Cyber Essentials in plain English
8 July 2026 · 6 min read · Optimum IT Solutions
Cyber Essentials comes up more and more, usually because a customer or an insurer has asked for it. Here is what it is, without the jargon.
What it is
Cyber Essentials is a UK government backed scheme, run under the National Cyber Security Centre. It is a baseline. It checks that you have the basic controls in place that stop the large majority of everyday attacks, the ones that go after any business rather than yours specifically.
It is deliberately not complicated. That is the point. Most breaches at small firms do not come from a genius hacker, they come from a missing update or a password nobody changed.
The five things it checks
The whole scheme sits on five basic controls.
- Firewalls: your connection to the internet is protected rather than wide open.
- Secure settings: default passwords and unused features are removed rather than left as the factory left them.
- Access control: people have the access they need and no more, and admin rights are not handed out freely.
- Malware protection: something is actively watching for malicious software on your machines.
- Update management: your software and devices are kept patched, because most attacks use holes that were fixed months ago.
Essentials or Essentials Plus
Standard Cyber Essentials is a verified self assessment. You answer for your setup and it is checked. Essentials Plus adds a hands on technical audit, where an assessor actually tests a sample of your machines rather than taking your word for it.
Which one you need usually comes down to what the contract or insurer in front of you is asking for. Many ask for the standard certificate. Some larger or public sector buyers want Plus.
Do you need it, and what it is not
The honest answer is that you need it when someone you want to do business with asks for it, or when your insurer starts making it a condition. More UK contracts and insurers do each year, so it is worth knowing where you stand before it becomes urgent.
It is also worth saying what it is not. A certificate is a baseline, not a force field. It makes you a harder target and it satisfies the paperwork, and it does not mean you can stop paying attention. We would rather fix what is genuinely weak than coach you to answer around the questionnaire.
If you want to know roughly where you would land today, we can do a quick gap check and tell you what stands between you and the certificate before you commit to anything.
Related
Want a straight answer on this?
Tell us the job that is costing you the most time. We will look at it and tell you honestly what, if anything, is worth doing about it. The first conversation is free.
Get a quote
