Cyber Essentials is the UK government-backed certification that proves your business has the baseline technical controls in place to defend against the most common cyber attacks. For many UK organisations — especially those bidding for public sector contracts — it's no longer optional.
What Is Cyber Essentials?
Cyber Essentials is a self-assessment certification administered by IASME on behalf of the National Cyber Security Centre (NCSC). It covers five technical control areas that protect against around 80% of common internet-based attacks.
The Five Technical Controls
- • Firewalls — boundary firewalls and software firewalls on every internet-connected device
- • Secure configuration — devices and software set up to reduce vulnerabilities (no default passwords, unused services disabled)
- • User access control — least-privilege accounts, separate admin accounts, MFA on cloud services
- • Malware protection — anti-malware on every device, sandboxing, or application allow-listing
- • Security update management — all software patched within 14 days of a high or critical update being released
Cyber Essentials vs Cyber Essentials Plus
The standard Cyber Essentials is a self-assessment questionnaire reviewed by a certifying body. Cyber Essentials Plus adds a hands-on technical audit by an assessor — they'll scan a sample of your devices, test email and web filtering, and verify your patching. Plus is the version most enterprise and public sector buyers look for.
How Much Does It Cost?
As of 2026, Cyber Essentials self-assessment ranges from £320 to £600 + VAT depending on company size. Cyber Essentials Plus typically adds another £1,500 to £5,000 + VAT in audit fees, plus any remediation work needed to pass.
How to Pass First Time
- • Define your scope carefully — exclude legacy systems you can't bring up to standard, or fix them first
- • Enforce MFA on Microsoft 365, Google Workspace, and any other cloud service
- • Confirm every device runs a supported OS (Windows 11, current macOS, supported Linux, current iOS/Android)
- • Deploy a managed EDR product across every endpoint, including BYOD if in scope
- • Document your patching policy — and prove updates land within 14 days
- • Remove local admin rights from standard user accounts
How Long Does It Take?
A well-prepared SMB can complete Cyber Essentials in 2-4 weeks. Cyber Essentials Plus typically takes 4-8 weeks including remediation. The certificate is valid for 12 months and must be renewed annually.
CLD Computers prepares UK businesses for both Cyber Essentials and Cyber Essentials Plus — handling scoping, technical remediation, MFA rollout, EDR deployment, and supporting you through the audit. Contact us for a free readiness assessment.
Related Service
Cybersecurity Services
Need Help with Your IT?
Book a free consultation and find out how CLD Computers can support your business.
Related Articles
Want to talk about this?
Book a free 30-minute consultation and we'll walk through it for your setup.
Book a free consultation