Cyber Essentials is very achievable for most businesses — but a surprising number fail first time on avoidable gaps. Here’s what’s involved and how to get it right.
The five controls you’ll be certified against
- Firewalls: properly configured firewalls protecting your networks and devices.
- Secure configuration: devices and software set up securely, with unnecessary features and default passwords removed.
- Security update management: operating systems and software kept patched and up to date.
- User access control: people have only the access they need, admin rights are controlled, and accounts are managed properly.
- Malware protection: effective protection against malware on all devices.
The steps
- Scope it: decide what’s in scope — usually your whole organisation, all internet-connected devices and cloud services.
- Assess & fix gaps: check your setup against the five controls and put right anything that falls short (this is where the real work is).
- Complete the assessment: answer the certification questionnaire accurately.
- Submit & verify: a certification body reviews it; for Cyber Essentials Plus, an assessor also tests your systems hands-on.
How long does it take?
If your security is already in good shape, certification can be quick. More often, the time goes into fixing gaps first — tightening access, patching, sorting configuration. Plan for a few weeks rather than a few days if you’re starting from scratch.
Where businesses trip up
The common fails are all fixable: unsupported or unpatched software, weak or default passwords still in place, too many people with admin rights, MFA not enabled, and personal devices that aren’t properly managed. Fixing these before you submit is the difference between passing first time and paying to re-take.
Let us handle it
We’re Cyber Essentials certified and do this regularly. We’ll assess you against the five controls, fix the gaps, and take you through certification so you pass first time — at competitive rates. Call 01923 228820 or get in touch for a quote.
Frequently Asked Questions
What are the five Cyber Essentials controls?
Firewalls, secure configuration, security update management (patching), user access control, and malware protection. Get these right and you block most common attacks.
Can we get Cyber Essentials ourselves, or do we need help?
You can self-certify, but most businesses find it faster and more certain to have a certified provider check and fix the gaps first — it avoids failing on avoidable issues. We handle the whole process at competitive rates.
