A Cyber Essentials certification guide should do more than tell you which boxes to tick. For a small business, the real value is knowing that the laptops, email accounts, cloud systems and mobile phones your team relies on are being managed safely – and being able to show customers, suppliers and insurers that you take cyber security seriously.

Cyber Essentials is a UK Government-backed scheme designed to help organisations guard against the most common internet-based attacks. It is not a replacement for sensible IT support, staff awareness or good backups. It is, however, a practical baseline that turns security into a clear set of actions.

For businesses in Sussex bidding for public sector work, working with larger organisations, or handling customer data, certification can be a commercial requirement as well as a security decision. It can also expose everyday weaknesses that are easy to overlook when everyone is busy keeping the business moving.

What Cyber Essentials certification covers

Cyber Essentials focuses on five technical controls. These are the areas that stop a large proportion of opportunistic attacks, such as criminals exploiting an unpatched device, guessing a weak password or taking advantage of a poorly configured cloud account.

• Firewalls and internet gateways control what is allowed to connect to and from your network.
• Secure configuration means devices, software and accounts are set up safely rather than left with unnecessary features, default passwords or excessive permissions.
• Access control limits system access to the people who genuinely need it, with strong sign-in measures such as multi-factor authentication.
• Malware protection helps prevent, detect and remove harmful software.
• Security update management ensures supported operating systems, applications and firmware receive important updates promptly.

These controls apply to the technology within the scope of your certification. That normally includes company-owned computers, servers, mobile devices, cloud services and network equipment used to access business data. Home workers and bring-your-own-device arrangements need particular care. If a personal laptop can access company email or files, it may be relevant to the assessment.

The scheme is deliberately focused. It does not prove that a business is immune to phishing, has a disaster recovery plan that will work in every situation, or meets every obligation under data protection law. Think of it as a solid front door, not the whole security strategy.

Cyber Essentials Basic or Cyber Essentials Plus?

There are two levels of certification, and choosing the right one depends on why you are applying.

Cyber Essentials Basic

Cyber Essentials Basic is a self-assessment certification. Your organisation completes an online questionnaire about its systems and security controls, then an independent assessor reviews the answers. You will need to provide clear, accurate information, but nobody visits your office or remotely tests your devices as part of the standard Basic assessment.

This option suits many small businesses that need a recognised security baseline, want to improve their internal practices, or have been asked for certification by a customer. It is often the quickest route, provided the groundwork has already been done.

Cyber Essentials Plus

Cyber Essentials Plus includes an independent technical assessment. An assessor tests a sample of your devices and looks for evidence that the controls are working in practice. This may include checking for missing updates, testing protections against common malware and reviewing how accounts are secured.

Plus gives customers greater assurance because the evidence has been tested, not only declared. Some contracts specify it, particularly where organisations handle sensitive information or supply larger businesses. It also requires more preparation. A business that passes Basic can still struggle with Plus if a handful of devices are unmanaged, old software remains in use, or staff have local administrator rights without a clear reason.

Both certifications are valid for 12 months. Security does not stand still for a year, so treat renewal as a check that your day-to-day IT management is still doing what it should.

How to prepare for Cyber Essentials certification

The application is easier when you start with an honest picture of your technology. Trying to rush the questionnaire before checking your devices can create delays, failed answers and last-minute disruption for staff.

1. Define what is in scope

Make a straightforward inventory of the systems that store, process or access business data. Include office PCs, laptops, phones, routers, Wi-Fi equipment, servers, cloud platforms, remote access tools and any specialist systems. For example, an automotive business may need to consider diagnostic machines if they connect to the wider business network. A charity may need to include shared devices used by volunteers.

You also need to know who administers each system. If different suppliers manage your internet connection, Microsoft 365, phones and backups, no one may have the complete picture. This is where a single accountable IT partner can remove a great deal of uncertainty.

2. Remove unsupported software and devices

Unsupported operating systems and applications are one of the most common obstacles. If the software supplier no longer provides security updates, it will generally not meet the scheme requirements when it is in scope.

Sometimes the answer is a planned replacement. Sometimes it is possible to isolate a legacy system so it cannot access the internet or other business systems, though this needs careful design and documentation. Do not assume an old device is acceptable simply because it still works. Reliability and security are different questions.

3. Get updates under control

Most businesses do not need staff manually checking every device. They do need confidence that operating systems, browsers, office applications, security software and key business tools are updated within the required timescales.

Centralised device management makes this far easier. It can report on missing patches, enforce encryption and security settings, and flag machines that have not checked in. Without that visibility, certification can become a time-consuming hunt through individual laptops.

4. Tighten sign-ins and admin access

Multi-factor authentication should be enabled wherever it is available, especially for email, cloud file storage, finance systems and remote access. A stolen password is far less useful to an attacker if they cannot complete the second sign-in step.

Review administrator accounts too. People should use standard accounts for daily work and elevated access only when required. Shared administrator logins make it difficult to see who changed a setting and make account removal harder when someone leaves.

5. Check your firewall, Wi-Fi and remote access

Your business firewall should be properly configured, kept up to date and protected with a strong, unique administrator password. Wi-Fi should use suitable encryption, with a separate guest network where appropriate. Remote access needs close attention, particularly if staff work from home or suppliers connect to systems remotely.

The aim is not to make technology awkward to use. It is to avoid leaving services exposed to the internet without a business need and suitable protection.

6. Answer the assessment carefully

The Cyber Essentials questionnaire is detailed because small configuration choices matter. Read each question in the context of every system in scope rather than answering based on what normally happens. If you are unsure, check the evidence first.

An assessor may return the questionnaire with points to clarify or improvements to make. That is useful feedback, not a reason to panic. Build time into your plan for corrections, especially if a tender deadline is involved.

Common issues that delay certification

The most avoidable problem is incomplete visibility. A business may have well-managed office computers but forget an old director’s laptop, a spare machine in a cupboard or a tablet used for stocktaking. Unmanaged devices are still devices.

Other frequent issues include staff retaining access after leaving, inconsistent multi-factor authentication, unsupported software, routers that have not received firmware updates, and suppliers who cannot clearly explain who is responsible for what. Cloud services can cause confusion too. Using a reputable provider does not remove your responsibility for account security, user access and configuration.

Cost is another consideration. The fee for certification is only part of the budget. You may need to replace ageing devices, move to supported software, introduce management tools or spend time improving internal processes. Those changes are worthwhile beyond the certificate because they reduce downtime and make support more predictable.

Making certification part of everyday IT

The strongest approach is to make Cyber Essentials the result of good routine management, rather than a once-a-year scramble. Regular patching, monitored security alerts, prompt leaver processes, tested backups and a clear device list make renewal much less disruptive.

My Tech Team helps small businesses turn these requirements into practical day-to-day IT support, without burying owners and office managers in technical language. The right setup should let your team get on with their work while you have a clear view of what is protected, what needs attention and who is accountable.

If certification is on your customer checklist, start by asking a simple question: could you identify every device and account that can access your business data? If the answer is not an immediate yes, a no-obligation IT audit is a sensible first step before you begin the application.