Cyber Essentials, without the headache.

It is a UK government-backed certification created by the National Cyber Security Centre. It confirms your business has five fundamental security controls in place — firewalls, secure configuration, user access control, malware protection and keeping software updated. It is deliberately practical: the basics, done properly, rather than a huge compliance programme.

You complete an online self-assessment questionnaire covering the five controls, and an assessor at a certifying body reviews your answers. I am not a certifying body — my job is to get you genuinely ready, help you answer the questionnaire accurately, and support you through submission. The certificate itself is issued by an approved body.

Often yes. I work with businesses of up to about five people and the controls apply just the same — small does not mean out of scope, and attackers are not fussy. It is usually a shorter, simpler job than owners expect, and it settles a lot of customer questions in one go.

You are told exactly what fell short and you get the chance to put it right. That is the whole reason I start with a gap review rather than diving at the questionnaire — the point is to find the problems while they are still easy and private to fix. I cannot promise an outcome, but surprises are rare when the groundwork is done.

Certification under the scheme can include a level of cyber liability insurance for eligible UK organisations, but eligibility and terms are set by the certifying body and can change. I would not treat it as a reason to certify — I will point you at the current terms so you can check whether you qualify.

There are two levels. Cyber Essentials is a verified self-assessment: you answer the questionnaire, a qualified assessor checks your answers, and you certify. Cyber Essentials Plus covers exactly the same five controls but adds a hands-on technical audit — an assessor tests a sample of your devices and your email and browser protections to prove the controls really are in place. You have to hold Cyber Essentials first, and the Plus audit has to be completed within three months of it. For most businesses of up to five people, plain Cyber Essentials is what customers ask for; Plus is worth doing when a contract or framework specifically names it.

Two parts. The certifying body’s assessment fee is set by IASME and tiered by organisation size — for a micro business of up to nine people it currently starts at £320 plus VAT, and I always show it to you at cost with no mark-up. Then there is my fee for the gap review, fixing what turns up and walking you through the questionnaire, which I quote once I have seen your setup, because a two-laptop business with Microsoft 365 already set up properly is a very different job from one with an old server in the corner. Cyber Essentials Plus is priced separately by the certification body.

It depends on what the gap review finds. A small business already on Microsoft 365 with modern, updated laptops and multi-factor authentication switched on can go from first conversation to a submitted questionnaire in a couple of weeks, and assessors typically come back within a few working days. The questionnaire itself is an hour or two sat together. What stretches it out is old kit — a laptop still on an unsupported version of Windows, a router nobody has logged into for years — because that has to be fixed or replaced before you can honestly answer yes.

Yes — the questionnaire is designed to be completed by the business itself, and if you are technically confident you can. Where people get stuck is knowing what a question actually means in practice (what counts as “in scope”, what a sufficiently strong password policy looks like, whether your phones count) and then doing the fixes. That is the bit I do, so you answer accurately first time rather than getting sent back.

Yes. The certificate lasts twelve months, and recertification is a fresh self-assessment against whatever the current question set is — the scheme is updated periodically, so a few questions usually change from one year to the next. Because I look after your setup through the year, renewal is normally a short check-in rather than starting from scratch, and I put the date in the diary so it does not lapse and catch you out in the middle of a tender.

Every current certificate is listed on the public register run by IASME on behalf of the NCSC, searchable by company name. It is worth knowing about for two reasons: you can check a supplier who claims to be certified, and once you certify, your customers can check you the same way — which is often exactly what their procurement team does.