Get ready for Cyber Essentials with clearer steps
Cyber Essentials can help your business show that important cyber security basics are in place.
Why use Chrome for Cyber Essentials?
It can also raise plenty of questions before you get there. Which devices are in scope? Are updates being managed properly? Is multi-factor authentication set up where it should be? Are old accounts still active? Are firewalls and security settings ready for assessment?
Chrome helps UK businesses prepare for Cyber Essentials by reviewing the practical areas first.
We’ll help you understand the requirements, check the gaps and decide what should happen before you start or renew an assessment.
The aim is simple: make Cyber Essentials feel less like guesswork and more like a clear plan.
Understand the requirements
Chrome can explain what Cyber Essentials asks for and how it applies to your business setup.
Check the gaps first
We can help review devices, users, updates, firewalls, malware protection and access before assessment.
Support tenders and customer questions
Cyber Essentials may help when customers, suppliers, insurers or public sector contracts ask about cyber security.
Connect it with wider support
Cyber Essentials works best when it links with managed IT, patch management, password management, email security and awareness training.
What is Cyber Essentials?
Cyber Essentials is a UK government-backed cyber security certification scheme, overseen by NCSC, the National Cyber Security Centre, and delivered through IASME and its certification bodies.
It focuses on the same five technical controls covered by any Cyber Essentials checklist, and helps protect against common online threats: firewalls, secure configuration, user access control, malware protection and security update management.
In plain English, it asks whether your business has important security basics in place. Are devices and services set up safely? Can users only access what they need? Is malware protection in place? Are software updates being managed? Is there suitable protection between your systems and the internet?
Cyber Essentials does not cover every part of cyber security. It is a useful baseline, and for many businesses that is the right place to start.
Chrome can help you understand what the controls mean for your setup and where work may be needed before assessment.
Firewalls
Control what can reach your network from outside.
Secure configuration
Remove default settings and accounts that were never needed.
User access control
Give people the access their role requires, and no more.
Malware protection
Keep protection in place and current on company devices.
Security update management
Keep supported software and devices up to date.
Cyber Essentials and Cyber Essentials Plus
There are two levels of certification.
Cyber Essentials is based on a verified self assessment. Your business completes a Cyber Essentials questionnaire about the controls in place, and the Cyber Essentials assessment is reviewed through the scheme process.
Cyber Essentials Plus includes the same controls, but adds independent technical testing. This gives a higher level of assurance because some of the answers are checked against your systems.
The right option depends on why you need certification. Some businesses need Cyber Essentials because a customer, insurer or tender asks for it, while others choose Cyber Essentials Plus because they handle sensitive information or want additional testing.
Chrome can help you understand the difference and decide which route is suitable. We’ll also make clear whether Chrome is helping with preparation, remediation, assessment coordination or ongoing support. That distinction matters before work starts, and we’ll confirm whether Chrome acts as your Cyber Essentials certification body directly or works alongside one when we talk.
Start with your current setup
Before trying to complete an assessment, it helps to understand what is already in place.
Chrome can review agreed areas of your IT setup and explain what may need attention. This may include laptops, desktops, servers, Microsoft 365, cloud services, user accounts, admin access, multi-factor authentication, firewalls, routers, malware protection, software updates and unsupported devices.
We can also look at devices used away from the office, shared accounts, leaver access and systems managed by other suppliers.
The exact scope depends on your business, systems and Cyber Essentials requirements.
We’ll explain what we can check, what another supplier may need to confirm and where the latest requirements should be reviewed before you submit, since scheme requirements can be updated and the current version should always be checked directly against the official guidance.
The aim is not to create a long list of problems. It is to give you a clearer view of what needs fixing, what can wait and what needs specialist input.
Fix gaps before they slow you down
Cyber Essentials preparation often shows up practical issues that were sitting unnoticed.
A few devices may be out of date. An old application may still be in use. A user may have admin access they no longer need. A cloud service may not have multi-factor authentication switched on. A shared account may still be used because that is how the team has always done it.
These findings are common, and they can usually be worked through in a sensible order.
Some changes may be quick, while others need planning, supplier input or user communication. Removing old admin access may need approval. Replacing unsupported software may need a project. Changing sign-in controls may need user guidance.
