Cyber Essentials for Consultants and Small Consultancies

Why consultants get asked

• You work inside client systems and hold their documents.
• Public sector consultancy frameworks require it – see Consultancy frameworks RM6309 and RM6399.
• Enterprise clients apply the same supplier onboarding standard to a sole trader as to a large firm.
• It is often the cheapest way to answer a long client security questionnaire.

What is in scope for a very small business

• Your laptop, and any second machine used for work.
• Your phone if it accesses work email or documents.
• Your cloud email and storage – Microsoft 365, Google Workspace or similar.
• Your home router where it is the boundary for work devices, or the device firewall where you work from multiple locations.
• Associates and subcontractors using their own devices on your work.

Working from home is entirely normal for Cyber Essentials. See Cyber Essentials for remote workers.

The practical checklist

1. Turn on MFA for your email, storage and any client-facing platform.
2. Confirm your operating system is a supported version and update it.
3. Enable automatic updates and apply high or critical fixes within 14 days.
4. Enable the device firewall and change any default router password.
5. Use a standard account for daily work and a separate account for administrative changes.
6. Enable built-in malware protection and device encryption.
7. Set auto-lock on laptop and phone.

For most consultants this is a morning's work. The full detail is in the five controls guide.

Associates and subcontractors

If associates use their own devices on your client work, they fall inside your scope unless they hold their own certificate and you contract accordingly. Decide this before you submit, because it is the most common thing a small consultancy gets wrong.

Cost, timing and the insurance benefit

• £320 + VAT for the smallest organisations.
• 24 to 48 hours once prepared, and preparation is usually same-day for a single-person business.
• Eligible UK organisations with turnover under £20 million receive £25,000 of cyber insurance with certification.

If a client has just asked, start with what to do when a customer asks for Cyber Essentials.