How to Get Cyber Essentials: Steps, Costs and Timescales

Last updated: 12 November 2026

Cyber Essentials usually lands on a director’s desk for one of three reasons: a customer or tender asks for it, an insurer mentions it, or someone simply wants to know the business is protected against the most common attacks. Whatever the reason, the questions are the same. What do we have to do, what will it cost, and how long will it take?

This guide answers all three, including the changes that came in during 2026 and the government discount launched in November.

Getting Cyber Essentials at a Glance

• What it is: a government-backed certificate showing your business has five basic security controls in place.
• How you get it: check your IT against the requirements, fix any gaps, then complete an online self-assessment that a certification body marks.
• What it costs: an assessment fee from £320 plus VAT, cut by 75% to between £80 and £125 plus VAT for eligible first-time small businesses until March 2027.
• How long it takes: a few days if you’re ready; more typically two to six weeks, most of it spent fixing gaps.
• How long it lasts: expect to renew every year.

What Cyber Essentials Actually Checks

Cyber Essentials is run by the National Cyber Security Centre, with IASME managing certification. It doesn’t try to cover everything. It focuses on five technical controls that stop the large majority of everyday attacks:

1. Firewalls, so only the connections you intend can reach your devices.
2. Secure configuration, so default passwords are changed and anything you don’t need is switched off.
3. User access control, so people only have the access they need, admin accounts are kept separate, and multi-factor authentication protects your accounts.
4. Malware protection, on every device that needs it, such as managed Sophos endpoint protection.
5. Security update management, so supported software is kept patched and unsupported software is removed.

The scope normally covers every computer, laptop, tablet, phone, server and cloud service your organisation uses for work, including personal devices if staff use them to access work email or files.

What Changed in April 2026

The requirements are reviewed regularly, and the version that took effect on 27 April 2026 (question set “Danzell”) made two things automatic failures rather than points to be discussed:

• Multi-factor authentication on every cloud service, for every user account, not just administrators. Missing it on even one service is a fail.
• High-risk and critical security updates installed within 14 days of release.

If you were certified under an earlier version, your renewal will be assessed against the new rules, so it’s worth checking both before you start. Our article on what actually trips businesses up covers the other common stumbling blocks.

How to Get Cyber Essentials, Step by Step

Step 1: Decide what’s in scope

The simplest and most valuable option is to certify your whole organisation. It avoids awkward boundaries, it’s what most customers expect, and it’s required if you want the free cyber insurance that comes with certification for eligible businesses.

Step 2: Take stock of your devices and cloud services

List every device and cloud service in use, including the ones nobody thinks of: the old laptop in a drawer that still connects, the free file-sharing account someone set up, the finance app with its own login. You can’t answer the questions accurately without this list, and it often turns up things that need retiring.

Step 3: Check yourself against the requirements

Go through the five controls and the current question set honestly. The usual gaps are multi-factor authentication missing on one or two services, devices or software that are out of support, updates that aren’t being installed quickly enough, staff using admin accounts day to day, and default passwords on routers or other equipment.

Step 4: Fix the gaps

This is where most of the time goes. Switching on multi-factor authentication, replacing unsupported equipment, tightening admin rights and setting up automatic updates can take anything from an afternoon to a few weeks, depending on what you find. It’s also the part that does the real security good, so it’s worth doing properly rather than just well enough to pass.

Step 5: Complete the self-assessment

You answer the questionnaire online through a certification body, and it must be signed off by a board-level person or equivalent. Answer accurately; the certification body may ask for more detail, and your answers need to be true on the day you submit.

Step 6: Get your result, and stay compliant

The certification body marks your answers, usually within a few working days, and issues your certificate if you pass. From then on the job is keeping things that way: updates installed on time, new starters and new services set up correctly, and old devices retired. Then you renew each year.

What Cyber Essentials Costs

There are two parts to the cost: the assessment fee, and any work needed to meet the requirements.

The assessment fee is set centrally by IASME, so it’s the same whichever certification body you use. It depends on the size of your organisation, starting at £320 plus VAT for micro organisations of up to nine staff and rising for larger ones.

The government discount. On 3 November 2026 the government launched the Cyber Essentials First Step Fund, which takes 75% off the assessment fee for eligible micro, small and medium-sized businesses getting their first certificate. That brings the fee down to between £80 and £125 plus VAT. It runs until the end of March 2027 or until the funding runs out, and applications are made through IASME’s First Step website.

The work to get ready varies the most. A business already using a well-managed Microsoft 365 setup with up-to-date devices may need very little. One with old equipment, no multi-factor authentication and no central management may need some investment first. Either way, it’s money spent on security you’d want anyway.

Cyber Essentials Plus is a separate, higher level that adds a hands-on audit of your systems by an assessor, and costs more as a result.

How Long It Takes

If your IT already meets every requirement, you could complete the questionnaire in a day or two and have your result within a few working days. That’s rare in practice. For a typical small business, two to six weeks from starting to certificate is realistic, most of it spent on Step 4.

If a tender or contract has a deadline, start early. Finding out three days before a submission that half your laptops need replacing is a common and avoidable problem.

Cyber Essentials or Cyber Essentials Plus?

Basic Cyber Essentials is a verified self-assessment. Cyber Essentials Plus covers the same five controls but adds an assessor testing a sample of your devices and systems directly, and it has to be completed within three months of your basic certificate.

Plus is usually only worth it when a customer, contract or tender specifically asks for it, or when you want the extra assurance of independent testing. For most small businesses, basic Cyber Essentials, kept up properly, is the right starting point.

Frequently Asked Questions

How long does it take to get Cyber Essentials?

If your IT already meets the requirements, the questionnaire can be completed in a day or two and the result usually follows within a few working days. Most of the time goes on fixing gaps beforehand, so for a typical small business a realistic timescale is two to six weeks from starting to holding the certificate.

How much does Cyber Essentials cost?

The assessment fee is set centrally by IASME and depends on the size of your organisation, starting at £320 plus VAT for micro organisations. Until March 2027, or until the funding runs out, the government's First Step Fund takes 75% off for eligible small and medium-sized businesses getting certified for the first time, bringing the fee to between £80 and £125 plus VAT. Any work needed to meet the requirements is extra.

Can you fail Cyber Essentials?

Yes. Since April 2026 some answers are automatic failures, including not having multi-factor authentication on every cloud service and not installing high-risk or critical security updates within 14 days. If you fail, the certification body will explain why, and you can usually fix the problems and resubmit.

How long is a Cyber Essentials certificate valid for?

A certificate shows you met the requirements on the day it was issued. Customers, insurers and tender documents generally expect it to be less than 12 months old, so in practice you renew every year.

Do I need Cyber Essentials Plus as well?

Only if a customer, contract or tender asks for it. Cyber Essentials Plus adds a hands-on technical audit of your devices and systems, must be completed within three months of your basic certificate, and costs more because an assessor tests your setup directly.

How CCSW Can Help

CCSW is Cyber Essentials certified itself, and we help businesses across Cardiff and South Wales get certified and stay that way. Our CCSW Cyber Secure service handles the whole process: we check your setup, fix what we find, and take care of your Cyber Essentials certificate every year with the assessment fee included. In between, you get monthly vulnerability scanning and penetration testing, dark web monitoring and a monthly cyber report.

CCSW Cyber Secure starts from £100 a month (excluding VAT) for organisations with up to nine staff, alongside our managed IT support. If you’re getting certified for the first time, ask us about the First Step Fund.

To talk through where you stand, get in touch or call 0333 014 4544.