Cybersecurity
If you run a London-based SMB, you've likely heard that Cyber Essentials certification UK is important—but the path to achieving it often feels mysterious. The good news is that for organisations with 20 to 150 employees, this government-backed scheme is genuinely achievable and doesn't require expensive overhauls or external consultants (though expert guidance certainly helps). This practical guide walks you through exactly what Cyber Essentials demands, how to assess your current position, and the concrete steps to secure your certificate within a realistic timeframe.
Cyber Essentials is a UK government-backed scheme run by IASME (Information Assurance for Small and Medium Enterprises). It's designed to help organisations defend themselves against common cyber threats—the kind that account for the vast majority of breaches affecting SMBs. Unlike more complex compliance frameworks, Cyber Essentials focuses on five core technical controls:
These aren't theoretical concepts—they're the practical defences that stop the majority of cyber-attacks targeting UK businesses. The certification proves to clients, partners, and regulators that your organisation takes cyber risk seriously. For professional services, legal firms, and financial advisers handling sensitive client data, it's increasingly a prerequisite for winning business.
The certification comes in two levels. The self-assessment version allows you to evaluate compliance internally, whilst the formal audit requires an independent assessor to verify your controls. Most SMBs start with self-assessment, then move to full certification when ready.
Before you begin implementing controls, you need to understand where you currently stand. This isn't about identifying every gap at once—it's about creating a baseline and prioritising what matters most.
Start with an honest inventory. Document:
Many SMBs discover they're using systems they'd forgotten about—old laptops with no security updates, shared administrative credentials, or cloud services bought by individual departments. Getting this picture clear is essential before you implement controls.
For each of the five core areas, assess your current state honestly. Do you have a firewall between your internal network and the internet? Is multi-factor authentication enabled on email and administrative accounts? When was the last time you applied security patches across all devices? Document what's in place and what's missing. This isn't a compliance exercise yet—it's understanding your starting position.
Some controls cost very little to implement. Others require investment or significant effort. Your assessment should identify which improvements offer the best return on effort and budget. For example, enforcing strong password policies costs nothing but takes time to communicate and manage. A next-generation firewall might cost money but dramatically improve your boundary defence.
With your assessment complete, implementation becomes systematic. You don't need perfection—Cyber Essentials rewards proportionate, sensible security.
Ensure you have a firewall between your internal network and the internet. This should block inbound traffic by default, allowing only necessary services. If you're using cloud-based applications exclusively, you still need a firewall—it protects against attacks on local devices and outbound threats. Many SMBs use simple hardware firewalls (like those built into broadband routers), which are adequate if properly configured. More sophisticated organisations might use Unified Threat Management (UTM) devices that combine firewall, antivirus, and intrusion detection.
Configure all devices—computers, servers, and network equipment—according to security baselines. This means:
For organisations using Windows across the board, Group Policy Objects (GPOs) allow you to apply consistent security configurations without touching each machine individually. This is efficient and auditable.
Implement the principle of least privilege—users should have access only to what they need. More importantly, enforce strong authentication:
Many SMBs balk at MFA initially, but the friction is genuine and worthwhile. It stops the majority of account compromises.
Deploy antivirus or endpoint detection and response (EDR) tools on all devices. For SMBs, a managed antivirus solution with cloud-based threat intelligence is usually sufficient and cost-effective. Ensure:
Create a documented process for applying patches to operating systems, applications, and firmware. Most organisations benefit from:
This is the control that organisations most often neglect. Set a calendar reminder monthly to check for updates across critical applications and devices.
Once controls are in place, you need evidence. Cyber Essentials auditors want to see:
You don't need elaborate documentation—simple, clear policies that actually reflect what you do are better than complex ones you don't follow. If you use cloud services, document their security features as they contribute to your overall defence.
When you're ready for formal certification, you'll work with an
VP Audit asks 15 questions across 5 security domains and scores your network 0–100 with specific findings. 100% in-browser — no data sent anywhere.
Audit your network →