Cyber Essentials for 1–5 Employees
If you're running the business on your own or with just a few people, Cyber Essentials is usually far more straightforward than you'd expect. There's no dedicated IT department to coordinate, so most of the work is confirming that the laptops, phones and cloud accounts you already use every day are set up sensibly, not buying anything new. Because the scope is small, this is typically the quickest bracket to get certified in, since there's less to configure and check.
What's different at this size
For most micro businesses, scope is simply everything you use to run the business: your laptop, phone, and whatever cloud services like email or invoicing you rely on. There's rarely a reason to try to narrow it down further at this size.
Typical vulnerabilities
- Personal devices used for work
- No formal password policy
- Consumer-grade router or firewall
- Software updates left switched off or ignored
Steps to get certified
A guided, hands-on path from scoping to certificate, no jargon, no guesswork.
Scoping
We agree the boundary of your assessment: a device, a network, or your whole organisation.
Self-Assessment
Complete a guided questionnaire against the five technical controls, with our support throughout.
Review
We check your submission and flag anything that needs addressing before it goes for formal assessment.
Certification
Your certificate is issued, backed by IASME/NCSC accreditation, valid for 12 months.
Questions from 1–5-employee businesses
Yes, most micro businesses complete Cyber Essentials without any dedicated IT support. The self-assessment questionnaire is designed to be answered by the business owner, and we're on hand to explain any question that isn't clear in plain English before you submit it.
Usually not. Certification checks how your existing devices and accounts are configured, things like automatic updates being switched on and a screen lock being set, rather than what brand or age they are. If something genuinely can't meet a requirement we'll flag it early, so there are no last-minute surprises.
It does. Any personal device that accesses business email, files or systems needs to meet the same baseline controls as a company laptop, things like a passcode and up to date software. It's one of the most commonly missed areas for sole traders, so it's worth checking before you start.
Most micro businesses complete the process within 3 to 5 working days of starting the assessment. The main thing that slows it down is leaving questions unanswered or unsure, so talking through anything unclear upfront tends to keep it on track.
Latest from the blog
Browse by company size
Get certified in as little as 5 days
Tell us a little about your organisation and we'll send an itemised quote, no obligation, no sales call required to get pricing.