£320 buys five controls, and £25,000 of cover if you tick the box.

The NCSC's own framing of why this works is the most useful sentence in the scheme: most cyber attacks are basic, and it compares them to a thief trying your front door to see whether it is unlocked.

That is the whole design philosophy. Cyber Essentials does not attempt to stop a determined, targeted adversary. It locks the door.

The insurance, and the box you have to tick

UK organisations with turnover under £20 million that certify their whole organisation are, in the NCSC’s words, “automatically entitled” to cyber liability insurance arranged by IASME, including round-the-clock incident response support covering technical, legal and crisis management services.

IASME, which arranges it, adds the two details that matter. The applicant has to opt in when completing the assessment — “only if they want the cover” — and the cover is a £25,000 limit of indemnity with a £1,000 excess, including a 24-hour incident helpline. The certification costs the same either way. The policy also expects you to install the automatic updates your software provider sends for critical business software, which is one of the five controls anyway.

Two things follow. If you are already certified, find out whether you opted in, because an incident response line you did not know about is useless at two in the morning. And if you are weighing the cost, £25,000 of cover belongs in the price comparison beside the £320 — measured against what your own policy already covers, not instead of it.

Where it stops being optional

Certification is voluntary until somebody asks for it, and increasingly somebody does. It appears in public sector procurement, in supplier questionnaires, and in the contract schedules that arrive when a larger client reviews its own supply chain.

That last route is the one to watch, because it is about to get busier. The Cyber Security and Resilience Bill brings managed service providers and data centres into scope and lets regulators designate critical suppliers, and obligations of that kind flow down by contract faster than they arrive by statute — which is the argument in the note on the 24-hour clock.

What it will not do

It will not make you secure. It is a floor, stated as a floor by the body that wrote it, and a firm that treats a certificate as the end of the conversation has misread a scheme that describes itself as the minimum.

It also says nothing about your data protection position. The Article 22C safeguards that came into force in February, the incident reporting duties, and everything about what your systems decide are separate questions with separate answers — the automated decision-making note covers the one most firms have not looked at.

Three honest observations

1. The self-assessment is only as good as the answers. A firm can certify while getting the update management question wrong in good faith. Plus exists precisely because self-assessment has that failure mode.
2. The controls are the value, not the certificate. Doing all five properly and never certifying leaves a firm better off than certifying and letting them drift. The certificate is the thing a client asks for; the controls are the thing that works.
3. It expires. Annual recertification means the controls get re-checked, which is the scheme's quiet strength — most security postures decay silently and this one has a date attached.

What this does not tell you

We are not a security firm and we do not certify anybody. We are writing about it because it is one of the few things a small professional firm can buy where the cost is knowable, the scope is honest and the body recommending it is not selling it.

Prices quoted are the entry price from the NCSC's own page; Plus is quoted by network complexity, so ask. And knowing what you run is the prerequisite for all five controls — a firm that cannot list its own systems cannot honestly answer the questionnaire, which is where the stack check and the cleanup work start.