In 2023 the Department for Science, Innovation & Technology commissioned a report into the effectiveness of Cyber Essentials, a UK government-backed certification designed to protect organisations against the most common cyber threats. The report is extensive and well worth a read but below we’ve summarised the findings and explained why Cyber Essentials is a vital tool for businesses committed to cybersecurity and resilience.

Net Primates are holders of Cyber Essentials Plus certification, and Steve has passed the NCSC Cyber Advisor assessment. You can also contact us for more information and help achieving your own certification. 

1. Effectiveness of technical controls

Cyber Essentials certification requires five key technical controls that address common vulnerabilities. According to the report, these controls can prevent 99% of internet-originating vulnerabilities. For businesses looking to bolster their defences, this is a compelling statistic – without these measures, organisations leave themselves open to a wide array of threats. The report found that 82% of Cyber Essentials users believe these technical controls effectively protect against common cyber risks, with 80% confident that they are helping to mitigate security risks within their organisations.

2. Boosting cyber awareness and confidence

Certification through Cyber Essentials doesn’t just improve security; it heightens awareness. The report shows that almost two-thirds (64%) of certified organisations feel more capable of identifying common cyberattacks. In contrast, non-certified organisations rated their concern about cyberattacks at 3.7 out of 10, compared to a 5.8 for certified businesses, indicating that Cyber Essentials raises awareness and emphasises the potential consequences of cyber threats. 

Notably, 85% of Cyber Essentials users believe that certification has improved their understanding of cyber risks, and 88% feel more confident in understanding the necessary steps to reduce them. For senior management, Cyber Essentials has helped clarify the importance of prioritising security, with 93% of certified organisations’ boards recognising it as a top priority. 

3. External assurance and supplier confidence

Cyber Essentials certification appears to be the only form of external assurance for more than half (53%) of its users, providing them with a trusted baseline for security. Additionally, organisations with Cyber Essentials certification find it easier to vet suppliers and partners; 61% say they are more likely to select Cyber Essentials-certified suppliers, and 75% have greater confidence in working with certified vendors. This extends to customer relationships, with 79% of users believing that Cyber Essentials certification reassures their clients about the organisation’s commitment to security. 

4. Improving market competitiveness

In the report, 69% of Cyber Essentials-certified businesses believe that the certification has improved their competitiveness. With many contracts now requiring Cyber Essentials, it’s become a commercial advantage. Certification acts as a ‘stamp of approval’, signalling to clients and suppliers that an organisation takes cybersecurity seriously and complies with recognised standards. 

5. Encouraging cybersecurity beyond the basics

While Cyber Essentials lays out baseline security measures, many certified organisations are inspired to take their security further. According to the report, 76% of users have implemented additional preventive actions, such as investing in new software, conducting penetration testing, or pursuing further standards like ISO 27001. This trend suggests that Cyber Essentials encourages a culture of continuous improvement in security practices. 

6. Value for money and cost savings

The report also alludes to the financial benefits of Cyber Essentials certification. For example, a small number noticed a reduction in cyber incidents. Time is being saved on security due diligence, especially with Cyber Essentials Plus certification. Additionally, 80% of certified organisations see a direct commercial benefit, as they believe it reduces the potential financial impact of cyberattacks. 

7. Supporting smaller businesses in their cyber journey

Cyber Essentials is particularly beneficial for smaller organisations that may lack the resources for a dedicated IT security team. The report highlights that certification helps to build a strong security foundation even without in-depth technical expertise, and the expanding network of certification bodies offers support tailored to a wide range of businesses. 

Conclusion 

The report confirms that Cyber Essentials is a powerful tool for organisations at all stages of their cybersecurity journey. By providing a clear, effective framework for preventing cyberattacks, Cyber Essentials not only strengthens an organisation’s defences but also enhances its credibility with clients and partners. For businesses considering Cyber Essentials, the evidence is clear – certification can provide peace of mind, streamline operations, and support market growth. 

If your organisation is ready to start its Cyber Essentials journey, we’re here to help every step of the way. Get in touch to discuss how we can guide you through the certification process and help you implement security controls that match your business needs. 

Back to posts