Cyber Essentials support has become a practical requirement for many London SMEs, not only a technical task. Public sector and corporate buyers increasingly ask suppliers to hold the certificate before awarding work, and a business that cannot answer that question may be excluded before any commercial discussion begins. The scheme is backed by the UK government and administered through the National Cyber Security Centre (NCSC). It focuses on five baseline technical controls. This guide explains what certification requires, how to choose a preparation route, and how to build a compliance plan that fits around normal operations.
Table of Contents
- Quick Takeaways
- What Cyber Essentials Covers
- Why London SMEs Are Asked for It
- Choosing a Certification Route
- Compliance Roadmap: Four Stages
- Evidence and Assessor Preparation
- Keeping Certification Current
- Where an Outsourced IT Department Fits
- Frequently Asked Questions
- References
Quick Takeaways
| Key Insight | Explanation |
|---|---|
| Define the scope first | Certification applies to a clearly defined scope, which may be the whole organisation or a defined part. Settle the list of devices, users and cloud services before any assessment begins. |
| Use the five controls as the work plan | Firewalls, secure configuration, user access control, malware protection and security update management form the full assessment framework. |
| Start with a gap assessment | Compare current settings against each control before buying tools. Gaps tend to cluster in a small number of areas, which sets the order of remediation. |
| Confirm the required certification level | Ask prospective buyers in writing whether they require Cyber Essentials or Cyber Essentials Plus, as the effort involved differs. |
| Keep evidence while you work | Assessors check answers against configured systems. Dated records created during remediation shorten preparation and reduce rework. |
| Plan for annual renewal | Certification is valid for one year. Renewal should be scheduled as a recurring task, not treated as a one-off project. |
What Cyber Essentials Covers
Cyber Essentials is a UK government-backed certification scheme that sets out five technical controls addressing the most common attacks against internet-connected organisations. The assessment checks whether those controls are in place. It does not assess a full information security management system.
The Five Technical Controls
Firewalls restrict traffic between internal systems and the internet, and default router passwords must be changed. Secure configuration removes unused accounts and software and replaces default settings. User access control limits each account to the access its role requires.
Malware protection must be installed, active and current on every device in scope. Security update management requires that software updates are applied promptly. In practice, this is the control where many small firms fall short, because it depends on routine discipline across every laptop and server.
What the Certificate Does Not Cover
Cyber Essentials does not replace a broader security programme, and it does not certify compliance with data protection law. Businesses that process personal data still have obligations under UK GDPR, which the Information Commissioner’s Office oversees. The certificate demonstrates a documented baseline, not complete protection.
Why London SMEs Are Asked for It
For many London SMEs, the first request for certification comes from a procurement team rather than the IT function. Some public sector contracts and corporate supply chains list Cyber Essentials as a condition of tender, so a missing certificate can remove a business from consideration early.
Where the Requirement Usually Appears
Local authorities, NHS bodies, universities and larger private companies are common sources of the requirement. Prime contractors also pass the question down to their suppliers. A business with no direct public sector work may therefore still need the certificate to keep an existing client.
Insurance and Commercial Benefits
Some certified organisations may qualify for cyber liability insurance cover, subject to eligibility criteria set by the scheme and the insurer. Eligibility should be confirmed in writing before a business relies on it. Certification also gives clients a consistent, verifiable answer to security questionnaires.
Pro tip: Ask prospective buyers in writing which certification level their tender requires. The standard and Plus versions involve different preparation effort, and an early answer prevents wasted work.
