Cyber Essentials: a practical starting point for SMEs

Why Cyber Essentials matters now

More clients, insurers and public-sector tenders ask for Cyber Essentials. For most SMEs the controls are achievable without a six-figure security budget — but "achievable" doesn't mean "already done."

We see the same gaps repeatedly: no MFA on email, local admin rights on every laptop, backups that nobody's tested, and firewalls still on factory settings from 2019.

Cyber Essentials gives you a clear checklist against five themes: firewalls, secure configuration, access control, malware protection and patch management. It's not perfect security, but it's a defensible baseline that proves you take the basics seriously.

What certification actually involves

You'll complete a self-assessment questionnaire (we help you answer it honestly), then an external body verifies your answers. Most SMEs certify at Cyber Essentials level first; Cyber Essentials Plus adds hands-on technical testing if a client specifically requires it.

Common work before you pass:

• Enabling MFA on Microsoft 365 or Google Workspace
• Removing unnecessary admin accounts and local administrator rights
• Documenting who can access what
• Confirming automatic updates are enabled and backups run daily

How we help clients through it

We start with a readiness review — usually half a day of looking at your estate against the five control areas. You get a plain-English gap list, not a 40-page PDF nobody reads.

Then we close the gaps in a sensible order: email MFA first, then patching and backups, then the documentation insurers expect. We can support you through submission and keep controls maintained so you're not re-scrambling before renewal.

Ask us about a readiness review if a contract or insurer is asking for certification this quarter.