UK Cyber Essentials: what small businesses actually need to know
What Cyber Essentials is
Cyber Essentials is a UK government-backed certification scheme (run via the NCSC) that verifies a business has basic technical controls in place against common cyber threats. It's not about advanced defence — it's about the fundamentals that stop the vast majority of opportunistic attacks.
The five control areas
- Firewalls — properly configured boundary firewalls protecting your network.
- Secure configuration — devices and software set up securely, not left on default settings.
- User access control — people only have access to what they actually need.
- Malware protection — up-to-date protection against malicious software.
- Patch management — software and systems kept up to date with security fixes.
Where a website scan fits in
Several of these controls have a directly visible footprint on your public-facing website — TLS configuration, exposed software versions, and security headers all map to "secure configuration." A scan won't get you certified on its own, but it's a fast, free way to see where you stand before you start the formal assessment.