All services Every engagement has a fixed, published price. Book a strategy call
Cyber Essentials for small businesses, explained for owners rather than IT people: what the five controls mean, the real costs, a one week plan to get certified, the 2026 rules, and when you genuinely do not need to pay anyone for help.
This guide to Cyber Essentials for small businesses is written for owners rather than IT people. No jargon, no scare tactics, and no pretending it is more complicated than it is. It comes from an IASME licensed certification body, meaning we are the people who mark the assessments, so we know exactly what trips small firms up and exactly how little this needs to cost.
The short version. Cyber Essentials is a UK government-backed certificate showing your business has five basic protections in place. For most small businesses it costs £320 or £440 + VAT, takes a few days of attention rather than weeks, and comes with £25,000 of cyber insurance included for eligible firms. You do not legally need it, but more and more contracts ask for it, and the protections it checks are the ones that stop the attacks that hit small businesses. A tidy business can do it without paying anyone for help, and this guide shows you how.
Cyber Essentials is a checklist with a certificate attached. The UK government’s cyber security experts looked at how small organisations get attacked and boiled the defence down to five areas. You answer a questionnaire about how your business handles those five areas, a qualified assessor checks your answers, and if they hold up, you are certified for a year. Here is what the five areas mean, without the jargon.
| The official name | What it means | The question behind it |
|---|---|---|
| Firewalls | A locked front door between the internet and your systems | Is your internet router still using the password it came with? |
| Secure configuration | Not leaving things switched on that you do not use | Are old accounts, sample software and default settings still lying around? |
| User access control | People can only reach what their job needs | Does everyone in the office have administrator rights just because it was easier? |
| Malware protection | Something actively stopping malicious software | Is protection installed, switched on and up to date on every machine? |
| Security update management | Updates applied quickly, everywhere | When your laptop says “restart to update”, does anyone do it within two weeks? |
If you read that table and thought “we mostly do this already”, certification will be quick and cheap. If a couple of rows made you wince, that wince is the reason the scheme exists, and fixing it matters whether or not you buy the certificate.
Legally, no. Nothing forces a small business to certify, and anyone telling you otherwise is selling something. There are three honest reasons to do it anyway.
Contracts increasingly ask for it. Many UK government and public sector contracts require Cyber Essentials by name, and larger companies now push the same requirement down their supply chains. For a growing number of small firms, the certificate is the difference between being allowed to bid and not. If your customers include councils, the NHS, universities or big corporates, expect the question.
Insurance is included. Eligible UK businesses with under £20 million turnover that certify the whole organisation get cyber liability insurance with £25,000 of cover included at no extra cost. For a micro business paying £320 for the certificate, that alone changes the arithmetic.
The protections are the point. The attacks that ruin small businesses are rarely sophisticated: a guessed password on an email account, an unpatched machine, an invoice fraud that worked because the attacker read your inbox for a month. The five controls are aimed squarely at those. The certificate is proof for other people. The controls are protection for you.
When can you genuinely skip it? If nobody in your market asks for it, your systems are one laptop and a phone, and you already run updates and decent passwords, the certificate can wait. The controls themselves should not.
The Cyber Essentials cost for small business budgets is refreshingly fixed, because the official fee is set nationally by organisation size and is the same through every certification body.
| What | Cost | When you need it |
|---|---|---|
| Official fee, micro business (0 to 9 people) | £320 + VAT | Always. This is the assessment itself |
| Official fee, small business (10 to 49 people) | £440 + VAT | Always, at this size |
| Guided certification | £950 + VAT with us | If you want an assessor to prepare the answers with you and tell you exactly what to fix |
| Cyber Essentials Plus | £1,150 + VAT with us, fixed. Commonly £1,500 to £3,000 elsewhere | Only when a contract asks for Plus, or you want the hands-on audit |
| Your own time | Typically a day or two, spread out | Always. Someone has to answer honestly and fix small things |
One pattern in the market for Cyber Essentials for SMEs is worth knowing: quotes far above these numbers are quotes for the fee plus services, and the services should be itemised so you can decline them. The full picture, including the games some resellers play, is in our Cyber Essentials cost guide. The honest headline for a tidy micro business: £320 and a quiet afternoon or two.
Mostly, but not entirely, and the difference matters. Your IT provider can and should do the fixing: turning on multi-factor authentication, sorting updates, tidying admin accounts. What they cannot do is own the answers, because the questionnaire is a declaration about your business and a director signs it, and from 2026 that signature explicitly promises the controls will be kept up all year rather than just on assessment day. So the right division of labour is: you understand the questions, your IT provider makes the technical answers true, and you sign knowing both. Two questions worth asking your IT provider today: “is MFA enforced on every cloud service we use” and “how quickly do security updates land on our machines”. Their answers predict your assessment.
