Cyber Essentials — What It Is, Why We Have It and How We Can Help

Back to Resources

Cyber Essentials is a UK government-backed certification scheme. It shows that a business has the basic security controls in place to protect itself against the most common cyber attacks.

Most attacks on small and medium-sized businesses aren't sophisticated. They are opportunistic: automated scans for unpatched software, weak or reused passwords, default settings left switched on and devices with no protection. Cyber Essentials targets exactly those weaknesses.

What is Cyber Essentials?

The scheme was developed by the UK government with the National Cyber Security Centre (NCSC) and is delivered through accredited certification bodies. It's built around five technical controls:

• Firewalls. Every device and network connection is protected by a properly configured firewall, so only the traffic you need gets through.
• Secure configuration. Default passwords are changed, unnecessary software and accounts are removed, and devices are set up securely from the start.
• User access control. People only have the access they need for their role, admin accounts are kept separate and multi-factor authentication is used on cloud services.
• Malware protection. Anti-malware or application controls are in place to stop malicious software from running.
• Security update management. Software and operating systems are supported and kept up to date, with critical and high-risk patches applied within 14 days.

Cyber Essentials and Cyber Essentials Plus

There are two levels of certification:

• Cyber Essentials. A verified self-assessment. You answer a detailed questionnaire about how your IT is set up, and an independent assessor reviews it.
• Cyber Essentials Plus. The same requirements, plus a hands-on technical audit. An assessor tests a sample of your devices and systems to confirm the controls are actually working.

Both levels must be renewed every 12 months, which keeps your security from drifting once the certificate is on the wall.

Certificates are public, so you can check whether a supplier or partner is certified using the NCSC certificate search.

Why it matters for your business

Beyond the protection itself, Cyber Essentials brings practical business benefits:

• Winning work. It's a requirement for many UK government contracts, and a growing number of larger businesses expect it from their suppliers.
• Customer confidence. It's a clear, recognised signal that you take the security of their data seriously.
• Insurance. Insurers increasingly ask about basic security controls, and certification can make cover easier to obtain.
• A clear baseline. It gives you a practical, structured checklist instead of guesswork about where to start.

Why we have it

Fruity IT is Cyber Essentials certified. As your IT partner, we have privileged access to your systems, accounts and data, so our own security directly affects yours. Attackers increasingly target IT providers as a way into their clients' networks.

Getting certified means we hold ourselves to the same standard we recommend to our clients, and it's independently verified every year. We'd rather show you than just tell you, so you can view our certificate here.

How we can help you

Many businesses put off Cyber Essentials because the questionnaire looks daunting or they aren't sure whether they'd pass. That's where we come in:

• Readiness review. We assess your current setup against the five controls and give you a clear, plain-English list of what needs to change.
• Fixing the gaps. We put the right controls in place: patching, secure device configuration through Microsoft Intune, multi-factor authentication, firewall configuration and replacing unsupported systems such as Windows 10.
• Support through the assessment. We help you complete the questionnaire accurately and work with you through the certification process, including the technical audit for Cyber Essentials Plus.
• Staying compliant. Through our managed services, the controls stay in place all year round, so renewal is a formality rather than a scramble.

The bottom line

Cyber Essentials won't stop every possible attack, but it closes the doors that most attackers try first. For most small and medium-sized businesses, it's the most sensible first step in cyber security, and a solid foundation for further protection such as MDR and security awareness training.