The Cyber Essentials scheme, launched 10 years ago, has been pivotal in protecting UK businesses from common cyber threats. Backed by the government, this initiative has fostered awareness, improved risk management, and bolstered security practices. A recent Cyber Essentials Impact Evaluation Report commissioned by the Department for Science, Technology, and Innovation (DSIT) reflects on the scheme’s achievements and areas for improvement.
Strengthening cybersecurity awareness and practices
Cyber Essentials is built around five core controls designed to mitigate the majority of internet-based vulnerabilities. These controls have not only provided users with confidence – 82% believe their organisations are better protected – but they have also enhanced awareness of cyber risks. According to the report, 80% of users agree that Cyber Essentials has helped reduce cybersecurity risks within their organisations. Furthermore, users demonstrate a heightened understanding of the reputational, financial, and legal consequences of cyberattacks.
Through the core controls, Cyber Essentials mitigates most online vulnerabilities, establishing confidence among businesses in the strength of their cyber defences. Beyond technical controls, the scheme considerably improves users' awareness of cyber risks, helping companies to identify threats and implement better mitigation strategies.
Cyber Essentials fosters a culture of responsibility and proactive defence with 85% of users reporting a greater understanding of cyber threats. Many organisations adopt additional protective measures above the scheme’s basic requirements, integrating more robust security practices across their infrastructure.
Broader impacts on the supply chain
The scheme’s influence extends beyond individual organisations, playing a crucial role in securing supply chains. Certification is a benchmark for assessing supplier risk, with 61% of users more likely to work with Cyber Essentials certified suppliers. Three-quarters of users express greater confidence in these certified partners.
However, challenges remain. Just 15% of users have made it a requirement for their suppliers to be Cyber Essentials certified, and only a third of contracts that users entered for the next 12 months required them to be Cyber Essentials certified. While many organisations see Cyber Essentials as a mark of assurance, greater adoption and awareness are needed for it to become a universal standard.
Business benefits of Cyber Essentials
The scheme delivers a range of benefits beyond improved security:
- Enhanced competitiveness: 69% of certified businesses report greater market presence and credibility.
- Improved processes: Certification lowers the risk of falling victim to common cyber threats.
- Supply chain confidence: Validating suppliers strengthens trust across partnerships. 79% of Cyber Essentials users expressed the scheme has had a positive impact on confidence with their own clients and customers.
- Reduced financial risk: 80% of users noted decreased economic vulnerability to cyberattacks.
- Sector growth: The scheme has spurred the rise of certification bodies, boosting the cybersecurity industry.
These advantages highlight Cyber Essentials’ value not just as a protective framework but as a tool for building resilience and strengthening market positions.
The road ahead
Despite its success, Cyber Essentials faces awareness challenges. Adoption rates are growing, but the NCSC’s 2024 Cybersecurity Breaches report reveals that only 12% of businesses and 11% of charities are familiar with the scheme. Expanding awareness through targeted marketing and education is critical to unlocking its full potential.
Unlocking future potential
Over the past decade, Cyber Essentials has laid the groundwork for a stronger cybersecurity landscape in the UK. By improving awareness, mitigating risks, and encouraging best practices, the scheme has become integral to organisational and supply chain security. Moving forward, concerted efforts to increase adoption and awareness will be essential to creating a more secure digital environment. Cyber Essentials improves risk mitigation and fosters good practices within organisations of all sizes.
Brigantia vendor partner CyberSmart simplifies achieving certifications like Cyber Essentials through its automated compliance platform. Book a demo with a product specialist to learn more.
