In short: Cyber Essentials for small business is the same government-backed certification larger organisations hold, scaled to your size. A small team answers the question set, fixes common gaps such as personal devices, shared logins, old laptops and missing MFA, and gets a certificate that buyers recognise. Eligible organisations certifying in full also receive included cyber insurance.
Is Cyber Essentials realistic for a small business?
Yes. Cyber Essentials is built for organisations of every size, from sole traders to large companies, and the five technical controls are the same for everyone: Firewalls, Secure Configuration, Security Update Management, User Access Control and Malware Protection.
What changes with size is the effort. A business with a handful of laptops, phones and one cloud email service has far less to inventory and fix than a company with several offices. IASME, the NCSC's Cyber Essentials Delivery Partner, also bands its fixed self-assessment fee by employee count, with the lowest band for micro organisations of up to nine people. See what Cyber Essentials costs for the factors that drive the total.
Small businesses usually certify for one of three reasons:
- A customer or tender asks for it. Government contracts under PPN 014 and many private buyers expect it from suppliers. See Cyber Essentials for supply chain assurance.
- Insurance and peace of mind. The controls are designed to protect against the most common untargeted internet attacks, and eligible organisations get included cyber liability insurance.
- A structured to-do list. The question set turns vague worry about cyber security into specific tasks.
The gaps small businesses usually have
Small organisations rarely fail because of anything exotic. These are the issues we find most often, and several are now automatic fails under the Danzell question set:
| Gap | Why it matters for Cyber Essentials | Typical fix |
|---|---|---|
| Personal phones and laptops used for work email or files | User-owned devices that access organisational data or services are in scope and must meet every control | Bring them under device management, or provide work devices. See BYOD and home working |
| Shared logins (one admin account, one shared mailbox password) | Every user needs unique credentials, and admin accounts must be separate and used only for admin tasks | Individual accounts, a separate admin account per administrator, delegated mailbox access |
| No MFA on Microsoft 365, Google Workspace or other cloud apps | Missing MFA on a cloud service that offers it fails the whole assessment | Turn on MFA for every user and every cloud service. See Cyber Essentials MFA |
| Old laptops or an unsupported operating system | Unsupported software in scope is an automatic fail | Upgrade, replace or isolate. See Windows 10 and Cyber Essentials |
| Updates left to users | Critical and high-risk updates must be installed within 14 days | Automatic updates on every device and app |
| Router with its default admin password | Default passwords must be changed and the admin interface not exposed to the internet without a documented need and extra protection | Change the password, disable remote admin, review open ports |
Our Cyber Essentials checklist walks through each area so you can check yourself before applying.
Home working, consumer routers and phones
Most small teams work at least partly from home. Home and remote devices are in scope, but a home router that the business did not supply is not, which means the device itself must run a software firewall. The firewall built into Windows and macOS is enough, as long as it is switched on.
If you supply staff with a router, that router is in scope and must meet the firewall requirements. If everyone connects through a company VPN, the boundary moves to the company or cloud firewall.
Mobile phones need care. A phone used only for ordinary calls, text messages and an authenticator app is out of scope. A phone that also opens work email, Teams or shared files is in scope, so it needs a supported operating system, a screen lock and updates. A mobile device management tool such as Microsoft Intune makes that manageable for a small team.
What it involves, step by step
- Decide your scope. Certifying the whole business is simplest and is required for the included insurance. See defining your scope.
- List your devices, cloud services and accounts. Include personal devices that access work data.
- Download the free question set from IASME and read it before you start. Our question set guide explains each section.
- Fix the gaps, starting with the automatic fails: cloud MFA, 14-day updates and unsupported software.
- Register and answer the questions through IASME (self-led) or a Certification Body (supported). A director or equivalent signs the declaration, which under Danzell commits you to staying compliant for the whole year.
- Receive your certificate, then plan for renewal in 12 months.
The full route is on the Cyber Essentials certification process. If a customer has asked for Cyber Essentials Plus, the same preparation applies, followed by hands-on testing within three months of the self-assessment.
Free help and included insurance
You do not need to spend money to find out how close you are:
- IASME's free question set booklet (PDF or Excel), so you can see every question in advance.
- The Cyber Essentials Readiness Tool from IASME, which produces a personalised action plan.
- The NCSC Cyber Action Toolkit, a free online tool that breaks basic protection down into simple steps for sole traders and small organisations.
- A free 30-minute session with an NCSC-assured Cyber Advisor, offered to small and medium-sized organisations preparing for Cyber Essentials. See the NCSC Cyber Advisor scheme explained.
On certification, IASME arranges cyber liability insurance, including 24/7 incident response, for UK-based organisations with turnover under 20 million pounds that certify their whole organisation. Check IASME's insurance page for the current terms and cover limits.
The NCSC's Funded Cyber Essentials Programme, which gave some small organisations free expert support, was described by the NCSC as being in its final year, and we found no open round in October 2026. See funded Cyber Essentials for what remains.
How we help small businesses
Forever Systems works with small teams that have no in-house IT. We run a short gap analysis, tell you plainly what needs to change, help you make those changes using the tools you already pay for where possible (every Microsoft 365 tenant can turn on MFA, and plans such as Microsoft 365 Business Premium include Intune device management), and support you through assessment alongside an IASME-licensed Certification Body. We do not issue certificates ourselves.
People are the other half of the picture, so we also point small teams to security awareness training for small businesses. Pricing depends on your size and starting point, so ask us for a quote. Contact us to get started.
How Forever Systems helps you get certified
Most organisations fail Cyber Essentials for the same handful of reasons: unsupported operating systems left in scope, missing multi-factor authentication on cloud services, default passwords on routers and firewalls, and security updates that sit for longer than the 14 days the scheme allows. We find those gaps before an assessor does, then help you fix them.
- Readiness review and gap analysis of your devices, cloud services, firewalls and user accounts against the current question set
- Remediation: patching, configuration hardening, MFA roll-out, firewall changes and device management with tools such as Microsoft Intune
- Support through assessment with an IASME-licensed certification body, for both Cyber Essentials and Cyber Essentials Plus
- Supply chain and sector requirements: help when a customer, a public-sector contract or a framework asks for certification as a condition of working with them
- Staying compliant all year, so renewal is a formality rather than a scramble
Forever Systems Ltd is an IT and cyber security provider. We prepare you for certification and work alongside a licensed certification body, which carries out the assessment and issues the certificate.
Want to know how close you are to passing Cyber Essentials?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Do sole traders need Cyber Essentials?
It is not a legal requirement, but sole traders can certify, and some customers and government contracts ask for it. The controls are the same; with one person and a few devices, preparation is usually quick.
How long does Cyber Essentials take for a small business?
It depends on how many gaps you have. Answering the question set is quick once your IT meets the controls; the time goes on fixes such as enabling MFA, replacing unsupported devices or bringing personal phones under management. Assessors aim to mark within a few days, and you have six months to complete an account.
Are staff personal phones in scope for Cyber Essentials?
Yes, if they access organisational data or services such as work email, files or Teams. A phone used only for calls, texts and an authenticator app is out of scope.
Does Cyber Essentials come with insurance?
IASME arranges cyber liability insurance, including 24/7 incident response, for UK-based organisations with turnover under 20 million pounds that certify their whole organisation. Check IASME's insurance page for current terms.
Can a small business do Cyber Essentials without IT support?
Many do, using IASME's free booklet and Readiness Tool. Outside help is most useful when you need to change configurations, such as MFA, device management or firewall settings, or when you want confidence before paying the assessment fee.