Choosing a Certification Route
Businesses can pursue Cyber Essentials, which relies on a self-assessment questionnaire checked by an accredited assessor, or Cyber Essentials Plus, which adds an independent technical audit of a sample of devices and systems. Both routes use the same five controls. The choice depends mainly on what buyers require and how much internal capacity the business can commit.
| Approach | Where It Works | Main Risk |
|---|---|---|
| In-house self-assessment | Businesses with one accountable IT lead, a small estate and time to read the requirements closely | Gaps are missed when no one checks answers against the actual configuration of each device |
| External consultant for a one-off certification | Businesses needing a focused assessment before a tender deadline | Controls drift after certification because no one maintains them between renewals |
| Outsourced IT department with ongoing support | Growing firms that need certification and continuous maintenance of the same controls | Requires a service agreement that defines who owns each control and how evidence is kept |
Compliance Roadmap: Four Stages
A workable roadmap runs in four stages, and each stage produces records that the assessor will later review. Compressing the early stages is the most common reason preparation takes longer than planned.
Define the Scope and Asset Inventory
List every device, user account, server and cloud service that connects to business data. Devices missing from the inventory are often the ones that fail a later check.
Run a Gap Assessment
Compare the current state against each of the five controls. Gaps commonly involve legacy accounts, unpatched laptops or default settings, so an early review determines the order of remediation.
Remediate and Document
Apply fixes in order of risk and keep a dated record of each change, including the reason and the person responsible.
Pro tip: Maintain a single asset register that lists each device, its operating system, its owner and its last update date. Assessors ask for this information, and a current register answers most questions quickly.
Evidence and Assessor Preparation
Assessors compare questionnaire answers with evidence, so each answer must match the configured state of the systems. A statement that a firewall is enabled carries less weight than a configuration export or screenshot that shows it.
Gather policy documents, update reports and administrator account lists before submission. Confirm that the answers reflect the systems as they stand on the submission date, not as they were at the start of the project.
Certification is only as reliable as the evidence behind each answer, and records kept during the work are far more persuasive than evidence assembled after the fact.
Keeping Certification Current
Certification lasts for one year, after which the process repeats. Businesses that treat certification as a one-off project often find that controls drift between renewals, particularly update management and account clean-up.
Renewal Planning
Schedule the renewal review several weeks before expiry so that remediation work does not coincide with a live tender deadline. Assign a named owner to the renewal, with a fixed calendar date.
Staff Changes and Access Reviews
Leavers, new starters and role changes all affect user access control. Review administrator rights each quarter and remove access that is no longer required for a role.
Where an Outsourced IT Department Fits
For many London SMEs, the difficulty is not understanding the five controls but maintaining them alongside client work. An outsourced IT department can assign ownership of each control, run monitoring and keep the asset register current throughout the year.
Businesses that want this continuity can review how managed IT support for London businesses is structured and how responsibilities are divided between the client and the provider.
What to Ask a Provider
Ask who owns each control, how update compliance is reported and where evidence is stored. Clear answers to these questions indicate a provider that can support certification over time, rather than only completing it once.
Frequently Asked Questions
How long does Cyber Essentials certification take?
Preparation time depends on the size of the estate and the current state of its controls. A small business with an accurate inventory and modern devices can often complete preparation within a few weeks. Businesses with legacy systems usually need longer.
Is Cyber Essentials a legal requirement for small businesses?
No. Certification is voluntary for most small businesses. Many public sector and corporate contracts, however, list it as a condition of award.
What is the difference between Cyber Essentials and Cyber Essentials Plus?
Both use the same five controls. Cyber Essentials Plus adds an independent technical audit of devices and systems in scope.
Can a business complete Cyber Essentials without outside help?
Yes, but accuracy is the main challenge. Internal teams with limited time often miss settings that differ between devices, which is where most avoidable failures occur.
How often must Cyber Essentials certification be renewed?
Certification is valid for one year. Renewal is required annually to maintain the certificate.
Does Cyber Essentials cover UK GDPR?
No. Cyber Essentials covers baseline technical controls. Data protection obligations under UK GDPR are separate and are overseen by the Information Commissioner’s Office.
We welcome feedback from London business owners on which certification steps have caused the most difficulty in your organisation, so please share your experience in the comments.
We would love your feedback and any insights you would share with others. What perspective would you add?