How to get Cyber Essentials certified: the step-by-step route for a small business
From “a client has asked for it” to a certificate in your inbox, in the order that actually works: find your gaps first, fix the automatic fails, write the short policies, then buy the assessment. Most small businesses can do this in a couple of weeks of spare hours.
Before you start: three things to know
- You cannot buy your way past the questions. Cyber Essentials is a self-assessment reviewed by an assessor. Whoever helps you, the answers describe your business, and they have to be true on the day you submit.
- Only a certification body certifies. You will buy the assessment from an IASME-licensed certification body; consultants and software, including ReadyCert, help you prepare and cannot award the certificate.
- Four things fail the assessment on their own: a cloud account without MFA where MFA is available, a cloud service wrongly listed as having no MFA, an unsupported operating system, and high-risk, critical or unrated security updates taking longer than 14 days. Everything else is a gap to close; these are the ones to clear first.
Step 1 — Work out what is in scope
Write down every laptop, desktop, phone and tablet used for work (including staff’s own phones if they read work email), with the make and exact operating-system version; every router and firewall your business owns, with make and model; any servers (most small businesses have none); and every cloud service you sign into, including business social-media accounts. For nearly every small business the scope is “the whole organisation”. The scope guide has the rules and five worked examples.
Step 2 — Find your gaps, automatic fails first
Go through the five controls honestly. The free interactive checklist lists every question as a tick-box with the official number beside it; the readiness check asks you the questions in plain English and shows the result control by control. Either way, look at the automatic fails before anything else:
- Is MFA switched on for every user and every admin on every cloud service that offers it? One account without it fails the whole user-access section.
- Is every device on a supported operating system? A retired version of Windows or macOS anywhere in scope is a fail.
- Do high-risk, critical and unrated security updates always go on within 14 days? If updates are manual or monthly, the honest answer is usually no.
Step 3 — Fix the gaps
The fixes are mostly settings. Switch on two-factor login in each cloud service — ten minutes per tool; check it’s on for every user. Turn on automatic updates in Windows, macOS and your browsers. Change the admin password on the router from the factory default. Make every phone and laptop lock with a fingerprint, face, password or PIN (at least 6 characters). Remove software and accounts nobody uses. Give each person their own login and make sure admin accounts are separate from everyday ones. The expensive case is a device that cannot run a supported operating system: that has to be upgraded, replaced, or genuinely removed from scope — see the unsupported software guide.
Step 4 — Write the short policies
The questionnaire asks how you do things, and the cleanest way to answer consistently is to have written it down. For a small business these documents are short by design: a scope statement and asset list; a page on passwords and authentication; how joiners get accounts and leavers lose them; how administrator accounts are controlled; and short statements on updates, malware protection and your firewall. If staff use their own phones, a personal-devices policy too. The free password policy generator produces the first of these; ReadyCert drafts all of them from your answers.
Step 5 — Choose a certification body and buy the assessment
Any IASME-licensed certification body sells the same assessment at the same IASME-set fee for your organisation size. They differ in what they add: some include a call to go through your answers, some offer consultancy, some simply review what you submit. Pick one, pay the fee, and you will receive access to the online questionnaire portal.
Step 6 — Answer the questionnaire and submit
Transfer your answers into the portal. The questions are the official ones — worded for assessors — so have your scope statement, asset list and policies open beside you, and answer exactly what is asked. Where a question has a yes/no and a free-text part, the free text is where you show the assessor you understood it. Submit when every answer is true today, not when it will be true next week.
Step 7 — The assessor’s review
An assessor at the certification body reviews your answers against the requirements. If everything meets them, you are certified and receive the certificate and a digital Cyber Essentials badge you can display on your website. If something does not, they tell you what — and the resubmission process and any time limit depend on the certification body’s terms, so ask about that when you buy. The surest way to avoid it is Step 2.
Step 8 — Stay ready for renewal
The certificate lasts twelve months. The question set is updated roughly annually, so next year’s assessment may be stricter than this one — keep automatic updates on, keep MFA on for every new account and every new starter, and note in your calendar when the year is up. The 2026 changes guide shows how much moved last time.
Frequently asked questions
Where do I apply for Cyber Essentials?
You buy the assessment from an IASME-licensed certification body. They give you access to the online questionnaire portal, review your answers and issue the certificate. IASME publishes a list of licensed bodies.
How long does it take to get Cyber Essentials?
The questionnaire itself can be answered in an afternoon once you know your answers. Finding them — listing devices and cloud services, switching on MFA everywhere, fixing gaps — is where the time goes. A tidy small business can be ready in a couple of weeks of spare hours.
Can I do Cyber Essentials myself without a consultant?
Yes. The self-assessment is designed to be completed by the business itself. The difficulty is that the questions are written for assessors; software or a consultant can translate them, but the answers are yours either way.
What happens if I fail Cyber Essentials?
The assessor tells you what did not meet the requirements. Whether and when you can resubmit, and at what cost, depends on the certification body’s terms, so ask when you buy. The way to avoid it is to find the automatic fails — MFA, unsupported software, the 14-day update rule — before you submit.
Do I need evidence or screenshots?
Usually not at the basic level — you answer in writing — but your certification body can ask for evidence. Cyber Essentials Plus is where devices are tested hands-on.