Quick Answer
Yes, if customers ask for it, you bid on government work, or you want a structured baseline. The cost is modest and the process forces good security hygiene. Even if no one's asking, the controls are sensible basics every business should have.
When Cyber Essentials Is Worth It
Customers require it
Increasingly, enterprise customers and public sector organisations require Cyber Essentials from suppliers. If you're hearing "do you have CE?" in sales conversations, get certified.Government contracts
CE has been mandatory for most government contracts involving data since 2014. No certification = automatic disqualification from many tenders.Cyber insurance
Some insurers offer better terms for CE-certified organisations. If you're struggling with premiums or coverage, certification may help.Supply chain requirements
Your customers may need to demonstrate their supply chain is secure. Your certification helps them tick that box.Genuine security improvement
The five controls are genuinely useful:- Firewalls configured properly
- Secure configuration
- Access control
- Malware protection
- Patch management
Competitive differentiation
In markets where competitors aren't certified, CE demonstrates commitment to security.When It Might Not Be Worth It (Yet)
No one's asking
If customers don't require it, you don't bid on government work, and your market doesn't expect it—certification is solving a problem you don't have. But the underlying controls are still good practice.You can't maintain it
CE requires annual recertification. If you'll certify once and let it lapse, the ongoing credibility benefit disappears.Budget is extremely tight
At £300-500 for basic CE, it's not expensive. But if every pound matters and no one's requiring it, prioritise the actual security controls over the certificate.The ROI Calculation
Cost:
- Cyber Essentials: £300-500
- Cyber Essentials Plus: £1,200-2,500
- Preparation help (if needed): £500-2,000
- Contracts won/retained requiring CE
- Insurance savings (potentially)
- Reduced breach likelihood
- Customer confidence
Basic vs Plus
Cyber Essentials (basic):
- Self-assessment
- Lower cost
- Adequate for many requirements
- Independently verified
- More credible
- Required for defence (DEFCON 658)
- Required for some other contracts
What We Think
For most small businesses, Cyber Essentials is worth it:
- The cost is low
- The controls are sensible basics
- Market expectations are moving this direction
- It's a stepping stone to better security