What Does Cyber Essentials Cover? The 5 Technical Controls Explained
A clear, direct answer to this question — written for UK business owners and IT decision-makers.
Direct Answer
Cyber Essentials covers five technical controls: firewalls and internet gateways, secure configuration, user access control, malware protection, and patch management. Together these controls prevent the majority of common internet-borne attacks. They do not cover physical security, social engineering, or advanced threats — which is why Cyber Essentials is a baseline, not a complete security programme.
Key Points
What you need to know.
The Short Answer
55,995 Cyber Essentials certificates were awarded in 2025; 42,288 at CE level and 13,707 at CE Plus.
For UK Businesses
Only 3% of all UK businesses are Cyber Essentials certified — rising to 21% among large businesses.
Cost Considerations
Only 12% of businesses are aware of the Cyber Essentials scheme (51% among large businesses).
Next Steps
Organisations with Cyber Essentials are 92% less likely to make a claim on their cyber insurance.
Quick Comparison
| Feature | Option A | Option B |
|---|
Frequently Asked Questions
Phishing is the most common attack type, identified by 85% of businesses that experienced a breach (DSIT 2025). Phishing accounts for 93% of cyber crimes against businesses. AI-powered phishing has driven a 204% increase in phishing emails delivering malware in 2025.
Yes. 50% of small businesses (10-49 employees) reported a cybersecurity breach in 2025. UK small businesses face around 65,000 hack attempts daily, with approximately 4,500 successful breaches. More than a quarter of SMBs say a single cyber attack could put them out of business entirely.
UK businesses typically allocate 13.2% of their total IT budget to cybersecurity. More than half of UK small businesses increased their cybersecurity spending in 2024. 85% of UK firms plan to boost their cyber budget for 2026. The cost of prevention is significantly less than the average breach cost of £3,550.
BEC is a type of fraud where attackers impersonate executives or suppliers to trick employees into transferring funds or sharing sensitive data. BEC attacks increased 33% in 2025. The average loss per BEC incident is $137,000. Even organisations with fewer than 1,000 employees face a 70% weekly probability of a BEC attempt.
The top threats are phishing (85% of breaches), ransomware (doubled year-on-year), business email compromise (increased 33% in 2025), and supply chain attacks (35.5% of all breaches now originate from third parties). AI-powered attacks are accelerating all of these threat categories.
Need More Detail?
Speak to an AMVIA expert for advice tailored to your business.
Related Questions
Cyber Essentials Certification
AMVIA's managed Cyber Essentials service — gap assessment, remediation, and certification at a fixed price.
What Is Cyber Essentials?
An overview of the UK government's baseline cybersecurity certification scheme.
Cyber Essentials vs Cyber Essentials Plus
The difference between the self-assessed and independently verified tiers of certification.