Cyber Essentials help for small businesses in Camberley and Surrey
Circuit Minds gets businesses with 5 to 50 staff ready to pass Cyber Essentials, the government-backed certificate for basic cyber security. We set up Microsoft 365, laptops and phones to meet the five controls, check your answers against how things are really configured, and stay with you through the assessment. The certificate itself comes from an independent certification body.
The free 76-check Microsoft 365 audit shows most of the gaps before you pay anyone. Free for 5 or more users.
Why small businesses get certified
Public-sector contracts
Central government departments and NHS bodies should ask for Cyber Essentials when a contract handles citizens' personal data or government ICT, under procurement note PPN 014.
Defence supply chains
The MOD's supplier standard requires Cyber Essentials at every risk level, and it passes down to subcontractors. Common around Farnborough and Camberley; see IT support for manufacturing and engineering.
Cyber insurance included
Certify your whole organisation with a turnover under £20 million and you're entitled to cyber liability insurance arranged by IASME, with 24/7 incident response support.
Fewer insurance claims
The NCSC reports that organisations with Cyber Essentials are 92% less likely to make a claim on their cyber insurance, based on the scheme insurer's data.
Client security questionnaires
Larger clients and insurers ask whether suppliers hold Cyber Essentials. A certificate number answers that question, and the work behind it helps with the follow-up questions.
75% off until March 2027
The government's First Step Fund, announced on 3 November 2026, cuts the fee for a first certificate to between £80 and £125 + VAT for eligible small and medium businesses.
What is Cyber Essentials?
Cyber Essentials is a UK government-backed scheme that certifies an organisation has five basic technical controls in place against the most common online attacks. The NCSC calls it the minimum standard of cyber security the government recommends for organisations of all sizes. IASME runs the scheme with licensed certification bodies, and certificates are renewed every year.
Take-up is still low. The government's Cyber Security Breaches Survey 2025/26 found 12% of small businesses hold it, up from 5% a year earlier, while 46% of small businesses reported a breach or attack in the past 12 months. Our cyber security page covers the protection that runs on every plan.
What are the five Cyber Essentials controls, and what's in scope?
Every question in the assessment maps to one of five controls. The current question set, v3.3 (Danzell), has applied to assessments since 27 April 2026.
Firewalls
Every device that connects to the internet sits behind a firewall that's configured properly, including laptops used away from the office.
Secure configuration
Default passwords changed, unused accounts and software removed, and devices set to lock. In Microsoft 365 and Intune we set these as policies, so new devices get them automatically.
Security update management
Software stays supported, and critical or high-risk updates go on within 14 days of release. Miss this and the assessment fails automatically.
User access control
People get only the access they need, admin accounts are kept separate, and every cloud sign-in uses two-step sign-in. That last one is also an automatic fail if it's missing.
Malware protection
Antivirus or an approved alternative on every device in scope, kept up to date and set to block harmful files and websites.
Scope
Cloud services like Microsoft 365 can't be left out, and personal phones or laptops that reach work data are in scope.
Our plans already run much of this day to day: security updates, antivirus and two-step sign-in are on EssentialsEssentialsThe fundamentals, done properly. £45 per user per month, minimum 5 users.Tap or click the name to compare plans, and Secure+Secure+Security-first, built for regulated firms. £75 per user per month, minimum 10 users.Tap or click the name to compare plans adds monthly checks for security weak spots. Preparation for the certificate is a separate fixed-price project.
Sources: NCSC: Cyber Essentials requirements v3.3; NCSC: Cyber Essentials overview; IASME: Cyber Essentials fees; GOV.UK: First Step Fund (3 November 2026); PPN 014; MOD Cyber Security Model; NCSC Annual Review 2025; Cyber Security Breaches Survey 2025/26.
Where small businesses usually fail
Common reasons for a fail
- An old admin account, or a shared mailbox login, that still signs in with just a password
- Laptops waiting weeks for updates because nobody checks they installed
- A personal phone with work email on it and no screen lock
- Microsoft 365 left out of the answers because it "isn't ours"
What we put in place
- Two-step sign-in enforced for every account, with unused accounts switched off
- Updates pushed and reported centrally, so you can see what's installed
- Rules that keep work email off phones until they meet the basics
- A scope that includes your cloud services, written down before the assessment
Not sure how your setup compares? Book the free security audit
What does it cost to stay compliant all year?
Per user, per month, ex VAT. Published, the same price for every firm.
Essentials
Min. 5 users£45/user/month
Remote support 9am-5pm (fair use), Microsoft 365 and computers looked after, security updates, antivirus, spam and scam email filtering, two-step sign-in for everyone
Complete
Min. 5 users£55/user/month
Unlimited remote support, stronger email protection, backup of your Microsoft 365 email and files, staff security training, IT reviews every quarter
Secure+
Min. 10 users£75/user/month
Attacks spotted and stopped 24/7, alerts if your staff's details turn up in data leaks, monthly checks for security weak spots, stricter sign-in rules, priority support, a yearly security review
The certificate is renewed every year, so the controls need to keep running in between. Every plan keeps updates, antivirus and sign-in security running. CompleteCompleteRight for most growing businesses. £55 per user per month, minimum 5 users.Tap or click the name to compare plans adds backup and staff training, and Secure+Secure+Security-first, built for regulated firms. £75 per user per month, minimum 10 users.Tap or click the name to compare plans (from 10 users) adds 24/7 monitoring and monthly weak-spot checks. Full detail on the pricing page.
