Cyber Essentials is a UK certification scheme developed by the NCSC around five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. For a startup founder it is worth doing if UK buyers or tenders ask for it, and it is one of the lighter ways to show a baseline.
What are the five controls?
The NCSC describes them as follows: firewalls create a security filter between the internet and your network; secure configuration sets up computers to minimise ways in; security update management prevents attackers using known software vulnerabilities; user access control limits who can reach data and services and at what level; malware protection identifies and stops malicious software.
For a cloud-first startup these apply to laptops, phones, cloud services and any office network, not only servers.
Who asks for it?
The NCSC says a growing number of organisations require suppliers to be certified to bid for work. That is the signal to look for. If a UK public sector or large enterprise prospect lists it in a tender or supplier form, it is a sales item. If nobody asks, you can still use the five controls as a free self-check.
What are the two levels?
Cyber Essentials combines a self-assessment with independent verification. Cyber Essentials Plus covers the same five controls but adds independent technical testing of your systems. The NCSC calls the second the higher assurance option. Choose Plus only if a buyer asks for it or your team wants proof the controls work in practice.
How do you get certified?
Two routes are offered. In the self-led route you register through the NCSC's delivery partner, IASME, complete the assessment, and a board member or equivalent signs off the answers before an assessor marks them. In the supported route a licensed certification body helps you understand the questions. A founder is usually the sign-off person, so read what you sign.
What are the founder decisions?
Scope: a small company can often certify the whole organisation, and the NCSC notes UK organisations with turnover under 20 million pounds that certify their whole organisation are automatically entitled to cyber liability insurance arranged by IASME. Check current terms on the NCSC page, because offers change.
Devices: decide whether personal devices are allowed. Unmanaged phones and laptops are the usual stumbling block.
Cloud services: the scheme covers cloud services you use, so know which ones hold company data and whether multi-factor authentication is on.
What does it not cover?
It is a baseline, not a full security program. It does not replace a risk assessment, secure development practices or a customer-facing security review. Describe the certificate for what it is: independent verification of five basic controls, at a defined date.
How to check or apply this
- Ask sales whether any buyer requires it and which level.
- Inventory laptops, phones and cloud accounts.
- Check each against the five controls, including multi-factor sign-in and automatic updates.
- Download the free question set and answer it internally first.
- Choose self-led or supported, and book a board-level sign-off.
- Diarise recertification, since the certificate is time limited.
A constructed example
A twelve person software company works remotely on a mix of company laptops and two personal phones used for email. Walking the five controls: the home routers are out of scope for a cloud-only setup but the laptops' built-in firewalls are checked; secure configuration finds two laptops still using default admin accounts; update management finds one laptop six months behind on operating system patches; access control finds a former contractor with an active shared drive account; malware protection is fine. The fixes are an afternoon of work each. The personal phones become the real discussion, because unmanaged devices that read company email need either enrolment or a policy change. That short list of findings is exactly why the self-check is useful even before a certificate is on the table.
Quick check
Is Cyber Essentials Plus a bigger version of the same checks?
It assesses the same five controls but adds independent technical testing of your systems.
Can I do it without hiring a consultant?
Yes. The self-led route lets you complete the assessment yourself, with sign-off by a board member or equivalent.
Sources
Last reviewed: 18 October 2026.
