Cyber Essentials in Scotland: What It Costs and Why Tenders Demand It

If you have been asked for Cyber Essentials by a client, an insurer or a public sector tender, you have hit the point where security stops being an IT topic and starts being a sales one. No certificate, no contract.

What it actually is

Cyber Essentials is a UK government backed certification covering five technical controls: firewalls, secure configuration, user access control, malware protection and security update management. It is deliberately basic. That is the point. The National Cyber Security Centre states these controls block the overwhelming majority of common internet based attacks.

There are two levels:

• Cyber Essentials is a self assessment questionnaire, reviewed and certified by an accredited body.
• Cyber Essentials Plus adds a hands on technical audit, including vulnerability scanning of a sample of your devices.

Why it matters commercially

• Most Scottish public sector and NHS contracts that involve personal or sensitive data require it as a minimum.
• A growing number of cyber insurance policies price on it, and some will not quote without it.
• Larger clients increasingly push it down their supply chain, so if you subcontract, expect the question.
• It gives you a defensible answer for UK GDPR purposes, showing you have taken appropriate technical measures.

What it costs

Certification fees are banded by organisation size and typically run from a few hundred pounds for a micro business up to around six hundred for larger organisations, with Cyber Essentials Plus costing considerably more because of the audit work. Check the current fee schedule with your certification body, as pricing is reviewed periodically.

The bigger cost is usually remediation: the unsupported Windows machine in the corner, the shared admin password, the phones running an operating system version that stopped getting updates two years ago.

Five things to sort before you apply

1. Get every device on a supported, patched operating system. Unsupported software is an automatic fail. Audit your estate now and budget for replacements, including personal phones used for work email.

2. Remove standing admin rights. Day to day accounts must not be administrators. Give admins a separate account for admin work.

3. Turn on multi factor authentication everywhere. Microsoft 365, remote access, and any cloud service holding client data. This is the single highest value change on the list.

4. Document your firewall and default settings. Default passwords changed, unnecessary services off, remote management locked down. Write it down, because the questionnaire asks.

5. Set an update deadline you can prove. High risk and critical patches within fourteen days is the standard. If nobody is monitoring this, it will not be happening.

The most common reason firms fail

Guesswork. The questionnaire asks precise questions about every device and cloud service in scope, and businesses answer optimistically. When the assessor probes, the answers do not hold. Firms that pass first time have someone who can pull an accurate device inventory and patch report in minutes.

The Orange Penguin take

We treat Cyber Essentials as an outcome of good IT management, not a project bolted on the side. Our managed clients are largely compliant by default, because patching, MFA, access control and endpoint protection are already monitored and reported. Preparation then becomes evidence gathering rather than a scramble.

We are Cyber Essentials certified ourselves, and we have taken Dundee and Tayside businesses through the process from a standing start.

Next step

If a tender deadline is looming, start with a cyber risk review. We will map your current position against the five controls and give you a plain English list of what needs fixing, what it will cost and how long it will take. Call our team on 0800 054 8805.