Do I need Cyber Essentials?

The short answer

For most businesses, Cyber Essentials isn’t a legal requirement. But you’re likely to need it if you bid for certain public sector contracts, or if a customer asks for it as part of their supplier checks. And even if nobody asks, its five controls are a sensible baseline for any small business.

What is Cyber Essentials?

Cyber Essentials is a UK Government-backed certification scheme. It was developed by the National Cyber Security Centre (NCSC), which describes it as the minimum standard of cyber security recommended by the Government for organisations of all sizes. The scheme is run by IASME, the NCSC’s official Cyber Essentials Delivery Partner, and certification is renewed every year.

It focuses on five technical controls that protect against the most common internet-based attacks:

• Firewalls – a security barrier between the internet and your network.
• Secure configuration – computers and devices set up to reduce the ways in.
• Security update management – keeping software and devices patched.
• User access control – controlling who can access your data and services, and at what level.
• Malware protection – stopping viruses and other malicious software before they cause harm.

Cyber Essentials or Cyber Essentials Plus?

Both levels check the same five controls. The difference is how they’re checked.

Cyber Essentials Plus gives customers more assurance, because someone independent has checked the controls are working in practice.

Who needs it?

Some government and NHS contracts

Under the Government’s Procurement Policy Note 014, central government departments, their agencies and non-departmental public bodies, and NHS bodies must ask suppliers to show Cyber Essentials or Cyber Essentials Plus (or equivalent controls) before awarding certain higher-risk contracts. These include contracts where the supplier handles citizens’ personal information such as addresses or bank details, handles government staff’s personal information, supplies ICT systems that store or process OFFICIAL information, or deals with information about the day-to-day business of government. Certification must then be renewed every year for the life of the contract.

It isn’t required for every public contract – the note specifically says buyers shouldn’t take a blanket approach – and other public bodies can choose to follow the same approach. Always check the tender documents.

Customers and supply chains

The NCSC notes that a growing number of organisations require their suppliers to be certified before they can bid for work. If you supply larger businesses, you may find it in their supplier questionnaires.

Everyone else

Even if nobody is asking, the five controls protect against the most common attacks, and certification shows customers you take security seriously. The NCSC also notes that UK organisations with a turnover under £20m that certify their whole organisation are entitled to cyber liability insurance arranged by IASME – check the current terms on the IASME website.

How does certification work?

1. Prepare. Read the question set and requirements, and close any gaps.
2. Buy the assessment. IASME prices Cyber Essentials by organisation size and publishes current fees on its website; Cyber Essentials Plus is quoted by a certification body based on the size and complexity of your network.
3. Complete it. You have up to six months to finish the online assessment, and a senior person must confirm your answers are accurate.
4. Get reviewed. An assessor from a certification body reviews your answers – IASME says within three working days – and you can update and resubmit if they need more information.
5. Get certified. Once you meet the requirements your certificate is issued, valid for 12 months.

Free help from the NCSC and IASME

The NCSC’s Cyber Essentials pages link to free resources, including a preview of the question set, a Readiness Tool that gives you a tailored action plan, IASME’s Knowledge Hub and, for eligible small and medium-sized businesses, a free 30-minute consultation with an NCSC-assured Cyber Advisor.

How MicroConnect can help

We’re not a certification body or assessor. Our job is to get you ready and make the process straightforward:

• check your devices, accounts, Microsoft 365 and network against the five controls
• fix the gaps – updates, multi-factor authentication and admin access, firewall settings and malware protection
• help you understand the questions and prepare your answers
• support you through the assessment with an IASME-licensed certification body
• keep your systems in line with the requirements, so renewal is easier next year

Sources

• NCSC – Cyber Essentials overview
• IASME – Cyber Essentials
• GOV.UK – PPN 014: Cyber Essentials scheme

This guide is general information, not legal or procurement advice. Scheme details can change, so check the NCSC and IASME websites for the latest requirements.