Cyber Essentials Certification: What London Businesses Need to Know
Cyber Essentials is a UK government-backed cybersecurity certification scheme designed to help organisations protect themselves against the most common cyber threats. For London businesses – particularly those working with government contracts, handling sensitive data, or operating in regulated sectors – it is increasingly becoming a requirement rather than a nice-to-have.
This guide explains what Cyber Essentials involves, who needs it, what the certification process looks like, and how to prepare.
What Is Cyber Essentials?
Cyber Essentials is a set of five technical controls that, when implemented properly, can prevent around 80% of common cyber attacks. The scheme has two levels:
Cyber Essentials – A self-assessment questionnaire verified by an accredited certification body. This confirms that your organisation has the five basic controls in place.
Cyber Essentials Plus – Everything in Cyber Essentials, plus an independent technical audit where a qualified assessor tests your systems to verify the controls are working as described.
The Five Technical Controls
1. Firewalls
Your internet connection must be protected by a properly configured firewall. This applies to both hardware firewalls at your office and software firewalls on individual devices, particularly important for staff working remotely.
2. Secure Configuration
Computers and network devices should be configured to reduce vulnerabilities. This means removing unnecessary software, changing default passwords, and disabling features you do not use.
3. User Access Control
Staff should only have access to the systems and data they need for their role. Administrator accounts should be tightly controlled and not used for day-to-day work.
4. Malware Protection
All devices must have protection against malware, whether through dedicated anti-malware software, application whitelisting, or sandboxing. This needs to be kept up to date.
5. Security Update Management
Software and operating systems must be kept up to date with security patches. High-risk or critical updates should be applied within 14 days of release.
Who Needs Cyber Essentials?
Cyber Essentials is relevant to any business that wants to demonstrate basic cybersecurity hygiene, but it is specifically important for:
- Government suppliers – Cyber Essentials certification is mandatory for many government contracts, particularly those involving the handling of sensitive or personal data.
- Regulated businesses – Insurance brokerages, financial services firms, and healthcare providers are increasingly expected to hold certification by clients and regulators.
- Businesses handling personal data – If you process customer or employee data, certification demonstrates you take data protection seriously.
- Organisations in supply chains – Larger clients and partners are increasingly requiring their suppliers to hold Cyber Essentials as a minimum security standard.
What Does Certification Cost?
Cyber Essentials self-assessment certification typically costs between £300 and £500 for the assessment itself. Cyber Essentials Plus, which includes the technical audit, typically costs between £1,500 and £3,000 depending on the size and complexity of your environment.
These costs cover the assessment and certification only. If your systems need work to meet the requirements, there will be additional costs to remediate any gaps – though for well-managed environments, this is often minimal.
How to Prepare
The most common reasons businesses fail Cyber Essentials assessments are straightforward to fix:
- Devices running outdated operating systems or software with unpatched vulnerabilities
- Staff using administrator accounts for daily work
- No multi-factor authentication on cloud services
- Default passwords still in use on routers or network equipment
- Personal devices accessing company data without proper security controls
A good IT support provider will be able to assess your current position, identify any gaps, remediate them, and guide you through the certification process.
How Caroleo Technology Can Help
At Caroleo Technology, Cyber Essentials preparation is part of our standard approach to cybersecurity for London businesses. We assess your current environment against the five controls, implement any necessary changes, and support your application through to certification.
For clients on our managed IT support plans, many of the Cyber Essentials controls are already in place as part of our standard service – proactive patching, endpoint protection, access controls, and firewall management.
Talk to us about Cyber Essentials certification for your business →