Cyber Essentials
Cyber Essentials as your starting point
NCSC chief executive Dr Richard Horne described Cyber Essentials as where to begin. Ministers have announced a discount for smaller businesses.
Last reviewed against NCSC, SecurityWeek and The Register. Sources
The message
Begin here, then build
The offer
The announced discount
Government announced a 75% cut in the price of Cyber Essentials for micro, small and medium-sized firms applying for a first certificate [5]. The reduced price was put at between £80 and £125, plus VAT, by Infosecurity Magazine [6]. Confirm current terms and eligibility with a certification body before applying, because our sources are press reports of the announcement.
Beyond it
Larger operators
In its patch wave advice the NCSC recommends Cyber Essentials, or the Cyber Assessment Framework for those running essential services such as energy, healthcare, transport, digital infrastructure or government [3].
Realistic limits
What certification does not do
Cyber Essentials covers basic controls. It does not replace an incident response plan, tested backups or a supplier review, all of which feature in the NCSC's priorities [7]. Treat it as the floor.
Supply chain
The wider scheme
A further scheme, the Cyber Resilience Pledge, has attracted more than 230 signatories according to Infosecurity Magazine; those signatories can refer smaller suppliers for free certification [6]. If a larger customer asks about your certificate, ask whether they take part. The report adds that selected businesses get a free cyber security adviser [6].
Next
Related pages
The preparation page gives the full sequence, and access routes covers the controls most closely tied to incidents.
Keep reading
Read next
Is AI-powered ransomware already hitting UK organisations?
The NCSC's AI ransomware warning is a forecast to 2028. What responders have seen so far, and what has not been confirmed.
Read the guide
What does the NCSC mean by 'highly likely'?
The NCSC uses the PHIA probability yardstick. What highly likely, almost certain and realistic possibility signal in its AI assessment.
Read the guide
Does the NCSC's AI warning affect a small business?
The forecast targets critical infrastructure, but the NCSC's advice and the Cyber Essentials discount reach smaller UK businesses. What to do.
Read the guideHow CyPro can help
Need a hand getting ready?
Reading the rules is one job. Mapping them to your organisation, closing the gaps and showing the evidence are several more. CyPro's consultants can take any of them off your plate.
Fractional CISO for the board
A senior security lead who advises the board on what to fix first, what to accept and what to tell customers, and owns the decision record.
More on cypro.co.uk
Penetration testing
A focused test of your systems and the controls around them, so you know they hold before an attacker finds out for you.
More on cypro.co.uk
Hardening and segmentation
Our consultants put the controls in place that limit the damage when something is missed: firewall rules, network isolation and tighter admin access.
More on cypro.co.uk
24/7 security monitoring
Our SOC analysts watch your systems day and night for the signs of an attack in progress: unexpected processes, new outbound connections, logins that do not fit.
More on cypro.co.uk
Incident response
If you may already be compromised, our responders contain it, preserve the evidence, find out what was touched and get you running again safely.
More on cypro.co.uk
Vulnerability scanning
Find every internet-facing system you run, including the forgotten ones, and see which are still on a vulnerable build.
See the scanning service
Get ready
Need to know what this means for you?
The NCSC points operators of essential services to the Cyber Assessment Framework. CyPro can assess how well your organisation meets it and set out the resilience work that matters most.