Cyber Essentials as a sole trader: small scope, same certificate
One laptop, one phone, a handful of cloud tools — and a client who just asked for the certificate anyway. Being tiny doesn’t exempt you, but it does make this the simplest version of the assessment there is. Here is the whole path.
Yes, sole traders get asked — and certified
Certification doesn’t care about headcount: public-sector contracts and larger clients ask their suppliers regardless of size, and subcontractors get asked because their client was. The scheme prices for it — the micro tier (0–9 employees) carries the lowest assessment fee, £320 + VAT on the widely published 2026 table (confirm on iasme.co.uk) — and the certificate you receive is exactly the one a 200-person firm gets. If you’re new to it, here is the scheme in plain English. What it costs once your time and any help are counted is in the cost guide, and the cost calculator works it out for a one-person business.
Your scope, honestly small
Scope is whatever touches work data, and for most sole traders that is refreshingly short: the laptop; your phone, in scope under the BYOD rule the moment work email is on it; your home broadband router not in scope (you didn’t buy it through the business — the laptop’s built-in firewall is what counts); no servers; and your cloud services — email, accounting, file storage, and the business social accounts, which count too. Write that list down with OS versions and you have answered a third of the questionnaire; worked example 1 in the scope guide is precisely this setup.
The five controls when you’re the whole company
- Firewalls: the laptop’s software firewall on. That is genuinely it for most sole traders.
- Secure configuration: uninstall what you don’t use, screen locks on laptop and phone (a PIN of at least 6 characters, where it only unlocks the device), auto-run left asking.
- Updates: automatic updates on, and the hardware honest — a laptop or phone that has aged out of support fails you on its own, so check before you pay.
- User access: MFA on every service — including LinkedIn and the accounting tool. With one user this is an hour, once.
- Malware: Defender on Windows; on a Mac, anti-malware or allow-listing (the malware protection guide covers both); on the phone, official app stores plus your own short list of approved apps.
“Do I really need processes?”
The questionnaire still asks how accounts are created, how leavers are handled, what happens when a password leaks. As a company of one, first-person answers are legitimate: “I create accounts as needed; there are no other users; if I suspect a compromise I change the password immediately and review recent sign-ins.” Short written versions are still worth keeping — they make renewal a re-read instead of a rethink, and the free password policy generator gives you the first one in a minute.
The honest afternoon
- List the laptop, the phone and every cloud tool, with versions (20 minutes).
- MFA on everything (an hour, mostly scanning QR codes).
- The settings sweep: locks, updates, uninstall (an hour).
- Write the one-page answers (an hour).
- Buy the assessment at the micro fee and transfer the answers.
If the hardware is current, this is the assessment at its absolute simplest — the checklist will show most boxes already tickable, and the free Cyber Essentials check asks nine of the questions in about two minutes.
Frequently asked questions
Can a sole trader get Cyber Essentials?
Yes. The scheme has a micro tier (0–9 employees) at the lowest assessment fee, and one-person businesses certify routinely — usually because a client or a public-sector contract asked.
What is in scope for a sole trader?
Whatever touches work data: typically one laptop, one phone (yours, under the BYOD rule if it reads work email), your home router only if a business owns it (it usually doesn’t), and your cloud services — email, accounting, storage, and business social accounts.
How much does it cost a sole trader?
The micro assessment fee — £320 + VAT on the widely published 2026 table (confirm on iasme.co.uk) — plus your time. The controls themselves are settings in software you already have.
Do I need any policies as a one-person business?
The questionnaire still asks how things are done, and short written answers still help — a scope statement, an asset list, and a few lines on passwords, updates and what you’d do about a compromised account. “I do X” is a perfectly good process description when you are the whole company.