Cyber Essentials

What it is

Cyber Essentials was developed by the National Cyber Security Centre (NCSC), which describes it as the minimum standard of cyber security the government recommends for organisations of all sizes. It is designed to stop the most common internet-based attacks, the kind that rely on default passwords, missing updates and accounts nobody switched off.

It checks five technical controls across everything in scope:

• Firewalls between your devices and the internet
• Secure configuration, so devices and services don’t ship with unnecessary accounts or software
• Security update management, including installing critical and high-risk fixes within 14 days of release
• User access control, so people only have the access they need
• Malware protection

Certification is a verified self-assessment: you answer a question set and an independent assessor reviews your answers. IASME is the NCSC’s official delivery partner and runs the scheme through a network of certification bodies. Organisations under £20 million turnover that certify the whole organisation are also entitled to cyber liability insurance arranged by IASME.

Why it matters for a UK small business

It is the certificate UK customers ask for first, especially in public sector and regulated supply chains. It is also a useful checklist in its own right, because the five controls cover the basics that most small business breaches get through.

How it works in Microsoft 365

Version 3.3 of the requirements applies from 27 April 2026. It states that cloud services cannot be excluded from scope, and that authentication to cloud services must always use multi-factor authentication. For most small businesses the biggest cloud service is Microsoft 365, so every account there needs MFA, and administrators need separate accounts for admin work. Managed devices, automatic updates and Microsoft’s built-in protection cover a large part of the rest.

The step up, with hands-on testing by an assessor, is Cyber Essentials Plus.

How &DEV helps: our fixed-price Microsoft 365 MOT puts the Cyber Essentials controls in place across your Microsoft 365 accounts, email and devices, with a written record of each one.