Not every small business is legally required to hold Cyber Essentials. Whether you need it depends on your customers, contracts, tenders, supply chain and risk priorities. A client or procurement process may specify a certification level, so check the exact wording before you decide what to buy.
When a small business may need it
- A contract or tender names Cyber Essentials as a condition of bidding.
- A customer requires certification before sharing data or onboarding a supplier.
- A framework or partner asks for evidence of baseline security controls.
- The business wants a structured way to review common technical controls.
- The business want to give assurance to its stakeholders that it takes cyber security serioulsy.
- The business is concerned about potential risk and wants to employ the simple controls that Cyber Essentials is built around.
What certification does and does not mean
Cyber Essentials assesses defined technical controls intended to help protect against common online threats. It can support assurance discussions with customers, but it is not a guarantee against cyber incidents, a full audit of every business risk or a substitute for other legal and contractual duties.
How to decide on your next step
Confirm the requirement with the organisation asking for certification, including whether it specifies Cyber Essentials or Cyber Essentials Plus. Review your current systems and the time available to prepare. If you are unsure where to start, use our free readiness assessment or speak to a consultant about the scope.