How to pass Cyber Essentials without turning it into a technical headache
Cyber Essentials can feel awkward when you first open the questions.
You are asked about devices, cloud services, firewalls, updates, admin accounts, malware protection, remote working and who has access to what. For many small businesses, the hard part is not wanting better security. It is knowing what the questions are really asking.
This guide walks you through the practical steps: define your scope, list what you use, fix the common blockers, answer honestly, and avoid the last-minute panic that catches so many businesses out.
How to pass Cyber Essentials without making it harder than it needs to be
Cyber Essentials is not meant to be a technical maze. For most small businesses, the problem is not the certificate itself. It is not knowing what is in scope, what needs fixing first, and how to answer the questions without guessing.
This guide gives you a practical route through the process, from checking your devices and cloud services to fixing the common issues that hold businesses up.
The mistake that causes the most pain
Many businesses start by opening the Cyber Essentials questionnaire and trying to answer it from memory.
That is where it gets messy. Someone guesses how many laptops are in use. Someone assumes Microsoft 365 is "handled by Microsoft". Someone forgets about the tablet in the van, the home worker, the old router, or the subcontractor with access to shared files.
The better route is simple: prepare first, answer second.
A practical way to pass Cyber Essentials
Get clear on why you need it
Are you doing Cyber Essentials for a tender, a main contractor, a council contract, cyber insurance, customer confidence, or because you want better security?
This matters because it affects how quickly you need to move, whether standard Cyber Essentials is enough, and whether Cyber Essentials Plus may be needed later.
Define your scope properly
Scope is the boundary of what your assessment covers. For many small businesses, that means the whole organisation. In some cases, a clearly separated part of the organisation may be assessed, but it must be properly defined.
Do not try to exclude awkward devices just because they are awkward. Cyber Essentials expects end-user devices and cloud services to be considered properly. Cloud services cannot be excluded from scope.
Not sure where to draw the line? Read our guides on what devices are in scope for Cyber Essentials and whether contractors and subcontractors are in scope.
Make a simple list of what you use
You do not need a perfect enterprise asset system. You do need a clear list of the technology used to access your business data and services.
- Laptops, desktops, tablets and mobiles
- Servers, virtual servers and remote desktop systems
- Routers, firewalls and internet connections
- Microsoft 365, Google Workspace and other cloud services
- People with access, including staff, contractors and outsourced support
Fix the obvious blockers before you submit
Most failed or delayed submissions are not caused by strange technical edge cases. They are usually caused by everyday things that have been left too long.
- Unsupported operating systems or old software
- Missing multi-factor authentication on cloud services, including Microsoft 365 and Google Workspace
- Shared admin accounts in cloud services that should be separate named accounts
- Shared accounts or old accounts that should have been removed
- People using admin accounts for normal work
- Devices that are not receiving updates
- Firewalls or routers with weak settings
Work through the five control areas
Cyber Essentials focuses on five practical areas: firewalls, secure configuration, security update management, user access control and malware protection.
Treat these as five checks, not five headaches. You are not trying to build a bank-grade security programme. You are proving that the basics are in place and being managed.
Answer the questionnaire carefully
The questionnaire is detailed, but it is much easier when you have already checked your scope, devices, accounts and controls.
Be consistent. Use the notes fields where needed. If something is unusual, explain it clearly rather than trying to hide it. The business owner or a suitable senior person will need to approve the answers, so make sure they are comfortable with what is being submitted.
Keep it alive after certification
Passing Cyber Essentials is useful. Keeping the controls working is better.
Add new devices to your list. Remove old accounts. Keep software supported. Review admin rights. Check MFA stays in place. Renewal becomes far easier when Cyber Essentials is treated as normal housekeeping rather than a once-a-year panic.
What Cyber Essentials is really checking
| Control area | What it means in plain English | Common problem |
|---|---|---|
| Firewalls | Your devices and networks should not be unnecessarily exposed to the internet. | Old router rules, open ports, weak admin access or forgotten devices. |
| Secure configuration | Devices and services should not be left with risky default settings. | Unused accounts, unnecessary software, weak settings or staff using admin rights for normal work. |
| Security updates | Supported software should be kept up to date, especially when important security fixes are released. | Old operating systems, missed updates or software that is no longer supported. |
| User access control | People should only have the access they need, and admin access should be tightly controlled. | Shared accounts, leaver accounts, too many admins or missing MFA. |
| Malware protection | Devices should have suitable protection against harmful files and malicious software. | Devices not updating, unsupported systems, or assumptions that protection is working without checking. |
Why businesses struggle to pass first time
Scope is vague
If you cannot explain what is included, the rest of the assessment becomes guesswork.
Cloud services are forgotten
Microsoft 365, Google Workspace, accounting tools and business social media accounts need proper attention.
Old kit is still active
An unsupported laptop used once a month can still create a certification problem.
MFA is patchy
MFA on one account is not the same as MFA across the accounts that need it.
Admin access is too loose
Day-to-day users should not have unnecessary admin rights just because it is convenient.
Answers are inconsistent
Contradictory answers can slow everything down, even when the underlying setup is close to compliant.
Before you submit, check these first
- You know why you need Cyber Essentials.
- Your scope is clearly defined.
- Your device list is up to date.
- Your cloud services have been included.
- Home and remote working devices have been considered.
- Contractor and third-party access has been reviewed.
- Unsupported software has been removed or replaced.
- MFA is enabled where required.
- Admin accounts are controlled.
- Old user accounts have been removed.
- Firewalls and software firewalls are enabled.
- You have answered the questionnaire from evidence, not memory.
If contractors or subcontractors can access your systems, this can affect how you answer some scope and access questions. Our guide on whether contractors and subcontractors are in scope for Cyber Essentials explains that in more detail.
How to pass Cyber Essentials: common questions
Can a small business pass Cyber Essentials?
Yes. Cyber Essentials is designed to be achievable for smaller organisations, as long as the basics are properly managed. The challenge is usually gathering the right information and fixing gaps before submission.
Should we complete the questionnaire first and fix things afterwards?
It is usually better to prepare first. Check your scope, devices, cloud services, accounts and updates before you submit. That reduces the chance of delays or confusing answers.
Do cloud services count for Cyber Essentials?
Yes, and they cannot be excluded from scope. If your organisational data or services are hosted in cloud services, those services must be included. Microsoft 365, Google Workspace, accounting systems and business cloud storage are common examples.
Do we need Cyber Essentials Plus?
Not always. Many businesses start with standard Cyber Essentials. Cyber Essentials Plus may be needed when a contract, customer or sector requires technical verification.
What is the quickest way to get ready?
Start with scope and asset information. Once you know what devices, users, accounts and cloud services are involved, it becomes much easier to spot the gaps that could block certification.
Can Black Swan help us pass Cyber Essentials?
Yes. We typically start with a short conversation to understand your setup - what devices you use, how your team works, whether you have contractors or remote workers, and what cloud services are involved. From there we can identify the gaps most likely to cause problems, help you put together a clear device and scope list, and walk you through the question set so your answers are consistent and backed by evidence rather than guesswork. Most small businesses we work with are closer to compliant than they think. The work is usually about tidying up what is already there rather than starting from scratch.
Need Cyber Essentials for a tender, client or insurer?
We help trades, suppliers, schools, care providers, charities and small businesses prepare for Cyber Essentials in plain English. No scare tactics. No over-complicated project. Just a sensible route from "we need the certificate" to "we know what needs doing".