Cyber Essentials: Where to Start

Cyber Essentials is often the first formal cyber security certification a UK organisation pursues. It gives customers, partners, insurers, and procurement teams a clear signal that your business has implemented essential controls against common cyber attacks.

NeedSec helps organisations prepare for Cyber Essentials and Cyber Essentials Plus by turning the requirements into plain English, identifying gaps early, and supporting teams through assessment and remediation.

What Is Cyber Essentials?

Cyber Essentials is a UK government-backed certification scheme focused on practical cyber hygiene. It is designed to reduce exposure to common threats such as phishing, malware, weak access controls, unpatched software, and unauthorised access.

The scheme is aligned to guidance from the National Cyber Security Centre (NCSC), the UK technical authority for cyber security. For many organisations, Cyber Essentials is the baseline security standard expected before working with public sector buyers, regulated clients, or customers handling sensitive data.

You can read more about our certification support on the NeedSec Cyber Essentials service page.

Cyber Essentials vs Cyber Essentials Plus

There are two levels of certification.

1. Cyber Essentials

Cyber Essentials is a verified self-assessment. Your organisation answers a structured questionnaire about your IT environment, security controls, devices, cloud services, users, and policies. A qualified assessor reviews the submission and confirms whether the answers meet the scheme requirements.

This is a strong starting point for small and medium-sized organisations that need credible, affordable cyber assurance.

2. Cyber Essentials Plus

Cyber Essentials Plus starts with the same self-assessment, then adds a hands-on technical audit. Testing is performed against a sample of systems and devices to confirm that the controls are implemented in practice.

Cyber Essentials Plus is useful when customers, tenders, regulators, or internal risk teams need a higher level of assurance. NeedSec also supports Cyber Essentials Plus preparation and assessment.

What Is the Verified Self-Assessment?

The self-assessment is the core of Cyber Essentials. A nominated person from your organisation logs into a secure assessment portal and answers questions about your systems and controls.

Before submission, a director or equivalent senior representative must confirm that the answers are accurate. An assessor then reviews the submission and issues one of three outcomes:

Pass
More information required
Fail, with feedback and an opportunity to fix issues

The assessment is not meant to be mysterious. The difficult part is usually understanding scope, knowing which devices and cloud services are included, and making sure your answers match how the organisation actually operates.

The Five Technical Controls

Cyber Essentials is built around five technical controls:

Firewalls: protecting internet connections and devices from unauthorised access.
Secure configuration: removing insecure defaults and unnecessary services.
Security update management: keeping operating systems, applications, and firmware patched.
User access control: limiting access rights and using appropriate administrator controls.
Malware protection: preventing and detecting malicious software on devices.

Every assessment question maps back to these controls. If you understand the five controls, the questionnaire becomes much easier to approach.

How Long Does Cyber Essentials Take?

For a well-prepared organisation, completing the self-assessment can take one to two hours. Preparation may take longer if you need to confirm asset lists, review user permissions, update unsupported software, or document how cloud services are managed.

Typical milestones are:

Register for certification.
Receive access to the assessment portal.
Complete and save the questionnaire.
Ask a director or equivalent to approve the declaration.
Submit the assessment for review.
Respond to assessor queries if more detail is needed.
Receive the certificate and digital badge after passing.

Certification is valid for 12 months, so renewal should be planned before the certificate expires.

What Should You Prepare First?

Before starting the questionnaire, gather the basics:

A list of laptops, desktops, mobile devices, servers, and network equipment.
Details of cloud services used by the organisation.
Your patching process and update timescales.
How administrator accounts are controlled.
Password and multi-factor authentication settings.
Malware protection arrangements.
Any bring-your-own-device or remote working policies.

This preparation reduces the risk of delays, unclear answers, and failed submissions.

Common Issues That Delay Certification

Organisations often get stuck because of practical gaps rather than complex security problems. Common examples include unsupported operating systems, missing multi-factor authentication, shared administrator accounts, unmanaged personal devices, unclear asset scope, and software updates that are not applied quickly enough.

NeedSec can review your readiness before submission, explain the requirements in plain English, and help prioritise fixes that matter for certification.

How Much Does Cyber Essentials Cost?

Cyber Essentials certification pricing is based on organisation size. The standard assessment bands are:

Organisation size	Assessment fee
0-9 employees	GBP 320 + VAT
10-49 employees	GBP 440 + VAT
50-249 employees	GBP 500 + VAT
250+ employees	GBP 600 + VAT

Additional costs only apply if you choose extra support or need to upgrade systems, software, or security controls to meet the requirements.

Is Cyber Insurance Included?

Some UK organisations may qualify for included cyber liability insurance when certifying to Cyber Essentials, subject to eligibility criteria such as turnover and scope. This should be treated as an additional benefit rather than the main reason to certify.

The stronger reason is practical assurance: Cyber Essentials helps prove that the organisation has handled the basics properly.

Start With NeedSec

If you are ready to begin, NeedSec can help with assessment preparation, gap reviews, Cyber Essentials certification support, and Cyber Essentials Plus testing.

Start here:

Getting Cyber Essentials right is not about ticking boxes. It is about building a baseline that customers can trust and your team can maintain.

Cyber Essentials: Where to Start