That creates opportunities for attackers, especially when passwords are weak, software is out of date, or systems are poorly configured.

Cyber Essentials helps you reduce that risk.

Backed by the UK Government and developed by the National Cyber Security Centre, the scheme focuses on five practical security controls that protect businesses from many common cyber attacks.

It also gives customers, suppliers and procurement teams clear evidence that your organisation takes cyber security seriously.

Why Cyber Essentials Matters

Cyber attacks continue to affect thousands of UK businesses.

The Government’s Cyber Security Breaches Survey 2025/26 found that 43% of UK businesses had identified a cyber security breach or attack during the previous 12 months.

That increased to:

• 46% of small businesses

• 65% of medium-sized businesses

• 69% of large businesses

Many attacks succeed because of basic security gaps - Cyber Essentials helps you close them.

What Does Cyber Essentials Protect Against?

The scheme helps reduce your exposure to common threats, including:

• Phishing

• Malware and ransomware

• Password attacks

• Unpatched software

• Insecure user accounts

• Poorly configured devices

• Weak firewall settings

No certification can guarantee that an attack will never happen.

Cyber Essentials does, however, help stop many of the straightforward attacks criminals use every day.

The Five Cyber Essentials Controls

Firewalls

Firewalls control traffic between your systems and the internet.

They must be configured correctly, protected with secure passwords and restricted to prevent unnecessary access.

Secure Configuration

Devices and software should not rely on default settings.

You should remove unused software, disable unnecessary services, change default passwords and apply suitable security settings.

User Access Control

Employees should only have access to the systems and information they need.

Administrator accounts must be tightly controlled and protected with strong authentication.

Malware Protection

Your devices need protection from malicious software.

This may include anti-malware tools, browser protection, approved app stores and controls that stop unauthorised software from running.

Security Update Management

Outdated software creates an easy route for attackers.

Security updates must be installed promptly. Unsupported software should be removed or replaced.

Cyber Essentials or Cyber Essentials Plus?

There are two levels of certification.

Cyber Essentials

Cyber Essentials is a verified self-assessment.

Your organisation completes a questionnaire covering its devices, systems, users and security controls.

An approved assessor reviews the answers and confirms whether you meet the required standard. Certification lasts for 12 months.

Cyber Essentials Plus

Cyber Essentials Plus includes the same five controls, followed by an independent technical audit.

An assessor may carry out:

• Vulnerability scans

• Device testing

• Security update checks

• Malware protection tests

• Account and configuration reviews

• Checks on internet-facing systems

Cyber Essentials Plus provides stronger assurance because your controls are tested in practice.

Which Level Do You Need?

Cyber Essentials is a strong starting point for most businesses.

Cyber Essentials Plus may be better suited when:

• A customer requires technical verification

• You handle sensitive information

• You work in a regulated supply chain

• A tender asks for Cyber Essentials Plus

• You want greater confidence in your security controls

The right level depends on your risks, customers and contract requirements.

Who Should Consider Cyber Essentials?

Cyber Essentials can benefit almost any organisation, including:

• Small and medium-sized businesses

• Professional services firms

• Charities

• Schools

• Technology companies

• Cloud service providers

• Government suppliers

• Businesses handling customer or employee data

It is particularly useful when clients ask for proof of your security standards.

Cyber Essentials and Government Contracts

Cyber Essentials is required for some UK central government contracts.

This often applies where suppliers handle sensitive information or provide certain technical services.

It is not required for every public-sector contract, and the tender documents will confirm which level of certification is needed.

The Business Benefits

Cyber Essentials can help your organisation:

• Reduce exposure to common attacks

• Build customer confidence

• Strengthen tender applications

• Meet supply-chain requirements

• Identify security weaknesses

• Support cyber insurance eligibility

• Stand out from competitors

How Jellyfish Can Help

Cyber Essentials is designed to be straightforward; however, preparing for it can still take time.

We can review your IT environment, identify compliance gaps and help you prepare for Cyber Essentials or Cyber Essentials Plus.

We can also support your annual renewal if your existing certificate is due to expire.

To discuss Cyber Essentials with our team, contact:

▷ 02921 202011

▷ hello@jellyfish.solutions