A Shoreditch agency wins its way to the final round of a public-sector tender, then hits a single line in the supplier questionnaire: "Please attach a valid Cyber Essentials certificate." They don't have one. The deadline is nine days away. Suddenly a scheme they'd half-heard of becomes the thing standing between them and a six-figure contract. This is the most common way London SMEs meet Cyber Essentials — under pressure, at the last minute. It doesn't have to be that way. Cyber Essentials is a UK government-backed scheme, run by IASME (the Information Assurance for Small and Medium Enterprises consortium) on behalf of the National Cyber Security Centre (NCSC). It sets out five basic technical controls that stop the most common internet-based attacks. This guide explains exactly what it covers, what it costs, why applications fail, and how to pass first time.
What Cyber Essentials certification actually requires
Cyber Essentials is a self-assessment questionnaire, verified by a certification body licensed by IASME. You answer questions about how your business is set up — devices, software, accounts, firewalls and updates — and an assessor reviews your answers against the scheme's requirements. If everything meets the standard, you're certified for 12 months.
There are two levels. The important word is "self-assessed": standard Cyber Essentials is based on your own honest answers. Cyber Essentials Plus adds an independent technical audit, where an assessor tests a sample of your devices and checks that what you claimed is actually true. Many contracts specify plain Cyber Essentials; some regulated or higher-risk buyers require Plus.
The scope covers everything that connects to the internet and touches your business data: laptops, desktops, servers, mobile phones and tablets used for work, cloud services and the accounts people log in with. You can certify your whole organisation or a defined subset, but a partial scope has to be genuine and clearly separated — you can't simply exclude the messy parts. Getting scope right at the start saves a great deal of pain later.
The five technical controls explained
Cyber Essentials is built around five control areas. None of them is exotic. They're the security basics that, done consistently, block the overwhelming majority of opportunistic attacks. The difficulty is rarely understanding them — it's applying them across every device and account without gaps.
Here's what each control means in practice for a typical London SME:
- Firewalls — every device must sit behind a correctly configured firewall, whether that's your office boundary firewall or the software firewall on a laptop working from a café. Default admin passwords on the firewall must be changed.
- Secure configuration — remove or disable software, accounts and services you don't use, change default passwords, and don't leave devices in their out-of-the-box state. Every unnecessary feature is a potential way in.
- Security update management (patching) — operating systems and applications must be supported by the vendor and patched promptly. High-risk and critical updates need to be applied within 14 days of release. Unsupported software (old Windows, unpatched plugins) is an automatic problem.
- User access control — everyone has their own account, admin rights are restricted to those who genuinely need them, and accounts are removed when people leave. Day-to-day work should not happen on an administrator account.
- Malware protection — anti-malware on devices, or an approved application-allowlisting or sandboxing approach. On managed devices this is usually endpoint security, which most London SMEs run alongside Cyber Essentials rather than as a replacement for it.
Multi-factor authentication and cloud services
Since the scheme's requirements were updated, cloud services are firmly in scope — and so is multi-factor authentication (MFA, a second login step such as a code or app approval). If your business runs on Microsoft 365, Google Workspace or similar, those platforms and the accounts on them must meet the controls.
In practice this means MFA on all administrator accounts and all user accounts for cloud services, sensible password policies, and disabling access for former staff. For most London businesses the assessment centres on their Microsoft 365 tenant, so getting Microsoft 365 support configured correctly does much of the heavy lifting for certification.
A recurring stumbling block is thinking "the cloud provider handles security". They secure the platform; you're responsible for how you configure it and who can log in. That difference matters, and it's exactly what the assessor probes.
What Cyber Essentials costs and how long it takes
The certification fee is tiered by organisation size, and for the smallest businesses (micro organisations of up to nine people) the standard Cyber Essentials assessment fee starts in the low hundreds of pounds plus VAT, rising for larger headcounts. Cyber Essentials Plus costs more because it involves a hands-on technical audit; the total depends on how many devices need testing.
The fee is only part of the picture. The larger cost is usually the remediation work — enabling MFA, tidying up admin accounts, replacing unsupported software, standardising device configuration. If your environment is already well managed, that work is minimal. If it's been left to drift, budget time and possibly some IT project delivery to get everything into shape first.
On timing: a well-prepared organisation can complete the self-assessment in a few days and receive a certificate quickly once submitted. In reality, most first-timers need two to four weeks to close gaps before they're ready to answer honestly. Cyber Essentials Plus needs additional lead time to schedule and run the audit. Don't leave it until a tender deadline is looming.
Common reasons applications fail — and how to avoid them
Cyber Essentials isn't designed to catch you out, but assessors do reject applications, and the reasons are consistent. Most failures come down to gaps between what a business believes is true and what's actually configured on its devices.
The frequent culprits are worth knowing before you start:
- Unsupported software still in use — an old operating system, an unpatched line-of-business application, or a browser plugin the vendor no longer updates.
- MFA not applied everywhere — enabled for some staff but missing on an admin account or a shared mailbox.
- Default or weak passwords left on routers, firewalls or network devices.
- Everyone running as a local administrator, so day-to-day work happens with elevated rights.
- Incomplete asset picture — forgetting BYOD (bring-your-own-device) phones, home-working laptops, or a server tucked in a cupboard that never got patched.
- Scope defined to dodge problems rather than reflect reality, which assessors will question.
Do you need Cyber Essentials to win contracts?
For many London SMEs, yes — at least for certain work. Cyber Essentials is mandatory for suppliers bidding on some central government contracts, particularly those handling personal or sensitive information. Increasingly, private-sector buyers, insurers and larger clients ask for it too, using it as a quick, credible signal that you take security seriously.
Even where it isn't strictly required, the certificate does useful work. It shortens supplier due-diligence, reassures clients, and often helps with cyber insurance applications. It's a recognisable badge that says your basics are in order — which is precisely why it appears in so many procurement questionnaires.
If tenders are part of your growth plan, treat Cyber Essentials as table stakes rather than an optional extra. Certifying in advance means you're never the finalist who has to withdraw over a missing certificate. It also pairs naturally with a broader cyber security approach, because the scheme is a floor, not a ceiling.
How managed IT support makes certification painless
The businesses that pass Cyber Essentials first time usually have one thing in common: consistent, centrally managed IT. When every device is enrolled, patched on a schedule, running approved software and protected by enforced MFA, the self-assessment stops being a scramble and becomes a description of how you already operate.
This is where a managed provider earns its place. Good managed IT support keeps an accurate inventory of every device and account, applies updates within the required windows, standardises configuration, and removes leavers promptly — the exact things assessors check. When it's time to certify, the evidence already exists. If you have an in-house team that needs backup on the technical detail, co-managed IT support can cover the specific controls without taking over everything.
At CLI Secure we help London businesses prepare for and maintain Cyber Essentials as part of ongoing IT and security management, so the certificate reflects genuine day-to-day practice rather than a one-off tidy-up. If a contract deadline is bearing down, or you simply want your basics verified, get in touch and we'll scope the work honestly — including telling you where your existing setup is already fine.