Certification
If a client, a tender portal or your own insurer has asked whether you hold Cyber Essentials, you're dealing with the UK's most commonly requested cyber security certification for small and medium businesses. It's a government backed scheme, overseen by the National Cyber Security Centre (NCSC), built to check five basic technical controls that between them stop the vast majority of everyday cyber attacks: firewalls, secure configuration, user access control, malware protection and security update (patch) management. There are two levels, and it's worth understanding the difference before you start.Read more
What you're actually up against
Phishing & Social Engineering
Employees can be tricked into revealing passwords or sensitive information.
Ransomware
Attackers can encrypt business data and demand payment to restore access.
Weak Passwords
Compromised or reused passwords can provide attackers with access to business systems.
Unpatched Systems
Outdated software can contain vulnerabilities that attackers exploit.
Data Breaches
Sensitive customer, employee and business information can be exposed or stolen.
A bundle of services you can pick and choose from
If a client, a tender portal or your own insurer has asked whether you hold Cyber Essentials, you're dealing with the UK's most commonly requested cyber security certification for small and medium businesses. It's a government backed scheme, overseen by the National Cyber Security Centre (NCSC), built to check five basic technical controls that between them stop the vast majority of everyday cyber attacks: firewalls, secure configuration, user access control, malware protection and security update (patch) management.
There are two levels, and it's worth understanding the difference before you start. Cyber Essentials is a self assessment: you work through a questionnaire about your systems, an independent certification body reviews and signs it off, and you're issued a certificate valid for twelve months. Cyber Essentials Plus checks exactly the same five controls, but adds a hands on technical audit, where an assessor actually tests your devices rather than taking your word for it. Some contracts, particularly public sector and supply chain work, specifically ask for the Plus level rather than standard.
CyberStark is a referral and reseller partner for this scheme, not the certification body itself. In practice that means we get your systems ready, work through the questionnaire and technical requirements alongside you, and coordinate the official assessment through the scheme's own certification process. The certificate itself is always issued by the scheme, never by CyberStark.
Below are the two certification packages we help businesses through: standard Cyber Essentials and Cyber Essentials Plus. Each page covers what's actually involved, what you get as part of the package, and how to work out which one fits what your business genuinely needs.
Certification questions
Cyber Essentials is a UK government backed cyber security certification that checks five basic technical controls, firewalls, secure configuration, user access control, malware protection and patch management, are properly in place. It's completed through a self assessment questionnaire, reviewed and signed off by an independent certification body, and the resulting certificate lasts twelve months.
Both check exactly the same five controls. Standard Cyber Essentials is self declared, you complete a questionnaire and confirm the controls are in place. Cyber Essentials Plus adds an independent, hands on technical audit, where an assessor actually tests your devices rather than relying on your own answers. Plus is generally viewed as the stronger of the two, and some contracts specifically require it.
Cost depends mainly on how many users and devices your business has, and whether you're going for standard Cyber Essentials or the Plus level, which includes the technical audit. Tell us your headcount and we'll give you a clear, straight figure rather than a vague range.
For plenty of businesses, standard Cyber Essentials is a genuinely useful baseline on its own. If a specific client, tender or insurer has explicitly asked for Cyber Essentials Plus though, standard alone won't satisfy that requirement, since Plus is independently verified and standard isn't.
No. CyberStark is a referral and reseller partner for the Cyber Essentials scheme, not the certification body. We prepare your systems, guide you through the requirements and coordinate the official assessment, but the certificate itself is always issued by the scheme's own certification body, never by us.
A Cyber Essentials certificate, standard or Plus, is valid for twelve months from the date it's issued. After that it needs to be renewed through a fresh assessment, it isn't a one off certification you get once and keep indefinitely.
Real people, not just a checklist
A lot of providers hand you a generic package and a login. We hand you a plan built around your business, and people who explain what's actually going on.
Hands-on support
A named specialist guides you through everything, no generic self-service portal.
Structured readiness review
We check your submission is ready before it goes for formal assessment, so you're not caught out by an easy-to-avoid mistake.
Fast turnaround
Certification in as little as 5 working days, security reviews and testing often start within days.
Nothing lapses silently
We track certificate expiry and follow-up scans ahead of time, so your protection never quietly goes stale.
One team, every service
Penetration testing, vulnerability testing, and ongoing monitoring handled in-house by our own team. Certification is coordinated end-to-end by us with an accredited certification body, so you get one point of contact, not several vendors to manage.
Certification pass guarantee
If you don't pass Cyber Essentials first time, we work with you at no extra cost until you do.
Hands-on support
A named specialist guides you through everything, no generic self-service portal.
Structured readiness review
We check your submission is ready before it goes for formal assessment, so you're not caught out by an easy-to-avoid mistake.
Fast turnaround
Certification in as little as 5 working days, security reviews and testing often start within days.
Nothing lapses silently
We track certificate expiry and follow-up scans ahead of time, so your protection never quietly goes stale.
One team, every service
Penetration testing, vulnerability testing, and ongoing monitoring handled in-house by our own team. Certification is coordinated end-to-end by us with an accredited certification body, so you get one point of contact, not several vendors to manage.
Certification pass guarantee
If you don't pass Cyber Essentials first time, we work with you at no extra cost until you do.
Get a clear answer on what your business actually needs.
Free, no-obligation 10-minute call, we'll tell you honestly, even if that means less work for us.
No sales pressure, no confusing quotes. Tell us about your business and your contracts, and we'll tell you exactly which certification and services make sense, and what it'll cost.
Related reading
View allUK Cyber Insurers Are Now Spelling Out Exactly What Controls They Expect
The Association of British Insurers has backed a specific set of security controls. If your business cannot demonstrate them, your cyber insurance policy may not pay out when you need it.
CertificationCyber Essentials Plus for Museums: Which Certification Level Does Your Heritage Organisation Actually Need?
Cyber Essentials or Cyber Essentials Plus? Here is a plain-English guide for museums, galleries and heritage trusts trying to work out which level fits their IT, their risk, and their funder's requirements.
CertificationArts Council Cyber Security Requirements: What Grant-Funded Museums Need to Know in 2026
Grant funders including Arts Council England are starting to attach cyber security expectations to funding applications. Here is what your museum needs to understand and have in place.
CertificationMuseum Visitor Data Protection and GDPR: A Practical Cyber Security Checklist for UK Museums and Galleries
Visitor bookings, donor records and Gift Aid data mean most UK museums hold far more personal information than they realise. Here is a practical cyber security checklist to help you meet your GDPR obligations.