What Is Cyber Essentials? Definition, Benefits & Costs

21.03.2025

Updated 08.10.2026

There are several reasons that a Cyber Essentials accreditation might be on your radar. Maybe a tender asked for it, or an insurer mentioned it as a requirement? Or maybe a client is asking questions about your credentials.

Whatever the reason, understanding Cyber Essentials is worthwhile for any SME decision-maker. This UK government-backed scheme certifies that a business has basic technical controls in place to stop the most common cyber attacks - so it’s a way to demonstrate your compliance and expertise, and also to win real peace of mind for your business.

In this guide we’ll help you to understand Cyber Essentials, as well as exploring its commercial and security upsides for businesses - SMEs in particular. Here’s what we’ll cover:

  • What Cyber Essentials and Cyber Essentials Plus actually are
  • The Five Controls at a glance
  • Is Cyber Essentials worth it for a business your size?
  • What Cyber Essentials does and doesn’t cover
  • Getting certified - DIY vs the managed route
  • The bottom line

FREE Cyber Security Assessment   Take our 2-Minute Cyber Security Assessment to uncover hidden risks.   Custom report. Instant results. No jargon.  

What Cyber Essentials and Cyber Essentials Plus Actually Are

Cyber Essentials is an independently verified self-assessment certification aimed at helping businesses protect themselves from the most common cybersecurity threats.

It is a scheme launched by the UK government and the National Cyber Security Centre (NCSC) to promote good cyber security practices among organisations.

Cyber Essentials is a self-assessed baseline, administered by IASME - a cyber security certification company. Your organisation completes a questionnaire to confirm the five controls are in place, which is then verified by a certification body.

Cyber Essentials Plus covers the same five controls, but is independently tested by an assessor rather than being self-declared. There is a hands-on technical audit that ensures the controls are in place and correctly configured.

The Five Controls At A Glance

At the heart of Cyber Essentials are five controls, designed to prevent the most common internet based cyber security threats. They are:

  • Firewalls and internet gateways
  • Secure configuration
  • Security update management
  • User access control
  • Malware protection

We explore all in more detail in our Cyber Essentials checklist and requirements post.

Is Cyber Essentials Worth it for an SME?

Being Cyber Essentials accredited delivers a suite of benefits for businesses with 20-100 employees. If you’re a decision-maker at an SME evaluating whether or not to pursue Cyber Essentials, here are some things to consider:

It Wins and Protects Work

Cyber Essentials is increasingly required for public-security tenders and specified in private supply chains. Not having the accreditation can prevent you from bidding completely, and lower your chances of winning bids where the requirement is not a barrier to bidding.

It Affects Your Cyber Insurance

Being Cyber Essentials accredited is now expected for some cyber insurance policies, and factors into eligibility and premium cost on policies where it is not formally required. Gaining the accreditation opens up more cyber insurance options and will likely mean lower premiums.

It Builds Client Trust

In a market where most SMEs struggle to evidence their security, Cyber Essentials is an independent, government-backed, widely recognised accreditation. Having it demonstrates the security of your SME, but also your organisational commitment to security - itself an important trust factor.

The Cost and Effort

Cyber Essentials IASME Certification uses a tiered pricing structure based on the number of employees in an organisation, following the UK government’s size criteria:

  • Micro (0–9 employees): £320 + VAT
  • Small (10–49 employees): £440 + VAT
  • Medium (50–249 employees): £500 + VAT
  • Large (250+ employees): £600 + VAT

Prices start at £320 + VAT for a micro-organisation and rise up to £600 + VAT for larger organisations, reflecting the increased complexity in assessing bigger businesses.

Third party assistance to interpret requirements and make changes: typically £500 - £2000

This represents a modest outlay for most SMEs, especially where a provider already manages your environment. For many SMEs, the first tender unlocked by having Cyber Essentials, or the first breach it helps to avoid, cover the initial investment many times over.

What Cyber Essentials Does and Doesn’t Cover

Cyber Essentials should be thought of as a security floor, rather than a ceiling. It provides a point-in-time certificate demonstrating that a business has sufficient protection against high-volume, opportunistic, automated attacks - the majority of what an SME is likely to face.

It’s not designed to protect against targeted, sophisticated attacks, or most social engineering attacks. Protection against these requires managed, maintained security covering areas like managed antivirus, managed firewall, dark web monitoring, anti-phishing detection, enhanced password protection, and similar.

To find out about your organisation’s current security posture, book a free consultation today.

Getting Certified - DIY vs the Managed Route

There are two routes to certification:

  • The DIY route is cheaper on paper, but requires you to fix the gaps that you surface, with Cyber Essentials Plus testing failing if the controls aren’t genuinely in place. If you’re planning this route, read our checklist for self-assessment.
  • With the managed route a partner assesses your current position, closes the gaps, certifies you, and keeps the controls in place for annual renewal to ensure ongoing compliance.

The Bottom Line on Cyber Essentials for SMEs

Cyber Essentials is worth it for most SMEs, but it helps to be clear about exactly what you're buying. The accreditation has several tangible benefits:

  • It covers the fundamentals that stop the large majority of cyber attacks
  • It costs relatively little against the income it can unlock
  • It gives something concrete to show clients and insurers

What Cyber Essentials isn't, is a finish line. Rather, it's a foundation that a properly managed, continuously maintained security setup is built on - not a substitute for one.

Understood that way, the accreditation is one of the most cost-effective moves a smaller business can make. If you'd like a breakdown of where you stand against the standard and the quickest route to certification, book a free consultation today. And if you want the detail behind any of this, check out our guides on the five controls, Cyber Essentials Plus and how it compares to ISO 27001.

 

FREE EBOOK The Essential Guide to Small Business IT Support Get your copy now to find out how your small business could benefit from top-class IT support.  

Want to dive deeper into Cyber Essentials and other cyber security certifications? Explore our related articles for everything you need to know: