Cyber Essentials is a UK government-backed check of five technical controls: firewalls, secure configuration, access control, malware protection and security updates. It is a baseline, not a full security audit — and that is why it is realistic for a 10-person firm.
Fix the basics before you apply
Assessors will fail you for things that are already good practice. Sort them first and the questionnaire is much shorter.
- Multi-factor authentication on email and admin accounts
- No shared logins for Microsoft 365, the firewall or the bank
- Supported Windows versions, with updates actually installing
- A firewall boundary between the office network and the internet
- A list of who has admin rights, reviewed when people leave
Our cyber security basics and autumn cyber checklist cover the same ground in plain language. Password managers make the access-control questions easier — see password managers for small teams.
When the certificate pays for itself
If you sell to councils, the NHS supply chain, or larger North East manufacturers, the badge removes a question from the tender pack. Even without that, insurers and customers increasingly ask what you have in place. A certificate is easier to show than a paragraph that says “we think we are fine”.
Garvey's IT prepares offices for the controls through managed IT support — patching, MFA, firewalls and device builds — from our base in Stockton-on-Tees. Talk to us before you book an assessor if you want the gaps found on our time, not on the assessment.
Common questions
Do we need Cyber Essentials if we are not bidding for government work?
You do not need the certificate to be safer, but the five controls are the right baseline either way. The badge helps when a customer or insurer asks how you protect data. Many public-sector and larger supply chains now expect it.
How long does Cyber Essentials take for a small office?
A tidy Microsoft 365 tenant with MFA, patched PCs and a known firewall can be ready in days. It takes longer if admin passwords are shared, old Windows versions are still in use, or nobody is sure which cloud apps hold company data.