Is Cyber Essentials worth it? What the evidence shows

What are you buying with Cyber Essentials?

Imagine a customer asks for Cyber Essentials before you can pitch for work. You now have a purchasing decision as well as a security task. Start by asking which level they want and what it must cover.

Cyber Essentials is a certification scheme from the UK National Cyber Security Centre, or NCSC. It covers five security measures, called controls, designed to guard against common online threats. Cyber Essentials Plus covers the same controls and adds independent technical testing.

With the self-led route, an assessor marks your answers after a board member or equivalent signs them off. With a supported route, a certification body helps explain how the questions apply to your organisation.

That gives you something concrete to compare: the level of testing and the help included. In a public review, Stuart Davies described needing certification to pitch for work. That is a reported reason to buy, rather than proof of a contract won.

The NCSC comparison makes the extra testing clear. This screenshot shows the assessment rows; pricing is outside the crop.

What did customers value most?

Clear help was the strongest theme in the reviews we read. On 19 October 2026, we checked our stored public accounts against their original pages. We retained 41 customer reviews and seven discussion threads, and counted them separately.

Guidance appeared in 38 of the 41 reviews. Reviewers also described time, effort or administration in 28. These are the subjects people wrote about, not ratings of how well each provider performed.

Every retained review was five-star. This selected collection helps show what those reviewers valued. It cannot tell us how satisfied all customers are.

Only three reviews described a result beyond receiving a certificate. That category includes greater understanding or confidence, so it is not a count of proven sales or security gains. For your own project, decide what you want to improve before it starts.

Does the finding depend on one provider?

The help theme remains when the most represented provider is removed. Assure Technical accounts for 16 reviews in the sample. Without those reviews, help still appears in 22 of the remaining 25.

This is a check on the result, not a comparison of firms. The smaller group is part of the original sample, so the chart does not show a trend.

The separate discussions show where people wanted that help. One organisation asked about moving away from shared logins. A software team asked about developer machines. Another asked which devices using its cloud services belonged in scope, meaning the systems covered.

Six of the seven discussions concerned work still in progress. In another, a certified organisation questioned access requirements, then corrected its understanding of the proposed fix. Treat forum posts as clues to the questions people have, not instructions for passing an assessment.

Before choosing support, describe a real setup you need help with. Ask the provider to explain how it would approach that question. A clear answer is more useful to your decision than a general promise of support.

Does Cyber Essentials help with winning work?

Government research offers a useful clue about customer checks. It does not promise a sale. A separate impact evaluation surveyed 606 current and lapsed users between October and December 2023.

In that study, 76% reported that certification made customer checks less of a burden. And 69% believed it had made their organisation more competitive. These are respondents’ views, rather than measured returns for your business.

The study could not calculate the user-survey response rate because the total invited through certification bodies was unknown. Its respondents are separate from our review and discussion samples.

Put the finding to work by asking your customer what the certificate will settle. Will they accept it for this purchase? What other questions will remain? Record the answer, then compare it with what happens after certification.

NCSC author Chris Ensor makes a useful distinction: a general sign of good practice does not prove that a specific risk is managed.

How can you use these findings before paying?

Write a short brief before you compare quotes. Name the customer requirement, the systems involved and the person responsible. Then ask providers to explain the work and support their fee covers.

Responsibility deserves a clear name. In the government’s process evaluation, owners or managers most often held it in the smallest organisations. That study surveyed users in January and February 2023. The NCSC also links to a free readiness tool for a preparation plan.

The questions below turn the research into a buying brief. Use the related guides for costs, the Plus test and customer questionnaires.

How we did the research: We screened 125 stored records, grouped them into 119 source pages and retained 48 distinct reported experiences. Those came from 46 visible public accounts. Accounts are not verified people or companies, and different accounts may describe the same organisation.

We included reviews and posts published from 19 October 2024 to 19 October 2026. We read original pages, removed duplicate experiences and excluded supplier cases and unclear accounts. One editor grouped each experience by the subjects it mentioned. Automated checks recalculated the totals. We kept annual renewals as separate experiences where the account described separate work.

This is a selected public-source study, not a UK survey, a provider ranking or a measure of satisfaction. A topic missing from a review may still have mattered to its author. The separate government studies use different samples and dates.

These quotations were checked against saved readings of public posts, which may not show later edits.