Chrome can help you understand the difference, so the work can be planned properly.
Cyber Essentials is not only about preparing for an assessment. It should leave your setup easier to manage afterwards.
Support for renewal
Cyber Essentials is not a one-time task.
Certification needs a Cyber Essentials renewal, and requirements can change over time. Your business may also change between assessments as users join, devices are replaced, cloud services are added and suppliers change.
A setting that was right last year may need checking again this year.
Chrome can help you prepare for renewal by reviewing the current setup against the latest requirements.
We can also connect renewal work with managed IT, co-managed IT, patch management, password management, mobile device management and wider cyber security reviews.
This helps Cyber Essentials become part of normal IT management, rather than a yearly scramble.
Cyber Essentials and wider cyber security
Cyber Essentials helps check important basics. It should not be the whole cyber security plan.
Email security can help reduce suspicious messages reaching users. Cyber security awareness training can help your team spot phishing emails and fake login pages. Dark web monitoring can alert you when credentials linked to your domain appear in monitored breach sources.
Managed DMARC can help protect your email domain from being used in spoofed messages. Patch management can help keep supported software up to date, while password management can reduce risky shortcuts around shared or reused passwords.
Chrome can help bring these areas together through one team.
We’ll explain what Chrome manages and where another provider remains responsible, so your team has a clearer place to start when something needs checking. See all cyber security services.
The five controls in plain English
Cyber Essentials is built on five technical controls. Here is what each one means in practice.
Firewalls
Firewalls help control traffic between your business systems and the internet.
Chrome can help review whether firewalls, routers and internet-facing services need attention before assessment.
Secure configuration
Secure configuration means devices, services and software are set up with safer settings, which may include removing default settings, turning off unused services and checking device setup.
User access control
User access control means people should only have the access they need. This includes admin accounts, leaver access, shared accounts and multi-factor authentication where required.
Malware protection
Malware protection helps reduce the risk from viruses and other harmful software. Chrome can help review what is in place and where devices may need attention.
Security update management
Security update management means supported software and devices should be kept up to date. This links closely with patch management, unsupported software and devices that have not checked in for updates.
We will tell you which controls you already meet and which need work before you apply.
What preparation looks like
Certification is easier when the groundwork is done first. This is how we work through it with you.
Understand why you need it
Review the current setup
Identify the main gaps
Support the next steps
Connect it with ongoing support
Clearer steps towards Cyber Essentials
Cyber Essentials support works best when it helps a business understand the requirements and act before assessment.
Read what customers say about Chrome’s communication, support and the people behind the service in our reviews.
What businesses ask before they apply
Common questions about Cyber Essentials: what the certification covers, how long it takes and what happens at renewal.
What is Cyber Essentials?
Cyber Essentials is a UK government-backed certification scheme focused on five technical controls. It helps businesses show that important cyber security basics are in place.
What are the five Cyber Essentials controls?
The five controls are firewalls, secure configuration, user access control, malware protection and security update management. Chrome can help explain how these apply to your business setup.
What is Cyber Essentials Plus?
Cyber Essentials Plus uses the same controls as Cyber Essentials, but includes independent technical testing. It gives a higher level of assurance because some controls are checked against your systems.
How much does Cyber Essentials cost?
Cyber Essentials cost and price depend on the certification body, your business size and whether you choose Cyber Essentials or Cyber Essentials Plus. We’ll confirm current pricing and options when we talk through your certification route.
Can Chrome help us prepare for certification?
Yes. Chrome can help review gaps, explain requirements and support agreed remediation work. We’ll confirm the exact certification route, assessor involvement and responsibilities before work starts.
Does Cyber Essentials mean we are fully protected?
No. Cyber Essentials is a useful baseline, not the whole cyber security plan. It should sit alongside wider protection such as email security, awareness training, backups, password management and ongoing IT support.
Need help getting ready for Cyber Essentials?
Your business may need Cyber Essentials for a tender, insurance question, customer request or internal review.
Chrome can help you understand the requirements, check the gaps and plan the next practical step.
You’ll get clear advice from people who can also support the wider IT and cyber security work behind the certificate.