Cyber Essentials for Startups and AI Companies

Why it comes up early

• Enterprise procurement applies the same supplier standard to a five-person company as to a large vendor.
• Public sector and framework routes require it – see G-Cloud 15.
• It answers a large part of a customer security questionnaire quickly and cheaply.
• It is a credible first step before the heavier ISO 27001 or SOC 2 conversations arrive.

Scoping a small, fast-moving team

• Every laptop used for work, including founders' personal machines.
• Your Google Workspace or Microsoft 365 tenant.
• Cloud accounts you administer: AWS, Azure, GCP, and your deployment and CI tooling.
• Contractors and fractional staff using their own devices – see BYOD rules.

Where AI tooling changes the conversation

Cyber Essentials assesses your technical controls, not your model. It does not review training data, model behaviour or AI-specific governance. But two things matter in practice:

• Administered cloud services are in scope. If your team administers an AI platform account, it needs MFA and controlled access like any other cloud service.
• Enterprise buyers ask beyond CE. Expect questions about data residency, whether customer data is used for training, retention and subprocessors. Prepare answers alongside your certificate.

If a buyer needs governance and risk evidence rather than just technical controls, IASME Cyber Assurance is the affordable step up and uses Cyber Essentials as its prerequisite.

The fastest path for a startup

1. Enforce MFA across the workspace and every cloud console today.
2. Confirm every laptop is on a supported OS with automatic updates and disk encryption.
3. Separate admin accounts from daily-use accounts in the tenant and in the cloud consoles.
4. Write the asset list – it takes twenty minutes at this size and saves hours later.
5. Submit, with a pre-submission review so you do not lose days to a resubmission.

Cost and what you get

• £320 + VAT for the smallest organisations, priced by size.
• £25,000 cyber insurance included for eligible UK organisations under £20 million turnover.
• A certificate number and public registry listing you can quote in every future questionnaire.

Also read what to do when a customer asks for Cyber Essentials and handling supplier security questionnaires.