Cyber Essentials proves your business has the fundamental protections in place against the most common cyber attacks. For many small and medium businesses, it's the difference between winning a contract and never reaching the shortlist.
Boundary protection between your network and the internet.
Devices and software set up to reduce vulnerabilities.
Accounts and admin privileges managed on a genuine need basis.
Defences against viruses and other malicious software.
Devices and software kept up to date, patched promptly.
Cyber Essentials requires you to have deployed both technical security controls and suitable procedures to ensure these are effective and maintained. Some organisations will deploy downloadable templates which are static and generic. Traditional consultants can produce the right documents, but rarely at a price that makes sense for a small business, for something this foundational. With our security policies, which are based on years of experience and updated with your organisation's specific information, you can get these deployed and improve your security posture quickly.
Answer a short, focused questionnaire about how your business actually operates, just the questions that matter for your policy set, not the full Cyber Assurance question pack, and the platform generates your complete Cyber Essentials policy set, built to match your real environment rather than a generic template.
Once you're certified, updating an answer automatically flags every document it affects, and our automated review-reminder emails keep you on schedule, so your documentation stays matched to your live setup, and your certification stays genuinely defensible, not just a folder you filed away.
There are two separate clocks running: getting your policies and evidence in order, and the certification body's own assessment. Neither is usually the bottleneck people expect.
Answer the questionnaire and your policy set generates immediately. For most small businesses this is a same-day task, not a weeks-long drafting exercise.
Submit your Cyber Essentials questionnaire to your chosen certification body. This is where most of the real time goes - not writing policies, but confirming every technical control is genuinely in place across every device in scope.
Cyber Essentials Plus adds an independent technical audit - vulnerability scanning and on-site or remote testing of a sample of your devices, verifying what you've claimed is actually configured correctly.
Most businesses that already have reasonable IT hygiene complete the whole process in 2-4 weeks. The variable isn't the paperwork - it's how much technical remediation (patching, MFA rollout, removing local admin rights) needs to happen before the assessment.
Cyber Essentials pricing is set in tiers by company size, so the certification fee itself is fairly predictable. Where costs genuinely vary is everything around it.
Certification bodies price Cyber Essentials in published bands based on employee count, so this part of the cost is broadly known upfront and doesn't vary much between providers for a given company size.
The real cost differences between businesses come from: how much technical remediation is needed before assessment, whether you write policies yourself, pay a consultant by the hour, or use a platform, and whether CE+ testing uncovers gaps requiring a re-test.
Where we fit: we remove the policy-writing cost and the ongoing maintenance cost - the parts that otherwise mean paying either your own time or a consultant's day rate, repeatedly, every year at renewal. See current pricing →
Excluding devices, cloud services or home workers that should actually be in scope is one of the most common reasons an assessment gets sent back for correction.
Personal phones and laptops used to access company email or data are in scope more often than businesses expect, and are frequently missed until the assessment flags them.
Operating systems or applications that have reached end-of-life and no longer receive security updates fail the malware and patch management controls outright.
User access control assumes admin rights are the exception, not the default - a common gap in businesses that have grown organically without a formal joiners/leavers process.
Your CE+ policy set builds on the same platform and the same automated affected-document flagging. CE+ adds a requirement to prove you're doing what you say. The controls remain the same, so our policies work across both certifications.
Your complete Cyber Essentials / Cyber Essentials Plus policy set, tailored to your business.
Only the questions your policy set actually needs, not the full Cyber Assurance question pack.
Update an answer and we automatically flag every document it affects, so your policies stay aligned as your business evolves. Real-world changes are down to you to tell us about, nothing scans your systems for you.
A dedicated set of policies setting out exactly what each of the five CE+ technical control areas requires, implementing and maintaining those controls is down to you or your IT provider, so you walk into your independent assessment prepared.
Your questionnaire answers, policies, asset register and action plan live in one place, not spread across shared drives, email attachments and whichever version of the template someone last edited.
Your asset register and scope statement update as your devices, cloud services and third parties change, not a one-time snapshot from when you first signed up.
See the full Cyber Essentials toolkit, every tool included →
Not sure if you need this or ISO 27001? See the comparison →
Wondering what the certification itself costs? See the 2026 pricing guide →
A genuinely smaller, faster, lower-cost package, for businesses that only need the baseline.