Cyber Essentials certification for UK businesses
Get Cyber Essentials ready: readiness review, device and firewall controls, secure configuration and guidance through certification.
Cyber Essentials is the UK government-backed scheme that shows your business has the basic security controls in place to stop the most common cyber attacks. PurpleBox gets your devices, accounts and network ready, fixes what needs fixing, and guides you through certification.
Why get Cyber Essentials?
- Win work. Many public sector contracts, and a growing number of larger clients, require Cyber Essentials from their suppliers.
- Cyber insurance. Insurers increasingly ask about these controls, and certification can make applications easier.
- Real protection. The five controls block the majority of everyday attacks, such as phishing, password guessing and unpatched software.
- Client confidence. For law firms, accountants and financial services, it is a simple way to show clients you take their data seriously.
The five Cyber Essentials controls
- Firewalls. Every device that connects to the internet is protected by a correctly configured firewall.
- Secure configuration. Default passwords are changed, unnecessary software and accounts are removed, and devices lock automatically.
- User access control. People only have the access they need, admin accounts are separate, and multi-factor authentication is on for cloud services.
- Malware protection. Anti-malware or application allow-listing is running on every device in scope.
- Security update management. Supported software only, with high and critical updates installed within 14 days of release.
Cyber Essentials or Cyber Essentials Plus?
| Cyber Essentials | Cyber Essentials Plus | |
|---|---|---|
| How it's assessed | Self-assessment questionnaire, checked by a certification body | Same questionnaire plus a hands-on technical audit |
| Who it suits | Most small businesses, many supplier requirements | Contracts that handle sensitive data, or where clients ask for Plus |
| Renewal | Every 12 months | Every 12 months |
Cyber Essentials Plus must be completed within three months of the basic certification.
How we get you certified
- Readiness review. We check your devices, Microsoft 365, firewall, Wi-Fi and accounts against the requirements and list exactly what needs to change.
- Fix the gaps. We update and configure devices, turn on MFA, remove unsupported software and set up endpoint protection.
- Prepare the submission. We help you answer the questionnaire accurately, so you don't fail on a technicality.
- Certification. You apply through an independent certification body, which assesses your answers and issues the certificate. PurpleBox prepares you for this but does not issue certificates.
- Stay compliant. With managed IT support, the controls stay in place all year, so renewal is straightforward.
What it costs
Our readiness support starts from £495 + VAT. Any work needed to fix gaps depends on how many devices you have and how far they are from the standard. The certification fee is separate. It is paid to the certification body and depends on the size of your business.
Results
- Meeting cyber insurance requirements without disrupting the business
- Security due diligence before a new system
Frequently asked questions
How long does Cyber Essentials take?
If your systems already meet the controls, certification can be completed quickly. Most small businesses need some changes first, and the time depends on how many devices need work. We will give you a timeline after the readiness review.
Do home workers' devices count?
Yes. Any device used to access company data or services is usually in scope, including laptops at home and phones used for work email.
Do we need Cyber Essentials for government contracts?
Central government contracts that involve handling personal data or providing certain IT services generally require it. Check the tender requirements for each contract.
What happens if we fail?
You get feedback on what didn't meet the requirements, fix it, and resubmit. Our readiness review is designed to catch these issues before you apply.
Do we need to renew?
Yes, certification lasts 12 months.
Ready to get started?
Talk to us about how we can help your business with cyber essentials.
See all solutions