What Cyber Essentials means for SMEs

What it is

Cyber Essentials is a baseline certification focused on five technical controls that, done well, prevent the most common types of internet-based attack.

There are two levels: Cyber Essentials (a self-assessment) and Cyber Essentials Plus (which adds an independent technical verification).

The five controls

• Firewalls — keep untrusted traffic out.
• Secure configuration — set devices and software up safely.
• User access control — right access for the right people.
• Malware protection — detect and stop malicious software.
• Security update management — patch known weaknesses promptly.

Why SMEs are being asked for it

Buyers, insurers, and partners increasingly want evidence that suppliers manage security. Cyber Essentials is a simple, recognised way to provide it.

Some UK public-sector contracts require Cyber Essentials in order to bid, so it can be a gateway to certain work.

Crywex helps you prepare for Cyber Essentials before you apply through an authorised certification route. Crywex is not a certification body.

How to approach it

Treat it as a project: review your setup against the five controls, fix the gaps in priority order, and gather the evidence you'll need. Most SMEs are closer than they expect.