Cyber Essentials in plain English

Cyber Essentials is a UK government-backed scheme that checks five basic technical controls. It is deliberately simple: firewalls, secure configuration, security updates, user access control and malware protection. If you can show each one is in place across the devices and cloud services your staff use, you can certify.

The most common stumbling block is scope. Everything your people use for work counts, including personal laptops used from home and the accounting package nobody thinks of as IT. Write the list down first; the assessment questions become much easier once you know what you are describing.

The second stumbling block is evidence. Assessors ask how you know a control is in place, not whether you believe it is. A dated register of your cloud services, showing who has administrative access and whether multi-factor authentication is enforced, answers most of those questions in one go.

Treat the first certification as a tidy-up rather than a project. Most small firms find that switching on multi-factor authentication, removing dormant accounts and enabling automatic updates covers the bulk of the work.