For most small businesses in Manchester, Cyber Essentials is worth doing if you bid for public sector work, supply larger companies that ask about security, or handle customer personal data. The basic certificate starts at £320 plus VAT for organisations with up to nine employees, lasts 12 months, and comes with cyber liability insurance for eligible UK organisations with a turnover under £20 million.
It is less clear cut for a very small business that holds little data and has no customers asking for it. Even then, the five controls behind the scheme are the basics the National Cyber Security Centre (NCSC) recommends for every organisation, so the real question is usually whether to certify, not whether to follow them.
What Cyber Essentials actually checks
The NCSC describes Cyber Essentials as the minimum standard of cyber security the government recommends for organisations of all sizes. It covers five technical controls:
- Firewalls: a security filter between the internet and your network
- Secure configuration: removing default passwords, unused accounts and software you do not need
- Security update management: keeping devices, operating systems and applications patched
- User access control: giving people only the access they need, with admin rights kept separate
- Malware protection: stopping malicious software from running
There are two levels. Cyber Essentials is a self-assessment questionnaire checked by an independent assessor. Cyber Essentials Plus covers the same controls but adds hands-on technical testing of your devices, and is quoted individually by certification bodies.
What it costs
IASME, the NCSC's delivery partner for the scheme, publishes fixed prices for the basic certificate based on the number of employees:
- Micro (0 to 9 employees): £320 plus VAT
- Small (10 to 49 employees): £440 plus VAT
- Medium (50 to 249 employees): £500 plus VAT
- Large (250 or more employees): £600 plus VAT
Certificates expire after 12 months, so this is an annual cost. You have six months from applying to complete and submit the assessment. The larger cost for many businesses is not the fee but the work needed to pass: replacing unsupported laptops or routers, switching on multi-factor authentication and tidying up admin accounts.
What changed in April 2026
The requirements were updated for assessment accounts created after 26 April 2026, using the new Danzell question set. The five controls stayed the same, but some points that used to be judged case by case are now automatic fails:
- Multi-factor authentication must be switched on for every cloud service where it is available, whether it is free, included or a paid option
- Operating system, router and firewall updates rated critical or high risk must be installed within 14 days of release
- Application updates are held to the same 14 day rule
- Cloud services, such as Microsoft 365 or Google Workspace, cannot be excluded from the scope
If your business last certified under the old question set, expect the renewal to look harder. Most of the extra work sits in Microsoft 365 settings and patching routines rather than new equipment.
When contracts require it
The Cabinet Office's procurement policy note PPN 014, which replaced PPN 09/14 and PPN 09/23 in February 2025, applies to central government departments, their agencies and NHS bodies. Those buyers should ask for Cyber Essentials or Cyber Essentials Plus where a contract involves citizens' personal data, government staff data, ICT systems handling OFFICIAL data, or the day to day business of government. Suppliers must then renew annually for the life of the contract.
In Greater Manchester that includes NHS trusts and other NHS bodies buying services locally. Councils and other public bodies are not bound by the note but may choose to follow it, so check the tender documents. The note also says buyers must accept equivalent controls, and that the scheme should not be applied to every contract as a matter of course, so a missing certificate does not automatically rule you out. In practice it makes bids simpler.
Is it worth it: a quick test
Certification is usually worth the fee if any of these apply:
- You bid, or plan to bid, for NHS or central government work
- A customer, landlord or insurer has asked about your cyber security
- You store customer personal data, payment details or client files
- You use Microsoft 365 or Google Workspace and have never reviewed the security settings
- Nobody can say when your laptops, router and firewall were last updated
Awareness is still low. The government's Cyber security breaches survey 2025 found that only 12% of UK businesses were aware of Cyber Essentials, falling to 9% of micro businesses, while 43% reported a breach or attack in the previous 12 months. Holding the certificate is still a way to stand out with buyers who do ask.
Local help in Greater Manchester
The North West Cyber Resilience Centre is a not for profit, police led partnership supported by Greater Manchester Police, Cheshire, Merseyside, Lancashire and Cumbria police forces and the North West Regional Organised Crime Unit. It offers small businesses affordable services such as cyber risk assessments and simulated phishing exercises. The NCSC also offers small and medium businesses a free session with an NCSC assured Cyber Advisor.
How Apex helps
Apex Options helps small businesses get ready for Cyber Essentials: reviewing devices and cloud accounts against the five controls, switching on multi-factor authentication, setting up patching that meets the 14 day rule and replacing unsupported equipment where needed. We work nationwide and remotely, with on-site support in Manchester, Greater Manchester, Liverpool, Cheshire and London. See our cybersecurity and compliance service, or read our guide to Microsoft 365 security settings for small businesses.