Does My Small Business Need Cyber Essentials? A Practical UK Guide for 2026

Cyber Essentials is a UK Government-backed cyber security certification scheme, overseen by the National Cyber Security Centre (NCSC).

It was created to help organisations protect themselves against some of the most common cyber attacks without expecting every small business to employ a security team or become an expert in cyber security.

These are not particularly exotic security measures. That is rather the point. Cyber Essentials is about getting the fundamentals right consistently.

For many businesses, need is perhaps the wrong first question.

A better question is: would we be comfortable explaining our current cyber security arrangements to an important customer, insurer or prospective business partner?

If the answer is uncertain, Cyber Essentials is a useful place to start.

According to the UK Government's Cyber Security Breaches Survey 2025/2026, 46% of small businesses reported identifying a cyber security breach or attack during the previous 12 months. Among micro businesses the figure was 42%.

That does not mean almost half of small businesses suffered a catastrophic breach. The survey includes a broad range of attacks and attempted attacks. But it makes one point rather clearly: being small does not make a company invisible to cyber criminals.

Automated attacks do not particularly care whether you employ five people or five thousand. If an exposed account, outdated laptop or poorly secured remote-access service can be found, it can be targeted.

Usually, no.

There is no general rule saying that every private company in the UK must hold Cyber Essentials certification.

However, there are circumstances where certification can become commercially important or contractually required. Certain UK public-sector contracts require suppliers to demonstrate appropriate Cyber Essentials controls, particularly where the contract involves personal information, government information or certain technology services.

Outside government, an increasing number of larger organisations also use Cyber Essentials as part of their supplier security requirements. That means a business can suddenly encounter a request to provide a current Cyber Essentials certificate — and that tends to be an inconvenient moment to begin wondering what Cyber Essentials is.

For a small business, we would give it serious consideration if any of the following sound familiar.

• You rely heavily on Microsoft 365, SharePoint, OneDrive, Teams or other cloud platforms.
• Your staff work from home or use laptops outside the office.
• You hold personal, financial, commercial or customer information.
• You have several employees accessing shared systems.
• You work with larger organisations that carry out supplier security checks.
• You intend to bid for public-sector or larger commercial contracts.
• You have customers asking about MFA, encryption, patching, cyber insurance or security policies.
• You simply do not know, with any confidence, whether the basics are already being managed properly.

In that last case, the certification itself is almost secondary. The preparation exercise can be valuable because it forces someone to answer questions that are very easy to ignore during the normal rush of running a business.

There is a common misconception that Cyber Essentials involves buying an expensive security product. It does not. The scheme is mainly concerned with how the technology you already use is configured and managed.

1. Firewalls

Your business should have suitable protection between internal devices and untrusted networks such as the internet. For a traditional office this may include a business firewall or router. For cloud-based environments, responsibility may be divided between your organisation and the cloud provider.

The important point is that access is controlled rather than simply exposed.

2. Secure configuration

New computers and software often arrive configured for convenience rather than maximum security. Unnecessary applications, services, accounts and administrative privileges create additional ways into a system.

Secure configuration is largely about removing what is not required and properly configuring what remains.

3. Security updates

Supported software must be kept updated. Under the current Cyber Essentials requirements, relevant high-risk or critical vulnerability fixes generally need to be applied within 14 days of release.

Unsupported software presents an obvious difficulty because, once a vendor stops fixing vulnerabilities, there may be nothing sensible left to install when the next security problem appears. This is one reason ageing PCs and forgotten applications so often surface during Cyber Essentials preparation.

4. User access control

Not everybody needs to be an administrator. Indeed, most people should not be. Employees should have individual accounts, appropriate permissions and access only to the systems required for their role.

Administrator access should be treated rather differently from an everyday user account. This is also where properly configured authentication and multi-factor authentication become particularly important.

5. Malware protection

Devices must have appropriate protection against malicious software. Depending on the environment, this can involve anti-malware technology, application controls and other supported approaches.

Again, the principle is not particularly glamorous. It is simply much better to stop malicious software before it becomes an incident.

Microsoft secures Microsoft's infrastructure.

Your business is still responsible for a considerable part of how your Microsoft 365 environment is used. That distinction matters.

Microsoft can operate a highly secure cloud platform while your organisation simultaneously has:

• weak user accounts
• unnecessary administrator permissions
• poorly configured MFA
• old laptops
• unmanaged devices
• former employees who still have access
• outdated third-party applications
• unsafe sharing practices

Cyber Essentials therefore includes cloud services within its scope and uses a shared-responsibility approach depending on the type of cloud service involved. Moving something to the cloud does not transfer every security responsibility to the cloud provider.

