Cyber Essentials shows up uninvited. It’s a line in a tender document nobody in the business recognises, or a single question buried deep in a supplier’s onboarding form. Whoever spots it first ends up explaining a government certification scheme to a board that’s never heard of it, on a deadline.
What is Cyber Essentials?
Cyber Essentials is a UK government-backed cyber security certification scheme, developed by the National Cyber Security Centre (NCSC) and delivered through IASME, its official delivery partner. It sets out a defined group of security controls, and certification confirms those controls are working.
The NCSC describes it as the minimum standard of cyber security recommended by the government for organisations of any size. It’s built to prevent the most common internet-based threats. Certification confirms the basic doors and windows are locked, closing off the easiest routes in for opportunistic attackers. A business that clears it has dealt with the entry points criminals use most often. Cyber Essentials was never designed to guarantee immunity from every kind of attack; it exists to close the easiest routes in.
What do the five controls ask of you?
Each control connects to something the business is using every day.
Firewalls: the barrier between the internet and an internal network. A properly configured firewall stops unwanted traffic reaching company systems in the first place.
Secure configuration: removing default passwords and switching off features that widen the attack surface unnecessarily. A router or laptop left on factory settings is an easy target.
Security update management: keeping software patched against known vulnerabilities. Cybercriminals frequently exploit flaws the software vendor fixed months earlier, so consistent updates close a well-used route in.
User access control: making sure people only have access to what their role requires and that admin-level rights aren’t handed out by default. A junior team member with full administrator access across every system is a common finding on assessments.
Malware protection: software that detects and blocks malicious code — whether it arrives through an email attachment or a compromised download — before it can run.
Businesses tend not to fail Cyber Essentials over something exotic. They fail over something ordinary. A patch that was missed or an admin account nobody switched off.
What certification buys beyond the tender
Certification becomes relevant the moment a customer, supplier or public sector body asks for it as a condition of doing business, and for public sector work that’s not a soft preference. Since 2014, central government has required Cyber Essentials certification for contracts involving personal data or certain IT services. The current version, PPN 014, took effect in February 2025 and applies to central government departments, their executive agencies, non-departmental public bodies and NHS bodies. A current certificate answers the question before it slows down a tender. A missing one can rule a bid out before anyone reads the rest of it.
It also lets a business reassure customers and staff that cyber security is being taken seriously, backed by an independent, external assessment.
One financial detail deserves precise wording. Any UK organisation with turnover under £20 million that certifies its whole organisation is automatically entitled to cyber liability insurance arranged by IASME, including incident response support that covers the technical and legal costs of dealing with a breach. The entitlement itself is an often overlooked part of getting certified.
Cyber Essentials or Cyber Essentials Plus?
Cyber Essentials and Cyber Essentials Plus are built around the same five controls. The standard certification relies on a self-assessment questionnaire, verified and marked by an assessor. Cyber Essentials Plus adds an independent technical audit. An assessor tests the systems directly, confirming the controls hold up under real conditions. A customer or contract that wants a higher level of assurance will specify Cyber Essentials Plus by name.
The paperwork has to match reality
The process runs through IASME’s online platform. A business answers a set of questions covering the five controls, and someone at senior or board level signs off on the responses before an assessor marks them. Good intentions don’t get marked. Accurate answers do. The questionnaire is a point-in-time assessment, and answers need to describe the IT currently running. An assessor working from a two-year-old policy document with no live evidence to back it up will mark it down, and that mismatch is where certification attempts most often stall.
Certification is valid for 12 months, and renewal means completing the process again in full, using a question set that IASME and the NCSC update each year to reflect emerging threats. A business that passed comfortably last year can’t assume nothing has changed this time.
The recurring reasons certification stalls
Certain issues turn up repeatedly during preparation. Software that has reached the end of life and no longer receives security updates is a frequent blocker, sitting on a forgotten server nobody logs into anymore. Patching gets inconsistent once a business mixes company and personal devices, especially once remote or hybrid working outpaces whoever was managing that side of things. Administrator access granted generously over time and never reviewed, catches out plenty of businesses too, alongside routers and firewalls still running factory settings.
This reflects how small businesses tend to operate day to day, adding tools and access as needed without a system for circling back to tidy up. It’s also why an outside review before certification catches things an internal team has stopped noticing.
Where MTS Technology comes in
MTS Technology has supported West Midlands businesses with IT and cyber security for more than 50 years, working from its Tamworth base with companies across Birmingham and the surrounding area. MTS can review a business’s setup against the five controls and flag what’s likely to cause problems during the assessment. From there, fixes get prioritised against what the business can realistically manage before a deadline.
Two weeks before a tender deadline is the worst time to discover a router has never been reconfigured or an admin account has been open for years. The businesses that get through certification cleanly are the ones that had someone look at their setup months before an assessor did. MTS’s role is to be that early look, flagging what needs fixing while there’s still time to fix it properly.
Cyber Essentials was designed to be achievable. Five controls and one assessment lead to a certificate that answers the tender question before it becomes a blocker. If a customer, tender or renewal has put that question to a business for the first time, MTS Technology can work through what needs fixing before an assessor does. Get in touch to start the process.
