Cyber Essentials is one of those government schemes that sounds like a box ticking exercise until a client asks for the certificate and you do not have one. My honest view is that the scheme is sensible but the way it lands on small suppliers is not. If you sell software or services to the public sector, or to anyone who sells to it, you need to understand it.
This is the plain English version, with the policy angle that nobody else seems to want to talk about.
What Cyber Essentials actually is
Cyber Essentials is a UK government backed scheme run through the National Cyber Security Centre. It sets out five basic technical controls: firewalls, secure configuration, user access control, malware protection and security updates. You answer a detailed questionnaire, a certification body marks it, and you get a certificate that lasts twelve months.
There is also Cyber Essentials Plus, where an assessor actually tests your systems rather than just reading your answers. Most small firms start with the basic version, and for most contracts that is enough.
Why it keeps turning up in tenders
Central government contracts that involve handling personal data or certain technical services require it, and the habit has spread. Councils, housing associations, universities and large corporates now ask for it as a standard supplier question. It turns up on tenders that have nothing to do with sensitive data, because someone copied the template.
What it costs a small business
The certification fee for a micro business is modest, a few hundred pounds at the time of writing, and it rises with company size. That is not the real cost. The real cost is your time and whatever you need to fix before you can answer the questions honestly.
If you run a tidy setup it takes a day or two. If you have old laptops, shared logins and a router nobody has updated since 2019, it takes longer and it will be uncomfortable. That discomfort is useful, though, and I will come back to it.
The hidden costs people miss
Multi factor authentication on every cloud service is required, and that includes the boring ones you forgot you had. Unsupported operating systems have to go. Any device that touches company data is in scope, which includes your personal phone if you read work email on it.
For a one person company that is easy enough. For a team of fifteen with a mix of home working and personal devices, it is a proper project.
Where the policy goes wrong
Here is my gripe. The scheme is cheap to run for the government and it is a genuine improvement for security, so I understand why it spreads. But a requirement that is trivial for a ten million pound IT services firm with a compliance team is a real tax on a two person company bidding for its first public sector contract.
I wrote before about how government IT procurement shuts out small suppliers, and this is another layer of the same problem. Each requirement is reasonable on its own. Stack them up and a small business spends weeks on paperwork before it has earned a penny.
The government says it wants more small businesses winning public contracts. Then it adds one more certificate to the pile. Both things cannot be a priority at once, and the certificate usually wins.
Is Cyber Essentials worth getting?
Yes, with one caveat. If you sell to any organisation of a decent size, you will be asked for it sooner or later, and having the certificate ready removes a blocker from every sales conversation. It also tells a nervous buyer that you take security seriously, which matters when you are the small supplier they have never heard of.
The caveat is that the certificate is not security. Plenty of businesses pass the questionnaire and still have terrible habits, like passwords in spreadsheets and a former contractor who still has access to the production database. Treat the scheme as a floor, not a finish line.
How to get through it without losing a week
Start with an honest inventory of every device and every cloud account that touches company data. Turn on multi factor authentication everywhere, remove old users, and retire anything that no longer gets security updates. Only then should you open the questionnaire.
Answer it yourself rather than paying a consultant to do it for you. You learn more, and you will need to repeat the process every year. If you build software, it is worth tying this into your wider habits, the same way I approach CI/CD pipelines for small teams, so security is part of how you work rather than a yearly scramble.
What I would change
I would like to see a lighter route for the smallest suppliers, with the certificate accepted across all public bodies so nobody has to repeat the process for every buyer. I would also like procurement teams to stop adding it as a default question when the contract does not need it. That alone would save a lot of wasted effort.
Until that happens, treat it as a cost of doing business and get ahead of it. If you want help with the technical side, or you are weighing up whether public sector work makes sense for your company, have a look at my consulting services or get in touch.
