Cyber Essentials for UK business, practical guide.

Cyber Essentials is a UK government-backed cybersecurity certification scheme administered by IASME on behalf of the National Cyber Security Centre (NCSC). It demonstrates that a business has implemented basic cybersecurity controls across five technical areas: firewalls, secure configuration, user access control, malware protection, and security update management. It's commonly required by UK government contracts and increasingly expected by enterprise customers. Two levels exist: Cyber Essentials (self-assessment, ~£300-600 typical cost) and Cyber Essentials Plus (independently audited, ~£1,500-3,500+ typical cost depending on business size).

We don't issue Cyber Essentials certifications directly — that's done by IASME-accredited certification bodies (a separate specialism with specific assessor qualifications). What we do provide is the underlying connectivity, network, firewall and managed-IT services that help our customers achieve and maintain certification. Most UK SMEs failing Cyber Essentials on first attempt fail on items 1 (firewall/router) and 2 (secure configuration) — both of which are direct outcomes of how the network is set up. We can fix that side; the actual certification application then goes through an accredited body.

1. Firewalls — every internet-connected device protected by a firewall, with passwords changed from default, unnecessary services disabled. 2. Secure configuration — devices and software configured securely, unused accounts removed, default settings changed. 3. User access control — administrative privileges only granted to those who need them, separate user accounts for admin tasks. 4. Malware protection — antivirus on all devices, kept updated, scans regular. 5. Security update management — software and operating systems patched within 14 days of patches being released.

Three of the five are directly affected by network setup. (1) Firewalls: our managed business broadband includes business-grade routers with proper firewall configuration — default credentials changed, unnecessary services disabled, port-blocking by default. This addresses control 1 out of the box. (2) Secure configuration: our network setups use VLAN segmentation (separating guest, EPOS, IoT, corporate traffic), proper SSID security on WiFi, and managed switch configurations — which directly addresses control 2. (3) For multi-site or larger operations, our managed networking includes centralised management, monitoring, and consistent configuration — which makes ongoing compliance auditing significantly easier. Controls 3, 4, 5 (user access, malware, patching) are typically endpoint/IT-management functions outside our core scope, though we can refer to specialist IT partners.

Costs vary by certification body but typical 2026 UK rates: Cyber Essentials (self-assessment): £300-600 application fee depending on business size, plus internal staff time to complete the assessment (typically 4-12 hours). Cyber Essentials Plus (audited): £1,500-3,500+ depending on business size and complexity, including the assessor visit and testing. Re-certification is required annually. Total first-year cost for a typical UK SME aiming at Cyber Essentials Plus: typically £2,000-4,000 all-in. Many businesses can offset some of this through cyber insurance discounts and government contract eligibility.

Mandatory in some cases, recommended in others. (1) UK government contracts — Cyber Essentials is a mandatory minimum for many government-tier procurements. If you bid for public-sector work, you typically need it. (2) Enterprise B2B contracts — many large UK enterprises now require Cyber Essentials of their suppliers, particularly for technology/services contracts. (3) Cyber insurance — many insurers offer significant premium discounts for Cyber Essentials-certified businesses. (4) Regulated sectors (healthcare, financial services) — often expected alongside other compliance frameworks. (5) General SME without these specific drivers — it's still a useful baseline of cybersecurity hygiene, but not strictly necessary. Honest answer: assess your specific business context before pursuing certification.

Concretely: business-grade managed routers with default passwords changed, unnecessary services disabled, firewall properly configured. VLAN segmentation for WiFi (guest WiFi never sees corporate traffic). Managed switches with documented configurations. WiFi 6 access points with WPA3 security and proper SSID setup. Monitoring and logging that supports audit trails. Documentation of network configuration for the assessor to review. For Cyber Essentials Plus, the assessor will test things like 'do you have a properly configured business firewall' — we can demonstrate this directly. We work with IASME-accredited assessors as partners and can refer you to one for the formal certification process.