A plain-English guide for business owners, directors and leaders
Cyber attacks aren’t just a problem for big corporations. According to the UK government’s latest Cyber Security Breaches Survey (April 2026), 43% of UK businesses, roughly 612,000 organisations, identified a cyber attack or breach in the last 12 months, with an estimated 5.19 million cyber crimes committed against UK businesses over the year.
Most of these attacks are opportunistic: criminals scanning for easy targets with weak defences. The good news? A small set of practical controls stops the vast majority of them.
That’s exactly what Cyber Essentials delivers, and the evidence behind it is compelling. Government data shows that organisations with Cyber Essentials controls in place make 92% fewer cyber insurance claims than those without.
What is Cyber Essentials Certification?
Cyber Essentials is a UK government-backed certification scheme, overseen by the National Cyber Security Centre (NCSC), that sets out the baseline security controls every organisation should have in place. It’s not about expensive technology or complex jargon, it’s about getting the fundamentals right, consistently.
And those fundamentals work. The government’s official impact evaluation found that the five Cyber Essentials controls mitigate 99% of internet-originating vulnerabilities when properly implemented.
For many businesses, certification is also a commercial requirement. It’s mandatory for government contracts involving personal or financial data, and more than a third of surveyed organisations now make Cyber Essentials a compulsory requirement for their suppliers. If you’re in anyone’s supply chain, expect to be asked for it.
The five pillars, explained in plain English
1. Firewalls and internet gateways
Think of this as your business’s front door and gate. A correctly configured firewall blocks unwanted visitors from the internet and stops attackers reaching your internal systems before they even get started.
2. Secure configuration
Devices and software should be set up securely from day one. Remove or switch off anything you don’t need, and change default passwords. Fewer unnecessary features mean fewer ways in for attackers.
3. User access control
Only give people the access they need to do their job. If someone doesn’t need to see sensitive data, they shouldn’t be able to. This limits the damage if an account is ever compromised.
4. Malware protection
Reputable anti-malware tools detect and stop viruses, ransomware and other malicious software before they can compromise the integrity and confidentiality of your data.
5. Patch management
Keep operating systems and applications up to date. Patches fix known security holes. Leaving them unpatched is like leaving your windows open for burglars. Regular updates close those gaps. With phishing now affecting 38% of UK businesses, and rated the most disruptive attack type by 69% of those hit, closing off the easy routes in has never mattered more.
What Cyber Essentials means for your business
Lower risk of common attacks. These five controls stop the majority of basic, opportunistic attacks, the kind most businesses actually face. The 92% reduction in insurance claims among certified organisations speaks for itself.
Stronger customer and partner confidence. Certification demonstrates you take security seriously. It’s required for many government contracts and increasingly demanded across private-sector supply chains, including by leading UK banks.
Practical, measurable steps. These aren’t theoretical principles, they’re concrete actions you can assign, track and audit. In the government’s evaluation, 85% of certified organisations reported a better understanding of cyber risks after going through the process.
Free cyber insurance. Certification includes free cyber liability insurance for organisations with a turnover under £20 million.
The honest picture: what Cyber Essentials isn’t
Cyber Essentials is not a silver bullet. It reduces common risks significantly, but it won’t protect against highly targeted or sophisticated attacks on its own.
Just as importantly, it’s not a one-off exercise. Controls that were compliant in January can drift out of date by June. Certification is annual, and the scheme itself evolves. The latest requirements (version 3.3, effective from April 2026) tightened the rules around cloud services, remote and BYOD devices, and what can be excluded from scope. Staying compliant means staying current.
Key questions for your leadership team
Before you start, it’s worth answering two questions:
- Do we need certification to win contracts or reassure customers? If yes, make it a priority, it’s often the deciding factor in tenders.
- Can we implement this in-house, or do we need external help? Certification requires proper configuration, evidence and ongoing upkeep. Getting it wrong means failed assessments and wasted time.
Whoever leads it, ownership matters, and this is where many businesses fall down. Government figures show only 31% of UK businesses assign board-level responsibility for cyber security, and just 25% have a formal incident response plan. Cyber Essentials needs to sit with an owner or director, not be delegated into a corner and forgotten.
How PC Comms helps
As an MSP and IASME Cyber Essentials Certified Practitioner, PC Comms helps organisations not just achieve certification, but build a stronger long-term security posture around it.
We assess your current environment, identify the gaps, implement the necessary controls, and guide you through the certification process from start to finish. Then our managed services approach makes Cyber Essentials part of your ongoing security strategy rather than a once-a-year scramble, with proactive monitoring, patch management, endpoint protection, user access management and regular best-practice reviews.
By partnering with PC Comms, your business benefits from:
- Expert guidance from IASME Cyber Essentials Certified Practitioners
- Faster, smoother certification with a reduced administrative burden
- Improved protection against common cyber attacks, ransomware and data breaches
- Ongoing monitoring and maintenance to support continued compliance
- Increased customer confidence and support for contract and tender requirements
- Access to experienced cyber security professionals, without the cost of building an in-house security team
The bottom line
Cyber Essentials is one of the most cost-effective ways to improve your cyber security baseline. The controls are low-cost compared with the damage a single breach can cause, the evidence shows they work, and the certification opens commercial doors that would otherwise stay shut.
With PC Comms managing the process and supporting your wider IT and security strategy, you gain both the certificate on the wall and a genuinely stronger, more resilient business behind it.
Ready to strengthen your cyber security?
Contact PC Comms today for a Cyber Essentials readiness assessment and discover how our IASME-certified experts can protect your business while taking the hassle out of certification.
Frequently asked questions
How much does Cyber Essentials certification cost?
Certification is tiered by organisation size, starting from £320 + VAT for micro-organisations (0–9 employees). Compared with the cost of a breach, and the contracts certification can unlock, it’s one of the most cost-effective security investments available.
How long does Cyber Essentials certification last?
Certification is valid for 12 months and must be renewed annually. The technical controls should be maintained continuously, not just at renewal time.
What’s the difference between Cyber Essentials and Cyber Essentials Plus?
Cyber Essentials is a verified self-assessment reviewed by a qualified assessor. Cyber Essentials Plus covers the same technical requirements but adds an independent hands-on technical audit of your systems, providing a higher level of assurance.
Do we need Cyber Essentials to bid for government contracts?
Yes, an up-to-date certificate is required to bid for government contracts involving the handling of financial or personal data, and it’s increasingly required in private-sector supply chains too.
Does Cyber Essentials cover home workers and personal devices?
Yes. Under the current requirements, corporate and BYOD devices used for business, including home and remote working devices, are in scope, along with cloud services that host your data.