We mark these assessments, so this list is not theoretical. Old software still in use: an operating system or application past its support date fails you, and there is usually one forgotten machine running something ancient. Multi-factor authentication not switched on: free on almost every service your business uses, and from April 2026 missing MFA automatically fails the whole assessment. Everyone is an administrator: day-to-day work should happen in ordinary accounts, with admin rights kept for the moments that need them. Ghosts in the machine: accounts of people who left, trial software nobody removed, the tablet in the drawer that still syncs email. Answering from memory: the questionnaire asks what is true rather than what you believe. The businesses that struggle are the ones that never look. A one-page list of your devices, cloud services and who can access what solves most of this before it starts.
The scheme tightened in April 2026, and two changes bite small firms directly. Multi-factor authentication is now an automatic fail if any cloud service you use offers it and you have not switched it on, free or paid. And high-risk security updates must genuinely be applied within 14 days, with two named questions that fail the assessment on their own if answered no. Cloud services can also never be left out of scope, so the accounting platform and the file storage count. None of this is hard for a small business. All of it punishes drift. The detail is in our guide to the Cyber Essentials 2026 changes.
Start with basic Cyber Essentials unless something specific says otherwise. Choose Cyber Essentials Plus when a contract names it, when you handle volumes of sensitive data that make hands-on verification worth having, or when a big customer’s security team wants more than a self-assessment. Plus is the same five controls with an assessor testing a sample of your machines, which is why it costs four figures instead of three. For most small firms the sensible path is basic certification now, and Plus the year a contract demands it, booked together with the renewal so both land inside the required window.
Monday: make the lists. Every computer, phone and tablet that touches business data. Every cloud service the business uses. Everyone with access, and who has admin rights. An hour with a coffee, honestly done.
Tuesday: switch on MFA everywhere. Email first, then accounting, file storage and everything else on the list. Include the directors. Especially the directors.
Wednesday: updates and admins. Turn on automatic updates wherever they exist, update or retire anything out of support, and take admin rights off everyday accounts.
Thursday: answer the questionnaire. Register with the certification body, work through the questions against your lists, and flag anything you cannot answer confidently.
Friday: review and submit. Read the flagged answers again, fix what Thursday exposed, have the director read what they are signing, and submit. Assessment turnaround is typically fast, and there is a window to correct anything the assessor queries.
Businesses with tidier IT finish faster. Messier ones need a second week for remediation rather than paperwork. Either way, the work is exactly the hygiene you would want done anyway.
Cyber Essentials for startups is often the easiest certification of all, because a young company has no legacy: no ancient server, no decade of forgotten accounts, machines still in support. A laptops-and-cloud startup can usually certify for £320 with less than a day’s total effort, and it pays off early, both with enterprise customers who send security questionnaires and with the discipline of starting tidy. The one startup-specific trap: personal devices used for work count, so decide early whether work happens on company-controlled devices or properly managed personal ones.
We are the certification body, so the arithmetic is simple. Cyber Essentials certification at the official fee, £320 to £600 + VAT by size, nothing added. Guided certification at £950 + VAT if you want our assessors preparing the submission with you, which suits businesses whose IT grew organically and needs untangling. Cyber Essentials Plus at £1,150 + VAT, fixed. And the advice we give most often to micro businesses is that they do not need to pay anyone: follow the week above, self-assess for £320, and spend the savings on something that grows the business.
For most, yes. It costs £320 to £440 + VAT, includes £25,000 of cyber insurance for eligible firms, keeps you eligible for contracts that require it, and the five controls it checks are the ones that stop the attacks that hit small businesses.
The official fee is £320 + VAT for businesses with up to 9 people and £440 + VAT for 10 to 49 people, the same through every certification body. Guided support and Cyber Essentials Plus are extra. A tidy business needs neither.
No law requires it. It becomes effectively required when a contract, framework or customer asks for it by name, which is increasingly common in public sector and corporate supply chains.
A tidy business can go from starting the lists to submitting in a week, with a day or two of actual effort. Businesses with older kit or loose access typically need an extra week or two of fixing first.
Yes, and usually more easily than an established firm: modern laptops, cloud services and no legacy make certification straightforward. Decide early whether work happens on company devices or managed personal ones, because devices that touch business data are in scope.
You are told what fell short and there is a window to correct and resubmit. From April 2026 the common causes of outright failure are missing multi-factor authentication and security updates slower than 14 days, both fixable in days for most small firms.
Yes. Macs, phones and tablets are in scope like any other device, and cloud services can never be excluded. The controls translate directly: supported macOS versions, updates applied, MFA on every cloud account, admin rights kept separate.
Yes, certification lasts twelve months and the official fee applies each year. Renewal is nearly always easier than the first pass, because the tidying was done in year one.
Written by Emmanuel Olatunji, Chief Enterprise Architecture Partner at Intelance, an IASME licensed certification body for Cyber Essentials and Cyber Essentials Plus. Last reviewed 8 July 2026.
Emmanuel Olatunji
Chief Enterprise Architecture Partner
Emmanuel founded Intelance in 2017 and has led architecture, AI governance, cyber and deal engagements across the UK, Europe, the Middle East and Africa. Every Intelance engagement runs under his direction, and every guide he publishes comes from that work.
See his record on LinkedIn About IntelanceThirty minutes with a licensed assessor. You leave knowing which route applies to you, what it costs and what to do first.
Talk to a senior adviser
