Get Cyber Essentials certification for your small business

This guide is for owners and office managers of small UK businesses and charities who need Cyber Essentials to win a contract, satisfy a client or insurer, or simply stop the commonest attacks. Many businesses fail first time, or pay a consultant to rush them through, because they scope it wrongly, forget a cloud service or a staff member's own phone, or answer the questionnaire optimistically. You will decide what is in scope, build an inventory, fix the five technical controls the scheme checks, choose a certification body and submit an assessment you can stand behind. At the end you will have a certificate, an inventory and a monthly routine that keeps you compliant until renewal.

What is inside

• Full step-by-step method8 detailed steps with decision points
• Ready-to-use templatesDevice and service inventory · Staff notice on MFA and personal devices · Email briefing your IT supplier
• Timed action plan7 stages from “Week 1” to “10 months later”
• Costly mistakes to avoid4 traps and what to do instead
• Complete checklist12 items to tick off
• Insider tips and fixes4 tips and 4 common problems solved

Step by step

1. Decide why you need it and which level

   Ask the client, tender or insurer exactly what they require: Cyber Essentials (a verified self-assessment), Cyber Essentials Plus (the same controls plus hands-on technical testing by an assessor), and by what date. Many central government contracts that involve handling personal information or providing certain technical services require at least Cyber Essentials, so check the wording in the tender documents rather than guessing. If you only need the basic level, do that first; Plus is built on top of a current basic certificate and has to be completed within a set period after it, so check that window with your certification body before planning. Note that the scheme's requirements were updated from late April 2026, with stricter expectations on multi-factor authentication, patching and scope; make sure every guide or checklist you use refers to the current version. Write down your target certification date and work back from it.