Free guide

Get Cyber Essentials certified, step by step

Cyber Essentials is the UK government-backed certificate that shows your business has the basic protections in place against common cyber attacks. More clients, public sector contracts and insurers now ask for it. This guide walks a small business through everything, in plain English.

The short version

• It covers five areas: firewalls, secure settings, security updates, user access and malware protection.
• You complete an online questionnaire, a director signs it, and an assessor marks it.
• It costs £320 + VAT a year for organisations with up to 9 employees.
• The certificate lasts 12 months, so you renew every year.
• Since 27 April 2026, MFA must be switched on for every cloud service that offers it. Missing even one is an automatic fail.

Before you start

• Admin access to your Microsoft 365 or Google Workspace account
• Access to your office router's settings
• A rough list of everyone's laptops and phones
• A director who can sign off the final declaration

The seven steps

1. 1Decide what's in scope and list everythingThe first step to Cyber Essentials: choose your scope and list every device and cloud service your business uses.
2. 2FirewallsHow to set up your office router and laptop firewalls to meet Cyber Essentials.
3. 3Secure configurationTighten the default settings on your devices and accounts so they meet Cyber Essentials.
4. 4Security updatesKeep every device and app supported and patched within 14 days, as Cyber Essentials requires.
5. 5User accounts, admin rights and MFAControl who can access what, separate admin accounts and switch on MFA everywhere, the biggest Cyber Essentials change for 2026.
6. 6Malware protectionProtect every device from viruses and malicious websites to meet Cyber Essentials.
7. 7Complete the assessment and get certifiedHow to complete the Cyber Essentials questionnaire, submit it and keep your certificate current.

This guide summarises Cyber Essentials Requirements v3.3 for small businesses. It is general guidance, not the official question set. Check the current requirements on the IASME website before you submit. Last updated 2 November 2026.