Twelve weeks is enough for a small organisation to prepare for Cyber Essentials if you scope in week one, fix the five technical controls in weeks two to eight, and keep weeks nine to twelve for evidence, board sign off and submission. The 12 week split is our planning suggestion, not a requirement of the scheme.
What is Cyber Essentials?
It is a UK scheme run with the National Cyber Security Centre (NCSC) and delivered through IASME. It checks five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. As of the NCSC page we fetched on 18 October 2026, Cyber Essentials uses a self assessment with independent marking, while Cyber Essentials Plus adds independent technical testing. The page listed Cyber Essentials from 320 pounds plus VAT, tiered by organisation size. Confirm current prices and the validity period of the certificate on the official pages, because the overview page did not state validity.
The calendar
Weeks 1 and 2: scope and inventory. Decide what is in scope. The NCSC page links certification of the whole organisation to the free cyber liability insurance it mentions, so scoping the whole organisation is worth considering. List every device, including personal devices used for work, every cloud service, and every router or firewall. Read the free question set from IASME and note the questions you cannot yet answer.
Week 3: firewalls. Make sure every site has a boundary firewall or equivalent, change default passwords, close inbound ports you do not need, and write down each rule you keep with the business reason.
Week 4: secure configuration. Remove unused accounts and software, turn off auto run, set a screen lock, and require a password or biometric on every device.
Weeks 5 and 6: update management. Find software that is unsupported and plan its removal. Turn on automatic updates and measure the patch gap. Set a rule for how quickly critical fixes go on, and track against it.
Week 7: user access control. Give every person their own account, restrict administrator rights to people who need them, and require multi factor authentication on cloud services that offer it. Review who holds admin rights.
Week 8: malware protection. Ensure every in scope device has malware protection that is enabled and updating, or use an app store allow list model where that is suitable.
Week 9: dry run. Answer the full question set as if submitting. Every answer should be backed by a screenshot, export or setting you can show.
Week 10: close the gaps. Fix the answers you could not support. Add anything that was forgotten, usually a forgotten laptop or an old cloud tool.
Week 11: board sign off. The NCSC page says a board member or equivalent signs off the self assessment. Walk them through the answers and let them ask questions.
Week 12: submit. Submit through your chosen route, self led through IASME or with a licensed Certification Body. Plan time for assessor questions.
Mistakes to avoid
- Scoping out a department "because they are different." Unlisted devices are where failures hide.
- Treating the answers as marketing. The sign off is a statement by a responsible person.
- Leaving unsupported operating systems for later.
- Forgetting home working devices and mobile phones that read company email.
What to do
- Pick a project owner and a start date, then read the free question set this week.
- Build the device and service inventory in a spreadsheet.
- Work the five controls in the order above and capture evidence as you go.
- Hold the dry run in week nine, and fix gaps before week eleven.
- Choose self led or supported, and book your board member's time.
Quick check
Is Cyber Essentials Plus a separate process?
Yes. It covers the same five controls with independent technical testing added. Many organisations get the basic certification first, then add Plus.
Do we need a consultant?
No. The NCSC page describes a self led route. A licensed Certification Body is the supported alternative.
How Safeguard helps automate this
Cyber Essentials is mostly about devices and settings, so Safeguard covers the software side of it. Safeguard's compliance suite covers frameworks, controls and evidence, with continuous monitoring so patching and configuration evidence is current at submission and afterwards. Technical evidence comes from your code and dependencies: scans and SBOMs show which libraries are out of date or vulnerable. Autonomous remediation can open tested fix pull requests for vulnerable dependencies. It is off by default, every category starts on Manual, and you choose which categories run automatically. Safeguard helps you prepare evidence and does not certify you. The assessor does. Book a call.
Sources
- NCSC, Cyber Essentials overview, fetched 18 October 2026.
Last reviewed: 18 October 2026.