If Microsoft 365 is central to your business, our Microsoft 365 service focuses on exactly these practical areas: identity, MFA, devices, permissions, sharing and secure day-to-day management.

This causes rather more confusion than it ought to.

Both certifications are based on the same five technical controls. The difference is how those controls are verified.

In simple terms: Cyber Essentials asks you to demonstrate that the controls are in place. Cyber Essentials Plus technically tests them.

For businesses dealing with more demanding customers, contracts or supply chains, the additional assurance of Plus can be valuable.

The official Cyber Essentials assessment fee is based on the number of employees in the organisation.

Cyber Essentials Plus is priced separately because the cost depends on the size and complexity of the environment being audited.

There is, however, an important distinction between the certification fee and the cost of becoming ready for certification.

If everything is already properly managed, preparation may be relatively straightforward. If the review uncovers unsupported computers, old software, unmanaged personal devices, excessive administrator permissions or poorly configured Microsoft 365 accounts, those issues will need dealing with.

In our view, that should not be seen as money being spent merely to pass an assessment. Those are precisely the weaknesses you would want to discover anyway.

For a well-managed small business, it should not be frightening. But it does require somebody to understand the environment properly.

You need to know what devices are in use, which operating systems and applications they run, how users authenticate, which cloud services are used, what internet-facing equipment exists and whether software remains supported and updated.

This is where businesses sometimes discover that their IT environment is not quite as simple as everybody thought. There may be an old laptop in a cupboard. A director may use a personal computer at home. A former employee's account might still exist. Perhaps a router was installed five years ago and nobody remembers the login. Or several employees may quietly have administrator privileges because it once made installing a printer easier.

None of these is terribly unusual. Cyber Essentials simply has a habit of bringing them into the daylight.

A Cyber Essentials certificate is valid for 12 months from the date of issue.

Certification should therefore be thought of as an annual health check rather than a one-off badge. Technology changes. People join and leave. Computers are replaced. New software appears. Security standards evolve.

A company that was secure two years ago is not automatically secure today.

No. And any company suggesting otherwise should be treated with a little caution.

Cyber Essentials establishes a strong baseline against common cyber threats. It does not certify that a business is immune from every possible cyber attack. That is not a weakness in the scheme.

A proper front-door lock does not make a building impossible to burgle either. It simply removes a very obvious route inside. Good cyber security works in much the same way: remove the easy opportunities first, then build additional protection according to the risks faced by the business.

Apart from improving security, certification can help demonstrate to customers and suppliers that your organisation takes cyber security seriously. It can also make supplier questionnaires and tender responses rather easier because you have recognised evidence that a baseline standard has been independently assessed.

There is another useful benefit for eligible businesses. According to the NCSC, UK organisations with turnover below £20 million that achieve certification covering their whole organisation are automatically entitled to cyber liability insurance arranged through IASME, subject to the scheme's applicable terms and eligibility conditions.

For many small businesses, that makes the overall proposition considerably more interesting than merely acquiring another certificate for the wall.

Quite possibly.

In fact, very small companies can have more reason to establish a sensible baseline because they usually do not have an internal security team watching over everything.

The Government's latest survey found that the proportion of micro businesses using an external cyber security provider increased from 39% to 44%, while small businesses were also considerably more likely than micro businesses to seek outside IT or cyber security advice.

That reflects reality rather well. A ten-person construction company, accountancy practice or engineering firm does not need its own cyber security department. It does need somebody making sure that the essentials are being done properly. There is quite a difference.

Do not begin by buying the certificate. Begin by understanding the environment.

Once those questions have proper answers, the certification exercise becomes much more straightforward. More importantly, you will understand the security of the business rather than merely possessing a certificate.

Cyber Essentials makes most sense when it is treated as an outcome of good IT management, rather than an annual paperwork exercise.

If your devices are supported, updates are managed, Microsoft 365 is properly configured, users have sensible permissions, MFA is in place and somebody knows exactly what technology the business is using, much of the hard work is already being done.

If those things are unclear, that is useful information too. You have found the gap before somebody else did.

At Liugo, we help small UK businesses review their existing IT environment, identify gaps against Cyber Essentials requirements and put the technical foundations in place before independent certification.

We position this as Cyber Essentials Readiness: practical review and remediation, not a claim that Liugo itself issues the certificate.

No unnecessary enterprise complexity. No security theatre. Just practical improvements appropriate to the size of the business. If you are unsure whether your company is already close to Cyber Essentials — or whether certification would actually benefit you — start with a conversation rather than a purchase.

You can also see how this fits into our wider cyber security and backup approach for small businesses.