Cyber Essentials, plainly explained
A UK government-backed baseline covering five technical controls. Not a silver bullet, but it forces a level of housekeeping that catches a lot of avoidable risk.
Cyber Essentials is a UK government-backed certification that checks a business meets a baseline of security practices across five areas: firewalls, secure configuration of devices and software, user access control, malware protection, and keeping software patched and up to date.
It's a self-assessment (with a version that includes independent verification, Cyber Essentials Plus, for those who need it), rather than a deep audit — which means it's achievable for a small business without a dedicated IT security team, not just larger organisations with more resources.
The certification itself is sometimes a hard requirement — some clients, public sector contracts and insurers ask for it directly. But even where nobody's asking, working through the five controls tends to surface exactly the kind of avoidable gaps that cause real incidents: an unpatched laptop, an account with more access than it needs, a firewall rule nobody remembers the reason for.
It's not a guarantee against every kind of attack, and it was never meant to be. It's a baseline — a reasonable floor to stand on, not a ceiling.