Plans require Microsoft 365 Business Premium (or equivalent), billed separately at Microsoft's list price. We manage your licences so you only pay for the ones you use. That licence is what includes the security features mentioned on this page. On-site visits are quoted per visit. In the first three months you can leave with 30 days' notice.
What does the free Microsoft 365 security audit check?
We run 76 checks on your Microsoft 365. We can only look, not change anything, and we send a written, prioritised report. It's free for firms with 5 or more users; the full 108-check audit is £99. Checks that line up with Cyber Essentials include:
- whether every account, admin accounts included, needs two-step sign-in
- whether old ways of signing in that skip two-step sign-in are still switched on
- how many accounts have admin rights, and whether they're used day to day
- whether devices are managed and kept to a security standard
- what's shared outside the business from SharePoint and OneDrive
What might an audit find?
Illustrative example, not a real client. It shows the kind of finding the audit reports, written up the way the report does.
- Finding
- Two-step sign-in is on for staff, but three admin accounts and a shared mailbox can still sign in with a password alone.
- Why it matters
- Under the April 2026 rules, any cloud sign-in without two-step sign-in is an automatic fail, and admin accounts are the ones attackers try first.
- Fix
- Turn on two-step sign-in for the admin accounts, block direct sign-in to the shared mailbox, and switch off old sign-in methods.
How does preparation work?
We start with the free audit and a scoping call, then send a fixed-price quote. The work itself is putting the controls in place in Microsoft 365, Intune and your network, then going through the questions with you so every answer matches how things are set up.
When you're ready, you buy the assessment from a certification body and we stay with you while it's reviewed. If something needs fixing, we fix it. Defence and manufacturing firms: see our manufacturing page.
How do we get started?
It starts with the free audit and a call to go through the report. If you decide to work with us, we agree a written plan for what gets done first, usually sign-in security and computers, and pace the rest around your work. We connect through Microsoft's own secure access for IT providers, so you never have to share an admin password with us.
Moving from another provider? Our guide to switching IT support provider covers the handover.
Common questions
How much does Cyber Essentials cost?+
The certification body's fee is set by IASME and depends on your size: £320 + VAT for 0-9 employees, £440 for 10-49, £500 for 50-249 and £600 for 250 or more. Until March 2027, or until the money runs out, the government's First Step Fund takes 75% off a first certificate for small and medium businesses that haven't held Cyber Essentials in the last four years, so you'd pay £80 to £125 + VAT. Our preparation work is quoted separately as a fixed price after a free scoping call.
What changed in April 2026?+
From 27 April 2026 assessments use the v3.3 question set, called Danzell. Cloud services such as Microsoft 365 can't be left out of scope, every cloud sign-in must use two-step sign-in, and critical or high-risk updates must be installed within 14 days. Missing either of the last two is now an automatic fail. Unsupported software has to go, and personal devices that reach work data are in scope.
What's the difference between Cyber Essentials and Cyber Essentials Plus?+
Cyber Essentials is a self-assessment: you answer the questions and an assessor from a certification body checks them. Cyber Essentials Plus adds hands-on technical testing by the certification body to show the controls work in practice. It must be done within three months of your Cyber Essentials certificate and is priced by the certification body for your network. Both certificates last 12 months.
How much does Cyber Essentials Plus cost?+
There's no fixed price. Unlike the basic certificate, IASME doesn't set the fee for Plus: each certification body quotes for your business, mainly on how many computers, phones and sites need testing. Get two or three quotes before you book, and ask whether a retest is included if something fails. Getting the basic certificate right first makes Plus far more likely to pass first time.
Do we need Cyber Essentials for government or defence work?+
Often, yes. Since 24 February 2025, procurement note PPN 014 asks central government departments and NHS bodies to require Cyber Essentials when a contract involves citizens' personal data or government ICT at OFFICIAL level. The MOD's supplier standard, Def Stan 05-138, requires Cyber Essentials at every risk level, and the requirement passes down to subcontractors. Check the contract itself for the level it asks for.
Is cyber insurance included?+
UK organisations with a turnover under £20 million that certify their whole organisation are entitled to cyber liability insurance arranged by IASME, including 24/7 incident response support. Read the policy terms when you apply.
How long does it take?+
It depends on how far your setup is from the rules today. The free audit shows most of the gaps in Microsoft 365, and the scoping call covers the rest, so you get a timeline with the quote.
Are you a certification body?+
No. We do the preparation: we put the controls in place and help you answer the questions accurately. The assessment and the certificate come from an independent certification body licensed by IASME, which charges its own fee.
We're a team of three. Can you help?+
Our managed plans start at 5 users, but Cyber Essentials preparation is a one-off project, so smaller firms can have it too, quoted at a fixed price. The full 108-check Microsoft 365 audit is a good place to start.
Find out how close you are to Cyber Essentials, for free.
Free for 5 or more Microsoft 365 users. You keep the written report.