CISA Cyber Essentials organizes basic security into six elements: yourself, your staff, your systems, your surroundings, your data and your crisis response. It is written for small businesses and small local governments, so it suits schools, nonprofits and any team without a security department.
Why this framework suits a small team
Longer frameworks assume an owner for each control. A ten person organization does not have one. Cyber Essentials gives leaders six plain topics and a short action under each, which fits in one meeting.
CISA frames it as a culture of cyber readiness, not a purchase list. Several of the actions cost nothing but attention.
The six elements in plain words
Yourself (leaders). Leaders drive strategy and investment. The action named is to lead investment in basic cybersecurity. In practice: someone with authority owns the topic and gets a small, protected budget.
Your staff. Awareness and vigilance, including phishing and business email compromise. Staff and volunteers should know how to spot and report a suspicious message.
Your systems. Protect critical assets. CISA says to leverage automatic updates for all operating systems and third party software, and to use application allow listing so only approved software runs. Allow listing is the hardest part for a small team, so do updates first.
Your surroundings. Who can get in. Use unique passwords for all accounts, multi factor authentication for all users starting with privileged, administrative and remote access users, and grant access and admin permissions on need to know and least privilege.
Your data. Establish regular automated backups and redundancies of key systems, and protect backups with physical security, encryption and offline copies.
Your crisis response. Leaders should lead development of an incident response and disaster recovery plan, and test it often.
A one hour first pass
Print the six headings. For each one, write one sentence on where you stand today and one thing to change this quarter.
A typical small organization ends up with something like this: name an owner (yourself), add reporting instructions for phishing (staff), switch on automatic updates (systems), turn on multi factor for admins and review who has admin (surroundings), do a test restore (data), print a one page contact plan (crisis).
Review the list every quarter. Cross off what is done, add one new item, and keep the list short.
How it connects to other guidance
If you want a more detailed checklist, the CIS Controls and the NIST Cybersecurity Framework go deeper. Cyber Essentials is the on ramp. Our posts on CIS Controls IG1 for small organizations and a 90 day plan for a nonprofit show how to go further.
Quick check
Who is Cyber Essentials written for?
CISA's starter kit describes it as a guide for small business and small or local government leaders to understand where to start with organizational cybersecurity.
Which element covers multi factor authentication?
Your surroundings. It recommends multi factor for all users, starting with privileged, administrative and remote access users.
If your organization builds software, Safeguard's free scan at gold.safeguard.sh/scan covers dependency risk, which sits under the systems element.
Sources
- CISA Cyber Essentials
- Cyber Essentials Starter Kit, CISA (archived page)
Last reviewed: 19 October 2026.
