Cyber Essentials for Small Business: What It Is and Why Customers Ask for It
Larger customers increasingly ask suppliers whether they hold Cyber Essentials. Here is what the scheme covers, how certification works and how to get ready.
If you sell to larger organisations, you may already have met the question in a tender form or a supplier questionnaire: do you hold Cyber Essentials? It is a government backed scheme, developed with the National Cyber Security Centre, that sets out a basic level of protection every organisation should have. For small businesses it has become one of the quickest ways to show customers that security is taken seriously.
The five controls
The scheme is built around five technical controls. Firewalls protect your network and devices from the internet. Secure configuration means devices and software are set up safely, with unnecessary features and default passwords removed. User access control means people only have the access they need, and administrator rights are tightly limited. Malware protection means devices are defended against viruses and malicious software. Security update management means operating systems and applications are kept up to date, within set time limits.
Why customers are asking for it
Supply chains are a favourite route for attackers, who target smaller suppliers to reach larger customers. In response, government, major banks and many large buyers are encouraging or requiring suppliers to hold the certificate. In December 2025 the National Cyber Security Centre published guidance asking senior leaders to make Cyber Essentials a standard supplier requirement. It is guidance rather than law, but the direction of travel is clear.
How certification works
You complete a self assessment questionnaire about your organisation, your devices, your network and your cloud services. It is reviewed by an accredited certification body, and if you pass you receive a certificate valid for twelve months. A higher level, Cyber Essentials Plus, adds a hands on technical audit. Fees depend on the size of your organisation and the provider, and for a small business the basic certificate is usually in the hundreds of pounds.
Where small businesses usually stumble
The assessment is strict about details. Common reasons for failing first time include unsupported software or operating systems, shared administrator accounts, missing multifactor authentication on cloud services, devices that have not been updated within the required period, and a scope that does not match reality. Most are easy to fix once you know about them.
How to prepare
Start by listing every device and cloud service that touches business data, including personal phones if staff use them for work. Remove or replace unsupported systems, turn on multifactor authentication everywhere it is offered, review who has administrator rights and switch on automatic updates. Then read the questionnaire before you start it, so the answers match what you actually do.
Is it worth it?
For businesses that sell to larger customers or the public sector, yes, because it can be the difference between being considered and being ignored. For others it is still a sensible, affordable baseline that cuts real risk, and some insurers look favourably on it.
K4O5 helps small businesses get ready, fix the gaps and complete the assessment with an accredited certification body. If you would like a readiness review, we will tell you plainly what stands between you and the certificate.