Cyber Essentials support for small businesses
Cyber Essentials shows clients, insurers and public sector buyers that your business has the basic security controls in place. We find the gaps against the current requirements, fix them with you and support you through the assessment, so you can submit with confidence.
What Cyber Essentials is
Cyber Essentials is a UK government-backed certification scheme, run by the National Cyber Security Centre (NCSC) and delivered by IASME. It covers five technical controls that protect against the most common internet-based attacks, such as phishing, password guessing and exploiting devices that have not been updated.
You answer an online question set about your organisation, your devices and your cloud services. An independent certification body marks the answers. If they meet the requirements, you receive a certificate that is valid for 12 months.
The question set that came into force in April 2026 follows the NCSC document Cyber Essentials: Requirements for IT Infrastructure v3.3. Our plain English checklist of the v3.3 requirements walks through every control.
Why small businesses are being asked for it
Central government contracts that involve handling personal information or supplying certain ICT services require Cyber Essentials, and many larger organisations now ask the same of their suppliers. Insurers and tender questionnaires increasingly ask whether you hold it.
Few businesses do. The Cyber Security Breaches Survey 2025/2026 found that only 5% of UK businesses hold Cyber Essentials, while 43% identified a breach or attack in the previous 12 months. Holding the certificate can separate you from competitors in a tender.
- Win or keep contracts that list Cyber Essentials as a requirement.
- Answer supplier security questionnaires with evidence rather than assurances.
- Eligible UK organisations with turnover under £20 million receive cyber liability insurance with the certificate, subject to IASME terms.
- Close the gaps that common internet-based attacks rely on.
The five controls in plain English
Every device and cloud service in scope must meet all five controls. These are the gaps we find most often when preparing small businesses.
| Control | What it requires | Gaps we commonly fix |
|---|---|---|
| Firewalls | Every device in scope is protected by a correctly configured firewall. Default admin passwords are changed and firewall admin interfaces are not open to the internet without MFA or an IP allow list. | Routers still using the default password. Software firewalls switched off on laptops used at home or on public wifi. |
| Secure configuration | Unused accounts and software are removed, auto-run is disabled, and devices lock after no more than 10 failed attempts, with a PIN or password of at least six characters. | Old user accounts left active. Phones and tablets with no screen lock. |
| Security update management | All software is licensed and supported. Automatic updates are on where possible. Critical and high-risk fixes are applied within 14 days of release. | Unsupported operating systems still in use. Updates left to staff to install when convenient. |
| User access control | Accounts are approved before creation and removed when no longer needed. Administrators use separate admin accounts. MFA is used wherever available and always on cloud services. | MFA missing on one or two cloud services. Staff using an admin account for everyday email. |
| Malware protection | Every device runs active, up-to-date anti-malware that blocks malicious websites, or restricts software to an approved, code-signed list. | Personal devices used for work with no protection anyone can confirm. |
Cyber Essentials technical controls under the v3.3 requirements
Firewalls
- What it requires
- Every device in scope is protected by a correctly configured firewall. Default admin passwords are changed and firewall admin interfaces are not open to the internet without MFA or an IP allow list.
- Gaps we commonly fix
- Routers still using the default password. Software firewalls switched off on laptops used at home or on public wifi.
Secure configuration
- What it requires
- Unused accounts and software are removed, auto-run is disabled, and devices lock after no more than 10 failed attempts, with a PIN or password of at least six characters.
- Gaps we commonly fix
- Old user accounts left active. Phones and tablets with no screen lock.
Security update management
- What it requires
- All software is licensed and supported. Automatic updates are on where possible. Critical and high-risk fixes are applied within 14 days of release.
- Gaps we commonly fix
- Unsupported operating systems still in use. Updates left to staff to install when convenient.
User access control
- What it requires
- Accounts are approved before creation and removed when no longer needed. Administrators use separate admin accounts. MFA is used wherever available and always on cloud services.
- Gaps we commonly fix
- MFA missing on one or two cloud services. Staff using an admin account for everyday email.
Malware protection
- What it requires
- Every device runs active, up-to-date anti-malware that blocks malicious websites, or restricts software to an approved, code-signed list.
- Gaps we commonly fix
- Personal devices used for work with no protection anyone can confirm.
