Cyber Essentials for 20–50 Employees
With multiple departments and systems in play, this is often the first size where a genuine conversation about scope makes sense, rather than simply including everything by default. You might have finance running different software to operations, a legacy system nobody's quite ready to retire, or contractors with their own access, and each of those needs a decision, not an assumption. We help you draw a boundary that's realistic to maintain and still stands up to scrutiny.
What's different at this size
Scoping conversations genuinely matter at this size. You can choose to certify your whole organisation or a clearly defined sub-network, but either way the boundary needs to be documented properly so it holds up if a client or the certification body asks how you drew it.
Typical vulnerabilities
- Legacy or unsupported software still in use
- Third-party vendors with standing access
- Growing attack surface across teams
- Multi-factor authentication applied inconsistently
Steps to get certified
A guided, hands-on path from scoping to certificate, no jargon, no guesswork.
Scoping
We agree the boundary of your assessment: a device, a network, or your whole organisation.
Self-Assessment
Complete a guided questionnaire against the five technical controls, with our support throughout.
Review
We check your submission and flag anything that needs addressing before it goes for formal assessment.
Certification
Your certificate is issued, backed by IASME/NCSC accreditation, valid for 12 months.
Questions from 20–50-employee businesses
In some cases, yes, this is exactly the kind of scoping conversation worth having properly rather than guessing. If a system genuinely can't meet the requirements yet, we can help you define a boundary that excludes it while being honest about that limitation, rather than including it and risking a fail.
Every location and remote worker with access to your business systems generally needs to be considered, though how they're included depends on how your network and cloud services are set up. This is one of the areas where a proper scoping conversation genuinely pays off at your size.
Cyber Essentials sets a consistent baseline across whatever's in scope rather than extra tiers for specific teams, but it's still worth reviewing who in finance has access to what, and whether that access is tighter than it needs to be. It's a sensible habit even outside of certification.
Most businesses at your size complete certification within one to two weeks once the scoping conversation is settled. If you've got a contract deadline, telling us upfront helps us prioritise the assessment accordingly.
Latest from the blog
Browse by company size
Get certified in as little as 5 days
Tell us a little about your organisation and we'll send an itemised quote, no obligation, no sales call required to get pricing.