Yes, for most Small to Medium sized businesses, Cyber Essentials is worth it. Its low cost compared to other IT projects, takes most businesses a few weeks to complete correctly and covers around 80%% of common threats that we see today. More increasingly, we are seeing Cyber Essentials becoming necessary to win contracts, especially in the government, defence or manufacturing sector.

What is Cyber Essentials?

Cyber Essentials is a UK government backed cybersecurity certification that shows your business has basic cybersecurity controls in place. We’ve covered what’s involved in getting certified in our blog here, this post focuses on whether its worth doing in a small business.

How much does Cyber Essentials Cost?

The official IASME fee is between £300 and £500 plus VAT, depending on the size of your business. This doesn’t include any costs associated with getting your business at a secure enough level to pass Cyber Essentials or Cyber Essentials Plus.

We would predict most SMBs could expect to pay around £5,000 to go through the process, start to finish. This cost may seem high, however, if your business is tendering for large government contracts, this can pay for itself.

It’s also worth noting, the average UK business loses an average of £1,600 to £3,550 to a single cyber attack, according to the government. This alone could almost pay for the whole certification process.

What are the Downsides of Cyber Essentials?

The downside of Cyber Essentials is that it only covers the basics as opposed to being a bespoke security programme tailored to your business. Companies which are certified can still be attacked. It also doesn’t include important areas such as security awareness training for staff and physical security. Its a good measure of the basic, best practices for cyber hygiene as opposed to a bulletproof system.

Cyber Essentials is also just a snapshot, not an ongoing guarantee of security. If you stop practicing the security measures you put in place to pass, you will lose the positive security posture you implemented. This means you need to ensure compliance throughout any business changes e.g. new starters or new software.

Do you need to Renew Cyber Essentials?

Yes, Cyber Essentials does require renewing every year. This means that is a reoccurring annual cost as opposed to a one off charge. This means you will have to be reassessed every year to ensure compliance. For some very small businesses, this reoccurring cost may mean that it really isn’t worth doing.

Who Cyber Essentials isn’t Worth it For

For most businesses, we say Cyber Essentials is worth it. However, for sole traders or startups, we say its probably not worth doing just yet. This is because your systems may change frequently whilst in the infancy of your business. It’s not worth investing in establishing these systems until you know they are there to stay and work for your exact needs.

Outside of those situations, however, we would recommend researching and making contact with a company who can provide Cyber Essentials. Three Cherries have a case study found here on deploying Cyber Essentials for Bristol Dockyards , a famous visitor attraction based in the heart of Bristol (Formerly the SS Great Britain).

Is Cyber Essentials Worth It?

Yes, for most small businesses, Cyber Essentials is worth it. It costs a relatively small amount, takes a few weeks to sort and closes off your business to around 80% of common cyber attacks. Although it cannot guarantee you’re never the victim of a breach, it does help protect your business. It also comes with a free £25,000 in cyber liability insurance which is worth its weight in gold.

Not sure where your business stands with Cyber Essentials? Get in touch with the team at Three Cherries. We can take a look at your current setup, tell you where any gaps may be and get you ready to pass. Click here to drop us a message!