Untitled

You have probably seen Cyber Essentials listed as a requirement on a tender document, or had a larger client ask whether you hold it before they sign. That question is becoming routine. More UK buyers now treat the certificate as a basic condition of doing business, and suppliers without it get quietly filtered out.

Here is what Cyber Essentials actually is, what it protects against, and how to get certified without the process eating your week.

What is Cyber Essentials?

Cyber Essentials is a UK government-backed certification that confirms your business has the core controls in place to defend against the most common cyber attacks. You complete a structured self-assessment questionnaire, then an accredited certification body reviews it independently.

The scheme targets the everyday threats that hit small and medium firms hardest: phishing, malware, and attacks that exploit unpatched software or weak configuration. Get these basics right and you stop the large majority of opportunistic attacks before they start.

The five controls it covers

Cyber Essentials checks five technical controls:

Firewalls and secure internet gateways that keep untrusted traffic out.

Secure configuration so devices and software ship without risky default settings.

Access control that limits who can reach what, and removes rights people no longer need.

Malware protection running across your devices.

Security update management so patches land before attackers exploit the gap.

None of these are exotic. Most breaches at SME level trace back to one of them being missed.

Cyber Essentials vs Cyber Essentials Plus

There are two levels, and the difference matters for contracts.

Cyber Essentials is a 70-question self-assessment, verified independently, that confirms your setup lines up with the framework.

Cyber Essentials Plus covers everything in the basic level, then adds a hands-on technical audit. An assessor tests your systems with vulnerability tools to prove the controls hold up in practice, checking patch levels, malware protection, device configuration, user access, and internet-facing security.

You cannot jump straight to Plus. You pass the basic questionnaire first, because the Plus audit verifies the answers you gave. Once you hold the basic certificate, you have 90 days to complete Plus.

Why it is worth doing

Three reasons come up again and again with our clients:

You win more work. Many government frameworks and enterprise buyers will not engage a supplier without Cyber Essentials. Holding it keeps you on the shortlist.

You cut real risk. The five controls block the bulk of common attacks, which protects your data, your clients, and your reputation.

You strengthen the rest of your security. Cyber Essentials sets a recognised baseline. Plenty of our clients earn it, add Cyber Essentials Plus, then progress to ISO 27001 as their compliance needs grow.

What it costs and how long it lasts

Support at Intouch Tech starts from £420 + VAT. The certification fee itself follows a tiered scale set by company size, using the standard micro, small, medium, and large definitions. On top of that, we charge to run the whole project for you, priced on the size and complexity of your network. You get the full figure up front, with no surprises later.

Each certificate lasts 12 months. You renew annually to stay certified and keep meeting buyer requirements.

Timing is quicker than most owners expect. Many businesses certify within 7 to 10 working days, and the full process usually wraps up in 2 to 4 weeks.

How Intouch Tech gets you certified

Our in-house cyber team runs the whole thing, so you are not left decoding technical requirements on your own. It works in four steps:

Discovery call. We assess your needs and recommend the right level.

Cyber readiness and gap support. We prepare everything the assessment needs and fix what would otherwise fail.

Submission and independent assessment. Your certification is reviewed and issued through an accredited provider.

Certification achieved. You receive your official Cyber Essentials certificate.

We are a UK-based team, working with businesses since 2012, rated 4.9 on Trustpilot across more than a thousand UK organisations, with certification handled by an independent accredited body and penetration testing delivered through a CREST-accredited partner.

Frequently asked questions

Do I need Cyber Essentials to win contracts? Often, yes. Many government and enterprise buyers will not work with suppliers who lack it.

How much does certification cost? Support starts from £420 + VAT. The exact figure depends on your company size and network complexity, and we confirm it before you commit.

How long does it take? Most businesses certify within 7 to 10 working days, with the full process typically complete in 2 to 4 weeks.

How long does the certificate last? Twelve months, then you renew to stay certified.

What if we are not ready? Our cyber team fixes the gaps with you before you submit, so you are set up to pass first time.

Can we certify if we are based outside the UK? Yes. Organisations outside the UK can certify too, and we handle the process the same way.

Ready to get certified?

Cyber Essentials does not need to be complicated. With Intouch Tech you get expert guidance, a smooth process, and a certificate you can put in front of any buyer with confidence.

Call 0333 370 7000 or request a free quote to get started.

Somewhere in your business today, a member of staff is pasting a client proposal into a free AI chatbot to tidy up the wording. They are not trying to cause harm. They are trying to get home on time. That single paste is Shadow AI, and it has quietly become one of the fastest-growing security gaps facing UK small businesses.

What is Shadow AI?

Shadow AI is any artificial intelligence tool your employees use for work without approval or oversight from your IT function. It covers free chatbots, browser plug-ins, meeting note-takers that sit in on calls, image generators, and coding assistants. If nobody signed it off and nobody knows what data goes into it, it counts as Shadow AI.

Think of it as the AI-era version of Shadow IT, the old problem of staff using personal Dropbox or Gmail for work files. This version carries more weight, because these tools do not just store your data. They send it to a third-party model provider you have no contract with.

Why SMEs carry more of this risk

Smaller firms sit more exposed than they realise. You rarely have a dedicated security lead. Your people wear five hats each and reach for whatever gets the job done before the next deadline. And unlike a large corporate with a procurement gate, little stands between a curious employee and a free tool that will happily swallow your customer records.

Three risks matter most:

Data leaves your control. Client lists, financial figures, source code, and HR records get pasted into tools that may use that input to train future models.

GDPR exposure. Feeding regulated personal data into a provider with no data processing agreement turns an internal habit into a compliance breach.

A wider attack surface. Every unsanctioned account, login, and plug-in is one more door into your systems that your defences never accounted for.

What to do about it

The instinct is to ban everything. That backfires. Blocking AI outright pushes usage further underground and, in a tight labour market, costs you talent. A better route looks like this:

Run a visibility audit. Ask your teams openly which AI tools they already use, and treat the answers as intelligence rather than an excuse for discipline. You cannot govern what you cannot see.

Give people a sanctioned alternative. Research through 2026 shows unauthorised use drops sharply once staff get an approved tool that matches the functionality they found on their own.

Write a short, readable AI policy. One clear page beats a forty-page document nobody opens.

Train the whole team. Most misuse comes from not knowing the risk, not from bad intent. A short session moves the needle.

Review it often. New tools appear every month, so your approved list and your policy need a regular look.

The practical version, minus the scare tactics

This is the exact ground we cover in our Staying Intouch webinar series, where we walk UK business owners through AI governance and Shadow AI in plain English. No jargon, no fear-mongering, just the steps that keep your data where it belongs.

Intouch Tech supports SMEs across Fleet, Hampshire, and the wider UK with managed IT, cyber security, and telecoms. If Shadow AI is a blind spot in your business, let's talk before it becomes a headline.