Is Cyber Essentials worth it for a small business?

It is a fair question, because certification is an expense of time and money with no visible return until something happens. The honest answer depends on what your business sells. If you bid for contracts — especially with larger companies, councils or the public sector — the certificate usually pays for itself the first time it keeps you in a bid.

The clearest signal is a question in a tender or security questionnaire. When a buyer asks whether you are Cyber Essentials certified, 'no' ends the conversation and 'here is our certificate' continues it. Firms that wait until they are asked usually end up rushing, and rushing is where submissions fail.

There are quieter returns too. The five controls — firewalls, secure configuration, security updates, access control and malware protection — close the common ways small businesses actually get breached: phishing, stolen passwords and unpatched software. Several insurers offer better terms to certified firms, and some cyber insurance policies ask for the certificate outright.

When is it not worth it? If you sell directly to consumers, hold almost no client data, and no customer has ever asked about security, the certificate may be a nice-to-have rather than a necessity. Even then, the tidy-up it forces — individual accounts, multi-factor authentication, supported software — is worth doing on its own merits.

Cost is the other half of the question. The assessment fee is banded by organisation size, and the real cost is your preparation time. Firms that keep a dated register of cloud services and re-check their controls monthly find renewal takes an afternoon; firms that start from memory every twelve months pay for it in stress and consultant hours.

The cheapest way to find out where you stand is to measure before you spend. Kept's free readiness scan shows how your cloud services look against the five controls in about two minutes, and the paid plans — from £29 a month — keep the evidence current so every future assessment is a formality.