Cyber Essentials: why UK businesses treat it as a must-have

The five controls

• Firewalls and internet gateways, configured deliberately rather than by default
• Secure configuration: default credentials removed, unnecessary services disabled
• User access control: least privilege, separate admin accounts, prompt leaver removal
• Malware protection on every in-scope device
• Security update management: critical patches applied within 14 days

What certification actually proves

That the basics are in place across the whole in-scope estate on the day of assessment. That is a genuinely useful claim, because most attacks are opportunistic and stopped by exactly these controls. It does not prove you would survive a targeted intrusion.

Base level or Plus

The base certification is a verified self-assessment. Cyber Essentials Plus adds independent technical testing of a sample of devices and is what larger buyers and several insurers increasingly ask for. Certify to base level first if the estate has not been audited recently.

Where organisations fail

• Unsupported operating systems and firmware still in scope
• Patching that happens monthly rather than within 14 days for critical fixes
• Local administrator rights handed out as standard
• Home and BYOD devices used for work but never counted in scope
• Cloud services assumed to be out of scope when they are not

How long it takes

A tidy 25-person estate can certify in four to six weeks. Anywhere with unsupported kit, mixed device ownership or no inventory should plan for three months, because remediation is the work and the questionnaire is the easy part.

Keeping it after year one

Certification lasts twelve months. Build patch reporting, joiner-mover-leaver discipline and an asset inventory into business as usual, and renewal becomes an afternoon rather than a project.