How we got Cyber Essentials in nine days: a practical guide for small businesses

Third Eye Open is Cyber Essentials certified. We paid for the assessment on 10 October 2026 and the certificate was issued on 19 October, nine days later.

Many guides to Cyber Essentials are written by companies that sell the assessment. This one is written by a small studio that has just been through it: the route we took, what it cost, where we spent our time and what it has done for us since.

What is Cyber Essentials?

Cyber Essentials is the minimum standard of cyber security the UK government recommends for organisations of every size. It was developed by the National Cyber Security Centre (NCSC), with IASME as the official delivery partner, and it covers five technical controls: firewalls, secure configuration, security update management, user access control and malware protection.

There are two levels. Cyber Essentials is a self-assessment that an independent assessor marks. Cyber Essentials Plus has the same controls plus a hands-on technical audit. We did the first.

	Cyber Essentials (self-assessment)
Cost, micro business (0 to 9 staff)	£320 plus VAT
Cost, small (10 to 49)	£440 plus VAT
Marking	Assessors aim to reply within 3 days
If you fail	2 working days to fix and resubmit at no extra cost
Valid for	12 months, then renew
Requirements version	v3.3, for assessments created from 27 April 2026

A board member signs a declaration that every answer is true. The assessor marks what you declare, so accuracy matters more than speed.

Why did we do it?

We build platforms that hold clients' data, and TEO Sense puts sensors in clients' buildings and sends readings to the cloud. Clients and partners reasonably ask how we protect all of that. Cyber Essentials is a short, recognised answer to the first part of that question.

Some public sector buyers require it. Under PPN 09/23, central government departments, their executive agencies, non-departmental public bodies and NHS bodies must ask for Cyber Essentials or Cyber Essentials Plus (or equivalent controls) on contracts with a higher cyber risk.

That is not why we did it, and it is a point our adviser made well. Plenty of businesses certify only to tick a box on a tender. The certificate then says one thing and the business does another. Treat the five controls as how you run things all year, and the certificate becomes a by-product.

What route did we take?

1. Joined the North West Cyber Resilience Centre. Cyber Resilience Centres are police-led and not-for-profit, with one for each region of England and Wales. Core membership is free.
2. Had a session with Paul Benson at the NWCRC. It covered why to do it, what the benefits are and how other businesses approach it, sometimes for the wrong reasons. It set the tone for everything after.
3. Worked through the free Readiness Tool. IASME and the NCSC built it. It walks you through the requirements in plain English and gives you a tailored action plan.
4. Paid for the IASME micro self-assessment on 10 October 2026.
5. Submitted, was marked and certified on 19 October 2026. The certificate runs to 19 October 2027.

Doing the Readiness Tool first is the single most useful tip we have. By the time we paid, we knew what every question was asking.

What do the five controls actually ask for?

These are the points from version 3.3 that a small business is most likely to need to act on.

Firewalls. Every device in scope needs a correctly configured firewall that blocks unauthenticated inbound connections by default. Change default router admin passwords. On public Wi-Fi, a device's own software firewall is what protects it.

Secure configuration. Remove accounts and software you don't need, change default passwords and turn off auto-run. Devices must lock, with brute-force protection of no more than 10 guesses in 5 minutes or a lockout after 10 failed attempts. A PIN used only to unlock a device needs at least 6 characters.

Security update management. Everything in scope must be licensed and supported. Critical and high-risk updates go on within 14 days of release. Software that is no longer supported has to go, or be cut off from the internet.

User access control. Each person gets their own account, and accounts that are no longer needed are removed. Admin work is done from a separate admin account that is never used for email or browsing. Multi-factor authentication (MFA) is required wherever it is available, and always for cloud services.

Malware protection. Every device in scope runs up-to-date anti-malware that also blocks malicious websites, or only runs approved, code-signed applications.

Where did we spend the most time?

On cloud services. It is the part where we wanted guidance, and we suspect most small businesses will too.

Version 3.3 is explicit: cloud services cannot be excluded from scope, and logging in to them must always use MFA. That covers email, file storage, accounting, design tools, code hosting and hosting platforms, anything that stores or processes company data. Our websites and TEO Sense run on Google Cloud in London, so the cloud question covered our own infrastructure as well as the apps we use.

The part that takes thought is shared responsibility. With a cloud service, the provider implements some controls and you implement the rest, but you remain responsible for all of them. The requirements expect the provider's part to be set out in its contract or documentation.

What worked for us:

• List every cloud service that holds company data, including the ones you only log in to once a month.
• Turn on MFA for every user on each one. Passkeys, including FIDO2 security keys, count as MFA.
• Check admin roles in each service. Give admin rights only to the people who need them, through separate admin logins.
• Find each provider's shared responsibility page and keep the links. When a question asks how a control is met on a cloud service, that is your evidence.

What did we check?

The assessment is a good reason to check everything properly. Ours came down to three areas.

• Settings. Screen locks, automatic updates, firewalls and malware protection checked on every device.
• Accounts. One account per person, reviewed so only current people have access.
• Admin accounts. Admin rights live on separate admin accounts used only for admin work. Day-to-day email and browsing happen on standard accounts.

None of this is exotic. It's what the standard asks for, and it is worth doing whether or not you certify.

How should you handle devices?

Any device that touches company data or services is in scope, including personal ones. A phone used only for calls, texts or an authenticator app is out of scope.

We kept it simple. Work happens on a dedicated work laptop with no personal accounts or sign-ins, and on a separate work phone. Nothing personal touches company data, so nothing personal is in scope. For a small team, that one decision removes most of the awkward questions.

Is there anything worth doing beyond the five controls?

Email authentication. It isn't one of the five controls, but Paul pointed us to a free web check of our email domain while we were at it, and we made sure SPF, DKIM and DMARC were all set up properly.

In short, SPF lists the servers allowed to send email for your domain, DKIM adds a signature that lets the receiver check a message really came from your domain and wasn't changed on the way, and DMARC tells receiving servers what to do with mail that fails those checks. The NCSC treats them as the core anti-spoofing standards, because they make it much harder for anyone to send convincing email that pretends to be you.

What has it done for us so far?

More than we expected for £320.

• It strengthened a funding bid. On our Digital Catapult application we said we were working towards Cyber Essentials. We were certified by the time we reached interview.
• It carries weight in conversations. When it comes up with clients and partners, it answers the security question early.
• It is easy to show. The official badge is on our site and links to the live certificate, which anyone can check.

There is also free cyber insurance for some businesses. An organisation based in the UK or Crown Dependencies, with turnover under £20m, that certifies its whole organisation through the self-assessment can opt in to £25,000 of cyber liability cover included with the certificate. Read the policy terms before you rely on it.

Our tips if you are starting now

1. Join your regional Cyber Resilience Centre. Core membership is free, and the centres are police-led.
2. Do the Readiness Tool before you pay. You will know exactly what each question means.
3. List your cloud services and switch on MFA everywhere. Cloud is where we needed the most guidance.
4. Split admin and everyday accounts. It is a requirement, and a simple change with a big effect.
5. Keep work on work devices. It shrinks your scope and your risk.
6. Answer accurately, not optimistically. If something isn't in place yet, fix it before you submit. You get two working days to fix and resubmit if needed.
7. Diary the renewal. The certificate lasts 12 months, and the requirements change from time to time.

How does this connect to what we build?

Security is part of how we design and build, not a separate step. It also belongs in the running costs of anything you build, as our guide to digital twin costs sets out. If you are choosing building sensors and want to know what to ask a supplier, our sensor security checklist on teosense.com covers it.

If you want a platform designed and built by a team that works this way, talk to us.