Cyber Essentials for small businesses: the five controls in plain English
Cyber Essentials is the government-backed minimum standard for cyber security. More and more public-sector and larger private buyers ask their suppliers for it. Here's what it actually asks of a small business.
Cost and routes
Cyber Essentials (a verified self-assessment) costs £320 + VAT for organisations with 0–9 employees, £440 for 10–49, £500 for 50–249, and £600 for 250 or more (IASME). Cyber Essentials Plus adds hands-on technical testing and is priced by quote.
The five controls
1. Firewalls
Every device connected to the internet sits behind a firewall, whether that's in your router or software firewalls on laptops. Change default admin passwords, and close any ports you don't need.
2. Secure configuration
Remove software and accounts you don't use, turn off auto-run, and require a PIN or password to unlock devices.
3. Security update management
Use supported software only. Apply high-risk or critical updates within 14 days. Software that's past end-of-life, such as old Windows versions, fails this control.
4. User access control
Everyone has their own account. Admin rights are used only for admin tasks. Multi-factor authentication is on for cloud services.
5. Malware protection
Anti-malware is on and kept up to date, or applications are restricted to an approved list.
How to prepare
- List all the devices and cloud services in scope
- Check that every device runs supported software
- Turn on MFA everywhere
- Read the current question set on the IASME site before you start
LanternCheck's readiness report walks you through this. We aren't a Certification Body.
Sources
Is your email set up to be trusted?
Free, passive and no sign-up. About ten seconds.