Cyber Essentials Explained: What UK Businesses Need to Know

Cyber Essentials is a UK government-backed certification scheme that shows your organisation has the basic technical controls in place to defend against the most common cyber attacks. It exists because the majority of breaches come from a handful of preventable weaknesses — and Cyber Essentials makes sure those are covered.

It's increasingly a requirement, not a nice-to-have: many public-sector contracts mandate it, insurers ask about it, and clients use it as a trust signal when choosing suppliers.

The five controls

Cyber Essentials is built around five core technical controls:

• Firewalls — secure your internet connection.
• Secure configuration — set up devices and software safely (no default passwords).
• User access control — give people only the access they need, with strong authentication.
• Malware protection — defend against viruses and malicious software.
• Security update management — keep everything patched and up to date.

Cyber Essentials vs. Cyber Essentials Plus

There are two levels. Cyber Essentials is a verified self-assessment — you complete a questionnaire that's reviewed by a certification body. Cyber Essentials Plus includes the same controls but adds a hands-on technical audit by an assessor, so it carries more weight. Many organisations start with Cyber Essentials and move to Plus as contracts require it.

How much does it cost and how long does it take?

The certification fee for Cyber Essentials is modest (set by the scheme and based on organisation size); Plus costs more because of the audit. The bigger investment is usually getting your controls in order beforehand — which is exactly where a managed IT partner helps. With the right foundations, certification can often be achieved in a matter of weeks.

How to get certified

The practical path is: assess your current setup against the five controls, fix the gaps (MFA, patching, secure configuration, access control), then complete the certification with an approved body. AiVigil helps UK organisations get Cyber Essentials-ready and stay there with ongoing managed IT and security. The starting point is a free readiness assessment.