Is Cyber Essentials worth it?

What are the advantages of Cyber Essentials?

Cyber Essentials has five practical advantages: it blocks the most common internet-based attacks, it qualifies you for contracts that require it, it brings included insurance for eligible organisations, it puts you on the public certificate search, and it makes you re-check your estate every year.

1. Protection against common attacks. The NCSC requirements v3.3 set five technical controls (firewalls, secure configuration, security update management, user access control and malware protection), each aimed at reducing exposure to attacks from the internet.
2. Access to contracts. Under PPN 014, central government, agencies, non-departmental public bodies and NHS bodies must ask for it in relevant procurements from 24 February 2025, and many private buyers write it into supplier terms.
3. Included cyber insurance. The Danzell question set states that organisations with a head office in the UK or Crown Dependencies and turnover under £20 million can opt in to cyber insurance at no extra cost when certified (A3.1, A3.2).
4. Public proof. Certified organisations, and any included legal entities, appear on the Cyber Essentials certificate search and the Supply Check Tool, according to the A1.6.1 guidance.
5. An annual health check. Renewing means re-running the inventory, the patch report and the MFA check, which catches drift before an attacker does.

The NCSC Annual Review 2025 reports that organisations with Cyber Essentials are 92% less likely to make a claim on their insurance, based on data from the Cyber Essentials insurance company (NCSC Annual Review 2025). The same review counts 39,790 Cyber Essentials and 12,850 Cyber Essentials Plus certifications awarded, and says 75% of Cyber Essentials certifications were renewals.

How much does Cyber Essentials cost?

The IASME scheme fee for Cyber Essentials self-assessment is £320 to £600 plus VAT, set by headcount. See the cost page for every band.

By band: £320 for 0 to 9 staff, £440 for 10 to 49, £500 for 50 to 249 and £600 for 250 or more, ex VAT. That is the full cost of a direct self-assessment. Assessor-supported certification adds a review of every answer before submission; Precursor's is from £1,500 with the fee included, and Cyber Essentials Plus from £3,000.

The cost that matters is remediation. A gap analysis typically finds unsupported operating systems, cloud services without enforced MFA and administrators using their admin accounts for email. Fixing those is where the time goes, and it is also where the security benefit comes from.

When is Cyber Essentials clearly worth it?

Cyber Essentials is clearly worth it when a customer, tender, insurer or funder asks for it, or when you hold personal data and have no other security framework.

When someone is asking. A contract, a tender, a prime contractor, an insurer or a funder that names Cyber Essentials makes the decision for you, and the certificate is a small fixed cost against the value of the work. Question A1.10 asks which of these applies, and most applicants have an answer.

When you handle personal data at any scale and have no other security framework. The five controls are the NCSC's baseline against common internet-based attacks, and a certificate is dated, independent evidence that you had them in place.

When you want the included insurance. Eligible organisations (UK or Crown Dependency head office, turnover under £20 million, whole-organisation scope) can opt in to cyber insurance at no additional cost, according to the Danzell question set. IASME describes the cover as a £25,000 limit with a 24-hour incident helpline; the policy documents set the exact terms. See Cyber Essentials and cyber insurance.

When is Cyber Essentials not the right answer?

Cyber Essentials is not the right answer when you need governance assurance, or when you cannot bring your estate into line with the controls.

When you need governance assurance. If a customer's questionnaire asks about risk assessment, incident response, supplier management and training, they are describing ISO 27001 or IASME Cyber Assurance. Cyber Essentials answers a few of those questions, not most.

When you cannot bring the estate into scope. An organisation that runs an unsupported operating system it cannot replace or segregate will fail A6.1, and a certificate obtained by describing the estate inaccurately is a liability, not an asset. Fix the estate first, or certify a properly segregated sub-set.

When you would treat it as the whole answer. The controls are a floor. Backups, monitoring and a tested response plan sit on top.

Should you certify, or just implement the controls?

Certify if anyone outside the business needs proof; implement the controls alone only if nobody will ask.

You can implement the five controls without certifying, and you will get most of the security benefit. Certification adds four things: an entry on the public register that customers and insurers can check, the included insurance, a forcing function that makes someone read the requirements (A1.11 asks whether you have) and gather the evidence, and an annual cycle that catches drift.

For a sole trader with no clients asking, implementing the controls is a reasonable choice. For anyone with customers, a supply chain or personal data, the certificate is the cheaper way to prove it.

How do you decide whether Cyber Essentials is worth it?

Answer two questions: is anyone likely to ask for it in the next year, and would your estate pass today? If either answer points to a gap, certification is worth it.

List who might ask for it in the next year: customers, tenders, insurers, funders. Check whether any device or software in the business is out of support. Check whether MFA is enforced on every cloud service for every user. If someone might ask, or if either check turns up a problem, the certificate is worth it and the checks have just told you what the gap analysis will find.