Cyber Essentials when you’re 5–50 people and nobody is “the IT person”

How it usually starts

Rarely with an interest in cyber security. A tender names it, a big customer’s supplier questionnaire asks for it, an insurer mentions it — and suddenly “Cyber Essentials” is between you and a contract. That framing matters, because it tells you what the job is: not becoming a security expert, but truthfully meeting five specific controls and being able to say so. If nobody has asked yet, the do-you-need guide covers whether to get ahead of it.

The good news about your size

A 5–50-person business on Microsoft 365 or Google Workspace is close to the scheme’s best case. No servers, usually one office and some home working, a dozen laptops, tools that all support MFA. Everything the controls ask for — MFA, automatic updates, screen locks, built-in firewalls, Defender — is included in software you already pay for. The assessment fee at your size is £320–£440 + VAT, or £500 once you reach 50 people (confirm the current table on iasme.co.uk), and most small businesses spend nothing else on kit unless a device has aged out of support.

The three blind spots at this size

• Personal phones. Half the team reads work email on their own phone, and each of those phones is in scope under the BYOD rule. Small businesses miss this more than any other rule.
• The forgotten tools. The one-person design app, the shared social logins, the accounting tool from 2019 — all cloud services, all needing MFA. One missed account fails the user-access section; the MFA gap checker exists for exactly this sweep.
• The old machine. The spare laptop in the cupboard, still on an unsupported Windows. In scope and switched on, it fails the assessment by itself — the one problem with no free fix.

The realistic plan for a business your size

1. One hour: list every device (with OS versions), every router, every cloud service including social accounts — the asset register template is the sheet.
2. One team sitting: MFA enrolment, everyone’s phone in hand. Ten minutes per person per tool, done once instead of chased for a month.
3. One afternoon: the secure-configuration sweep — uninstall, old accounts, screen locks, auto-run — device by device.
4. One evening: the short policies. The free tools on this site produce the password policy, the BYOD policy, the patch management statement, the user access policy and the scope statement, plus an asset register spreadsheet.
5. Then buy the assessment from a certification body and transfer answers that are already true.

A tidy business lands this in one to two weeks around the day job; the timing guide has the honest ranges for messier starting points.

Who should own it internally

The person who knows where things are — usually the owner or office manager — not the most technical person, because the job is inventory and coordination more than technology. Give them this plan and the authority to book the team sitting. If IT is outsourced, the provider executes settings, but the answers and the declaration stay with the business, and the provider’s own admin logins are in scope too.