How to earn Cyber Essentials certification

The UK's government-backed security standard provides reassurance for you and your customers. Nik Rawlinson explores what's involved - and how to get it

If your business has any kind of internet connection, it’s at risk. In a recent survey by Deloitte, a full third of executives said their accounting and financial data had been targeted over the past 12 months; in 2022, an incredible three-quarters of organisations polled reported that they’d been the subject of an attempted ransomware attack.

And things are unlikely to get any better any time soon. As AI and machine learning go mainstream, the potential for malicious actors to cause harm is only increasing. Your organisation must be ready to defend itself – and you need to be able to prove it to potential customers and partners. If not, they’ll understandably be hesitant to rely on your services and trust you with their data.

For small businesses, the Cyber Essentials certification programme is a great solution. It’s accredited by the UK government and delivered by the IASME consortium (iasme.co.uk), which became the National Cyber Security Centre’s (NCSC) sole Cyber Essentials Partner in April 2020.

Cyber Essentials provides a clearly defined, widely recognised security framework, which can save you from having to formulate policies and practices from scratch. The guidance is broad and, for the most part, non-prescriptive, so it can apply to a wide range of business types; rather than mandating specific tools and settings, it guides companies through assessing their exposure, identifying possible vulnerabilities and implementing whatever measures are necessary to close them off.