Cyber Essentials has become the proof point a customer, an insurer or a tender document asks for first. This page covers what it involves and how MTS Technology can help with certification.
Cyber Essentials is a UK Government-backed certification scheme, overseen by the National Cyber Security Centre (NCSC) and delivered on its behalf by IASME. It sets out five technical controls, then checks you’ve got them in place, either through a self-assessment or a technical audit.
There are two levels. Cyber Essentials is the self-assessment route, checked by an independent assessor. Cyber Essentials Plus adds independent technical testing of your systems on top of the same five controls. Either one gives a customer, insurer or supplier the same reassurance that the basics are covered.
West Midlands SMEs without an in-house security team often find Cyber Essentials is the first formal step towards proving cyber security maturity to customers, insurers and public sector buyers. The scheme applies to any size of organisation, in any sector, and doesn’t assume specialist IT knowledge in-house.
Cyber Essentials has been around since 2014, built around the same five controls the whole time. What’s changed is the speed of the attacks it’s designed to stop.
In April 2026, the Department for Science, Innovation and Technology and the Cabinet Office wrote an open letter to UK business leaders about this directly. Government testing found new AI models that can now find software weaknesses and write the code to exploit them, work that needed a skilled human specialist a year earlier. The same testing found that capability roughly doubling every four months.
A business doesn’t need to be a specific target for this to matter. Automated tools scan huge numbers of internet-facing systems every minute, checking for the one left unlocked. A small West Midlands firm looks no different to that scan than a national brand.
The five controls Cyber Essentials asks for haven’t changed, because they were built to stop exactly this kind of opportunistic attack. Certifying against them is one of the more direct responses available as automated attacks scale up faster than many in-house IT teams can track.
Cyber Essentials focuses on five technical controls. Understanding them doesn’t need specialist skill, and together they block the large majority of attacks a typical business will face.
Controlling what's allowed in and out of your network, so the internet can't reach things it shouldn't.
Setting up devices and software securely from the outset, with unnecessary features and default settings switched off.
Making sure only the right people have access to the right systems, with permissions reviewed and removed when they're no longer needed.
Software that spots and blocks viruses, ransomware and other malicious code before it can do damage.
Keeping software and devices updated, so known weaknesses get fixed before someone finds them.
Certification puts a recognised baseline behind your cyber security.
A growing number of tenders, especially public sector and supply chain contracts, list Cyber Essentials as a condition of bidding. Certification opens doors that would otherwise stay closed.
Businesses and organisations with Cyber Essentials controls in place make 92% fewer insurance claims, according to the UK Government. Several insurers reflect that directly in premiums.
Certification gives customers, suppliers and prospects an independent signal that you take their data seriously, without you having to make the case yourself.
The five controls target the everyday, opportunistic attacks that make up the majority of breaches reported to the NCSC each year.
Reported directly by the UK Government and the NCSC.
fewer insurance claims among businesses with Cyber Essentials controls in place
Cyber Essentials certificates awarded across the UK to date
starting cost of certification, priced by organisation size
On paper, certification is straightforward. Most businesses still want someone who’s done it before sitting alongside them through the process.
MTS Technology treats Cyber Essentials as part of the wider cyber security support we’ve provided to West Midlands businesses for over 50 years, delivered by the same local team you work with day to day.
We review your current setup against the five controls and flag exactly what needs attention before you apply.
We review your current setup against the five controls and flag exactly what needs attention before you apply.
We review your current setup against the five controls and flag exactly what needs attention before you apply.
We review your current setup against the five controls and flag exactly what needs attention before you apply.
We’re hosting a free, invite-only Lunch and Learn on Thursday 5th November, covering Cyber Essentials and the practical impact of AI on cyber security. Expect a relaxed session over lunch, with plenty of time for questions and conversation.
Places are limited, so please confirm as soon as you can.
No. Cyber Essentials is designed for organisations of any size. The West Midlands businesses we support range from five-person teams to firms with over a hundred staff, and few have a dedicated security function.
Self-assessment takes around two to four weeks from starting the questionnaire to receiving certification. Cyber Essentials Plus takes longer as it includes a hands-on technical audit of your systems.
Cyber Essentials is a self-assessment, checked by an independent assessor. Cyber Essentials Plus covers the same five controls, verified through hands-on technical testing of your systems.
No certification can promise that. What Cyber Essentials does is close off the openings that the bulk of common attacks rely on, and demonstrate to customers and insurers that you’ve done so.
We’re hosting a free, invite-only Lunch and Learn this [month] covering Cyber Essentials and the practical impact of AI on cyber security. Expect a relaxed session over lunch, with plenty of time for questions and conversation.
Places are limited, so please confirm as soon as you can.
