Cyber Essentials for Retail & E-commerce
Online retailers hold customer payment details, order histories and account credentials that are directly valuable to criminals, and card skimming attacks that quietly inject malicious code into a checkout page have hit retailers of every size, not just large chains. Certification sits alongside, rather than replaces, your PCI DSS obligations if you handle card payments, and it gives customers a recognisable signal of trust at a point where online shoppers are increasingly wary about where they enter their card details. Account takeover, where a criminal reuses stolen passwords from another breach to log into a customer's account on your site, is also a growing problem that basic security hygiene helps reduce.
Why it matters for retail & e-commerce
Online retailers hold customer payment details, order histories and account credentials that are directly valuable to criminals, and card skimming attacks that quietly inject malicious code into a checkout page have hit retailers of every size, not just large chains. Certification sits alongside, rather than replaces, your PCI DSS obligations if you handle card payments, and it gives customers a recognisable signal of trust at a point where online shoppers are increasingly wary about where they enter their card details. Account takeover, where a criminal reuses stolen passwords from another breach to log into a customer's account on your site, is also a growing problem that basic security hygiene helps reduce.
This covers online retailers, e-commerce businesses and any business that takes payments or stores customer personal data through a website or online store.
Common threats faced
- Card skimming (Magecart)
- Account takeover
- Payment fraud
- Website plugin vulnerabilities
Steps to get certified
A guided, hands-on path from scoping to certificate, no jargon, no guesswork.
Scoping
We agree the boundary of your assessment: a device, a network, or your whole organisation.
Self-Assessment
Complete a guided questionnaire against the five technical controls, with our support throughout.
Review
We check your submission and flag anything that needs addressing before it goes for formal assessment.
Certification
Your certificate is issued, backed by IASME/NCSC accreditation, valid for 12 months.
Services we recommend for retail & e-commerce
Retail & E-commerce questions
Yes, using a reputable payment provider reduces your card data exposure but doesn't remove the need for basic security on your own website, staff accounts and customer data. Attackers frequently target the surrounding website and admin systems rather than the payment provider itself, which is exactly what Cyber Essentials looks at.
They're separate requirements that address different things. PCI DSS is specifically about how card payment data is handled and is usually required by your payment provider or acquiring bank, while Cyber Essentials is a broader, general check of your organisation's IT security. Meeting one doesn't automatically mean you meet the other, so treat them as complementary rather than interchangeable.
The platform provider's own infrastructure is typically outside your scope, but keeping the plugins and extensions you've installed updated, and controlling who has admin access to your store, is very much part of the assessment. Outdated plugins are a common route attackers use to inject skimming code, so this is worth taking seriously beyond just the certification itself.
It can help, particularly with customers who've become more cautious about entering card details online after high profile retail breaches, though most shoppers won't recognise the badge without some explanation of what it means. Pairing it with a plain English line about how you protect customer data tends to work better than the badge alone.
Latest from the blog
Browse related sectors
Get certified in as little as 5 days
Tell us a little about your organisation and we'll send an itemised quote, no obligation, no sales call required to get pricing.