Summarised from the NCSC document Cyber Essentials: Requirements for IT Infrastructure v3.3 (April 2026). The full requirements include more detail on password rules, scope and cloud services.
What changed in version 3.3
The v3.3 requirements, which the April 2026 question set follows, made several clarifications that affect small businesses using cloud software.
- Cloud services cannot be excluded from scope. If your data sits in Microsoft 365, Google Workspace, Xero or similar, those services are assessed.
- Cloud services now have a formal definition: an internet-accessible, on-demand service that stores or processes data for your organisation through an account.
- Passwordless authentication explicitly includes FIDO2 authenticators and passkeys, which count as multi-factor authentication.
- Backups are still not a technical requirement, but the document now stresses how important they are.
- Software development guidance now points to the Software Security Code of Practice.
What Cyber Essentials costs
The certification fee is fixed by IASME and depends on the number of people in your organisation. Preparation and any remediation work are separate, and we quote for them after the gap analysis.
| Organisation size | Staff | Assessment fee |
|---|---|---|
| Micro | 0 to 9 | £320 plus VAT |
| Small | 10 to 49 | £440 plus VAT |
| Medium | 50 to 249 | £500 plus VAT |
| Large | 250 or more | £600 plus VAT |
IASME Cyber Essentials assessment fees, checked September 2026
Micro
- Staff
- 0 to 9
- Assessment fee
- £320 plus VAT
Small
- Staff
- 10 to 49
- Assessment fee
- £440 plus VAT
Medium
- Staff
- 50 to 249
- Assessment fee
- £500 plus VAT
Large
- Staff
- 250 or more
- Assessment fee
- £600 plus VAT
Fees are set by IASME and can change. Cyber Essentials Plus is priced by the certification body after scoping, because it includes an on-site or remote technical audit. See how Robishto pricing works.
How Robishto prepares you for Cyber Essentials
Robishto prepares you and supports the submission. The certificate is awarded by an independent, licensed certification body.
- 01
Free readiness check
Answer 25 plain English questions to see how close you are, with a score for each of the five controls.
- 02
Scope and gap analysis
We agree what is in scope, including cloud services, home workers and personal devices, then check every requirement and list the gaps in priority order.
- 03
Fix the gaps
We roll out MFA, switch on automatic updates, configure firewalls and device locks, replace or isolate unsupported software, and write the short policies that support the controls.
- 04
Submit and stay certified
We support you through the question set so the answers match what is really in place, then help you keep the controls current until renewal in 12 months.
Cyber Essentials guides
- Cyber Essentials requirements checklist (v3.3)Every technical requirement, explained for a small business.
- Cyber Essentials vs Cyber Essentials PlusWhat the Plus audit adds and when a contract needs it.
- Microsoft 365 setup checklistThe settings that close most cloud-related Cyber Essentials gaps.
- Cybersecurity and compliance servicesVulnerability scanning, policies, penetration testing and ongoing support.
Cyber Essentials questions
How long is a Cyber Essentials certificate valid?
Twelve months. To stay certified you complete the assessment again each year, answering against whichever question set is current at the time.
Are staff personal phones and home routers in scope?
Personal devices that access organisational data or services, such as work email, are in scope. Phones used only for calls, texts and MFA apps are not. Home routers are out of scope unless your business supplied them, so laptops used at home need their own software firewall switched on.
Are Microsoft 365 and Google Workspace included?
Yes. Under v3.3 cloud services cannot be excluded from scope, and authentication to cloud services must always use multi-factor authentication.
Do we need Cyber Essentials Plus instead?
Only if a contract, client or insurer asks for it. Plus adds a technical audit of a sample of your devices and accounts and must be completed within three months of passing Cyber Essentials. Read Cyber Essentials vs Cyber Essentials Plus.
Are backups required for Cyber Essentials?
No. Backups are not one of the technical requirements, but the NCSC strongly recommends them, and we set them up as part of preparation where they are missing.
Does Robishto award the certificate?
No. We prepare you and support the submission. The certificate is awarded by an independent, licensed certification body, which keeps the assessment impartial.
Find the gaps before an assessor does.
The free readiness check scores your business against each of the five controls and shows what to fix first. If you would rather talk it through, book a free consultation.