Cyber Essentials for Sole Traders & Freelancers
Working alone doesn't make you invisible to attackers, in fact a single laptop with no IT team behind it is often an easier target than a larger business with dedicated security staff. Certification gives clients a quick, credible signal that you take basic security seriously, which matters more than people expect once you're handling anyone's personal or financial information as part of your work. It's also one of the few security credentials genuinely built to be achievable for a business of one.
Why it applies to you
Working alone doesn't make you invisible to attackers, in fact a single laptop with no IT team behind it is often an easier target than a larger business with dedicated security staff. Certification gives clients a quick, credible signal that you take basic security seriously, which matters more than people expect once you're handling anyone's personal or financial information as part of your work. It's also one of the few security credentials genuinely built to be achievable for a business of one.
Typical Trigger / Source
Client requirement / best practice
Requirement levels reflect current UK government, NCSC and IASME guidance. If you're unsure which category applies to your organisation, our team can help you confirm it on a quick call before you commit to certifying.
Steps to get certified
A guided, hands-on path from scoping to certificate, no jargon, no guesswork.
Scoping
We agree the boundary of your assessment: a device, a network, or your whole organisation.
Self-Assessment
Complete a guided questionnaire against the five technical controls, with our support throughout.
Review
We check your submission and flag anything that needs addressing before it goes for formal assessment.
Certification
Your certificate is issued, backed by IASME/NCSC accreditation, valid for 12 months.
Questions from sole traders & freelancers
Yes, the standard is specifically designed to scale down to very small setups, including a single person working from one device. The controls it checks, things like keeping software updated and using strong passwords, apply just as much to a one person business as a larger one.
It depends on the client, but plenty of freelancers and contractors report it being asked about directly, particularly by larger clients or anyone handling sensitive data. Even when it isn't asked for outright, it's a genuine point of difference on a proposal against another freelancer who doesn't have it.
That's fine, but those devices and accounts need to be included in what gets assessed if they're used for work, since a personal phone with client emails on it is still part of your real attack surface. It's worth being upfront about your actual setup rather than presenting a tidier version of it for the assessment.
It can still be worth it as a way of tightening up your own basic security and having something concrete to point to when a client does eventually ask, which happens more often as businesses get more security conscious. Think of it as being ready for the question before it's asked, rather than reacting to it.
Latest from the blog
See other categories
Get certified in as little as 5 days
Tell us a little about your organisation and we'll send an itemised quote, no obligation, no sales call required to get pricing.