What you are being asked for
Cyber Essentials covers five controls: firewalls, secure configuration, security update management, user access control and malware protection. You either go through a self-led route, where a board member or equivalent signs off the answers and an assessor marks them, or use a licensed Certification Body.
Why it feels like a burden
One commenter says Cyber Essentials / Plus is common for government tenders, and another calls doing it a "Huge waste of time". In 2023 a solo founder asking about ISO 27001 said they lost a big deal for lack of a certificate.
What a gap list gives you
Each of the five controls is marked met, gap or unknown with an evidence reference, so you see the work before you pay. The assessor still decides, and no one can promise you will pass.
Which paid job fits
The Cyber Essentials job produces the gap list and a drafted answer for each question for your director to check and submit. If you have no written policies, the policy-set job drafts them from what you really do.
Sources and limits
- NCSC: Cyber Essentials overview Checked 2026-10-12.
- The five technical controls are firewalls, secure configuration, security update management, user access control and malware protection.
- There are two routes: self-led, where you register via IASME, pay and complete a verified self-assessment that a board member or equivalent signs off and an assessor marks, or supported, through a Certification Body licensed by IASME.
- Cyber Essentials Plus covers the same controls and adds more rigorous, independent technical testing.
- Basic Cyber Essentials starts at £320 plus VAT, scaled to organisation size, and cyber liability insurance arranged by IASME comes with certification for a UK organisation with turnover under £20m whose certification covers the whole organisation.
- Hacker News comment on Cyber Essentials (29 Jan 2026) Checked 2026-10-12.
- The commenter says that for government tenders agencies need certification and that "Cyber Essentials / Cyber Essentials Plus is common", and that two replies criticise the scheme as burdensome.
- Hacker News reply on Cyber Essentials Plus (29 Jan 2026) Checked 2026-10-12.
- The commenter writes: "I absolutely hated doing Cyber Essentials (Plus). Huge waste of time".
- Hacker News: a solo founder weighing ISO 27001 and Cyber Essentials Checked 2026-10-12.
- The author says they "lost a big deal just because of lack of the certificate", and a commenter advises starting with Cyber Essentials and notes that corporate IT will still want you to fill out its security questionnaire even with certificates in hand.