Cyber Essentials explained: the checklist for UK SMEs

Cyber Essentials is the UK government-backed certification every SME should know about. Here's what it involves and why it matters to your clients.

By James Douglas | February 16, 2026

Shield and padlock representing cyber security controls

5 controls

You'll need to implement and evidence

90 %

Of attacks are stopped by the basics

3 months

Typical timescale to certification

Cyber Essentials is the UK government-backed certification that sets a baseline for cyber hygiene. More and more public sector tenders and supply chains now require it — and it’s genuinely effective.

What Cyber Essentials covers

The scheme is built around five technical controls:

Firewalls and internet gateways — the boundary that controls what gets in and out of your network.
Secure configuration — devices set up with security in mind, with defaults changed and unnecessary services disabled.
User access control — staff only have the access they need, admin rights are limited, and leavers lose access promptly.
Malware protection — antivirus and the policies that keep it updated and working.
Security update management — keeping software patched and up to date.

That’s it. No mountain of paperwork — the controls are practical and, for most businesses, largely in place already.

Why it matters

For many UK SMEs, the push comes from clients. A growing number of larger firms and public bodies now insist suppliers hold Cyber Essentials (or its higher tier, Cyber Essentials Plus) before they’ll do business.

There’s also a genuine security benefit. The NCSC estimates that around 90% of common cyber attacks are stopped simply by implementing these basics. Certification isn’t a box-ticking exercise — it’s a workable floor for your security.

How we help

Most of our clients reach certification without lifting a finger. As part of our managed services we:

Configure firewalls and routers to the standard
Manage patching and updates across your estate
Enforce secure configuration and access control
Document and evidence each control as we go

For the Plus level, which involves an independent technical audit, we prepare your environment in advance so the assessment goes smoothly.

Don’t wait for the tender

The businesses that get ahead are the ones who certified before a client asked for it. The process typically takes a few months, and it’s far less painful when someone else is running the controls day-to-day.

Want to know where you stand? Book a free IT audit and we’ll tell you how close you are to Cyber Essentials today.