Cyber Essentials for a startup: what to do in the first 90 days

Cyber Essentials is the UK government backed scheme built on five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. A startup can use 90 days to define scope, inventory devices and accounts, fix gaps against each control, then take the assessment.

What is the scheme?

The NCSC describes Cyber Essentials as the minimum standard of cyber security recommended by the Government for organisations of all sizes, aligned to five controls designed to prevent the most common internet based attacks. It is delivered through IASME, the NCSC's Delivery Partner, and a growing number of organisations require suppliers to be certified to bid for work.

There are two levels. Cyber Essentials is a combination of self-assessment and independent audit, and the NCSC says pricing starts at 320 pounds plus VAT, scaled by organisation size. Cyber Essentials Plus covers the same five controls but adds independent technical testing, and is priced by the size and complexity of your network. Confirm current prices with IASME before you budget.

What are the two routes?

You can go self-led, registering through IASME, paying, and completing a verified self-assessment that a board member or equivalent signs off and an assessor marks. Or you can go supported, hiring a Certification Body licensed by IASME to help you understand the questions. The NCSC also offers a free readiness tool and free downloads of the question set.

How do the 90 days break down?

Days 1 to 30: scope and inventory. Decide the scope. The NCSC notes that cyber liability insurance for UK organisations under 20 million pounds turnover applies when certification covers the whole organisation, so scope broadly if that matters to you. List every laptop, phone, server, cloud service and network device, and who uses each. Use the free question set to see what you will be asked.

Days 31 to 60: fix against the five controls. The NCSC's Requirements for IT Infrastructure (version 3.3, April 2026) sets the detail. In summary:

• Firewalls: protect every in-scope device with a correctly configured firewall, either a boundary firewall or a software firewall on the device. Change default administrative passwords, keep the firewall's admin interface off the internet unless clearly needed, and document and approve inbound rules.
• Secure configuration: remove or disable accounts and software you do not use, and disable auto-run features that execute files without user action.
• Security updates: all software must be licensed and supported, and unsupported software must be removed or kept offline. Updates that fix critical or high risk issues, meaning a CVSS v3 score of 7 or above or a vendor rating of critical or high, must be installed within 14 days of release.
• User access control: create and approve accounts through a process, use unique credentials, remove accounts that are no longer needed, use MFA where available (always for cloud services), and keep separate accounts for administrative work.
• Malware protection: the document sets options, such as anti-malware software or application allow listing, so choose one that fits each device type and read its conditions.

Days 61 to 90: assess and submit. Do an internal read through of the question set against your inventory. Have the board member who will sign read the answers. Then register and submit, or work with a Certification Body.

Which controls trip startups up?

Personal devices and cloud accounts are the usual scope surprises. If staff use their own phones to reach company email, those phones are in play. Software that is no longer supported is the other common gap, since the update control asks for it to be removed or kept offline.

What does a certificate not do?

It shows five basic controls were assessed. It does not cover application security, secure development or your customers' own requirements. Treat it as a floor.

What to do

1. Pick a level and a route, and book time for the sign-off owner.
2. Download the question set and the requirements document.
3. Build the device, account and cloud service inventory.
4. Close gaps control by control, starting with updates and accounts.
5. Remove unsupported software or replace it.
6. Complete an internal review, then submit.
7. Set a renewal reminder, since the certificate needs to be kept current.

Quick check

Sources

• NCSC: Cyber Essentials overview, fetched 18 October 2026
• NCSC: Cyber Essentials Requirements for IT Infrastructure v3.3 (PDF), fetched 18 October 2026

Last reviewed: 18 October 2026.