requirements before you budget.

Where we can help

Certification is only as good as the systems underneath it. If your website, apps or cloud set-up need tidying before you apply, our team can help with cloud and security work for small businesses.

The bottom line: Cyber Essentials is a modest cost, backed by the government, that gives you a checklist of sensible habits, a certificate you can show customers and, in many cases, insurance. It will not make you immune to attack, but it is a clear, achievable way to get the basics right.