Cyber Essentials for 5–20 Employees
Once you've got a small team, a few shared systems tend to creep in, things like a shared drive, a CRM, or a joint email inbox, and Cyber Essentials starts to check how consistently those are locked down across everyone, not just how one laptop is configured. Certification at this size is still very achievable without a dedicated IT hire, though it takes a bit more coordination to make sure nobody becomes the weak link. Most businesses in this bracket haven't needed to think about scoping yet, and usually still won't.
What's different at this size
Scope at this size usually still covers the whole company, but now includes the cloud services your team logs into every day, such as email, CRM or accounting software, alongside the physical devices. It's worth listing these out before you start, since it's easy to forget one.
Typical vulnerabilities
- Shared admin logins
- Unmanaged personal devices (BYOD)
- Inconsistent patching across devices
- Leaver accounts not disabled promptly
Steps to get certified
A guided, hands-on path from scoping to certificate, no jargon, no guesswork.
Scoping
We agree the boundary of your assessment: a device, a network, or your whole organisation.
Self-Assessment
Complete a guided questionnaire against the five technical controls, with our support throughout.
Review
We check your submission and flag anything that needs addressing before it goes for formal assessment.
Certification
Your certificate is issued, backed by IASME/NCSC accreditation, valid for 12 months.
Questions from 5–20-employee businesses
Any device that can access your business email, files, or cloud systems needs to be included, regardless of who owns it. For a small team this usually just means agreeing a short, sensible policy for personal devices rather than replacing them.
Generally yes, if staff log into them to do their jobs, they're part of your scope. The good news is that most mainstream cloud services already support the settings Cyber Essentials asks for, like multi-factor authentication, so it's often a case of switching things on rather than changing supplier.
It can be, plenty of businesses this size pass without a full time IT role. What matters is that someone is accountable for things like updates and account access, and that those responsibilities are actually being carried out consistently, not just assigned on paper.
It's worth telling us before you submit, since new starters mean new accounts and devices that need to meet the same baseline. Whether that changes anything for your certification depends on your specific setup, so it's worth building account setup and offboarding into your normal hiring process so it doesn't become a gap later.
Latest from the blog
Browse by company size
Get certified in as little as 5 days
Tell us a little about your organisation and we'll send an itemised quote, no obligation, no sales call required to get pricing.