Cyber Essentials is a UK government-backed certification that proves your business has the fundamentals of cyber hygiene in place. It is short, achievable, and increasingly required to win business — especially in public-sector supply chains.
The five technical controls
- Boundary firewalls and internet gateways — configured and documented.
- Secure configuration — no default passwords, unnecessary services disabled.
- User access control — least privilege, MFA on admin accounts, joiners/movers/leavers process.
- Malware protection — supported endpoint protection everywhere.
- Patch management — critical security patches within 14 days.
Cyber Essentials vs Cyber Essentials Plus
Cyber Essentials is a self-assessment questionnaire, verified by an accredited certification body. Cyber Essentials Plus requires an independent technical audit — including internal vulnerability scans and external penetration testing of your public-facing systems.
Typical cost
- Cyber Essentials (self-assessed): £320–£500 depending on business size.
- Cyber Essentials Plus (audited): £1,500–£3,500 for a 10–50 user business.
- Add remediation time to reach the required baseline — usually 20–40 hours for a first-time applicant.
Where SMEs most often fail on first pass
- Old Windows or macOS versions still in use beyond vendor support.
- MFA not universally enabled on Microsoft 365.
- Admin accounts used for day-to-day work.
- Router or firewall running on default credentials.
- No documented joiners/movers/leavers process.
Atom IP prepares UK SMEs for Cyber Essentials and Cyber Essentials Plus. Fixed-fee remediation and audit support.
Atom IP delivers Managed IT Support across the UK. Book a free technology review and we’ll come back with practical, jargon-free findings.
