Cyber Essentials for Northern Ireland small businesses: what it is and whether you need it

Cyber Essentials is one of the most searched-for terms among small business owners worried about cyber security, and one of the least understood. This guide explains what it is, what it checks and how to decide whether to get certified.

What Cyber Essentials is

Cyber Essentials is a UK government-backed scheme. The NCSC describes it as helping organisations stay safe by making sure five technical controls are in place, aimed at protecting against the most common online threats. The NCSC's own wording is that most cyber attacks are basic in nature, "the digital equivalent of a thief trying your front door to see if it's unlocked".

The five controls

Control	The NCSC's short description
Firewalls	Create a security filter between the internet and your network
Secure configuration	Set up computers securely to minimise ways that a cyber criminal can find a way in
Security update management	Prevent cyber criminals using vulnerabilities in software as an access point to your systems
User access control	Control who can access your data and services and what level of access they have
Malware protection	Identify and immobilise viruses or other malicious software before it can cause harm

In plain terms: a properly set-up network, devices that are configured and kept updated, people who only have the access they need, and protection against malicious software.

Cyber Essentials and Cyber Essentials Plus

	Cyber Essentials	Cyber Essentials Plus
What it is	A verified self-assessment, signed off by a board member or equivalent and marked by an assessor	The same five controls, with independent technical testing
Assurance	Baseline	Higher
Pricing approach	Priced by the size of your organisation	Quoted, based on the size and complexity of your network

Most small businesses start with the basic level. Plus is worth considering if a customer asks for it or you want proof that the controls work in practice.

How to get certified

The NCSC describes two routes:

• Self-led. Register through IASME, the NCSC's official Cyber Essentials Delivery Partner, pay, complete the assessment, have it signed off and marked.
• Supported. Use a certification body licensed by IASME to help you understand the questions and get ready.

The NCSC points to free help: a readiness tool, and a free 30-minute session with an NCSC-assured Cyber Advisor for small and medium-sized businesses.

Is it worth it?

Reason it can be	Why
A customer or tender asks for it	Some buyers, especially larger organisations and public bodies, ask suppliers for certification. Check the specific requirement.
It gives you a checklist	Even if you never certify, the five controls are a sensible list to work through
Insurance	NCSC states that a UK organisation with turnover under 20 million pounds that certifies its whole organisation is automatically entitled to cyber liability insurance arranged through IASME, including incident response support. Read the terms before relying on it

It is not a guarantee. Certification shows the controls were in place at assessment. It does not make you immune, and it does not cover everything, such as how staff handle suspicious emails.

What to do first if you are not ready

The NCSC's Small organisations guide to cyber security lists actions, many of which it says take as little as five minutes. Good places to start:

• Turn on two-step verification for email and key accounts.
• Keep devices and software updated.
• Back up the data you cannot afford to lose, and test restoring it.
• Use strong, different passwords, ideally with a password manager.
• Teach staff to spot scam messages, and agree who to tell if something looks wrong.

Where Logic NI fits

We build and look after websites and business systems, and we keep them updated, backed up and access-controlled. We do not issue Cyber Essentials certificates, and we are not a certification body. If you want help keeping the systems we build secure, see managed support or get in touch.