Does Cyber Essentials prevent ransomware?

It does not guarantee prevention, but it closes the common entry points ransomware affiliates rely on: exposed services, unpatched systems, weak access control and missing MFA.

Are small businesses really targeted by ransomware?

Yes. Ransomware affiliates use internet-wide scanning and mass phishing. Targeting is by opportunity, not by company size.

What is the single most important control to prioritise?

Multi-factor authentication on every account that can reach the internet or cloud services, especially admin accounts and remote access.

How quickly should critical patches be applied?

IASME requires high and critical patches on in-scope systems within 14 days. For internet-facing systems, 48 hours is a safer working standard.

Most Ransomware Attacks Start With Basic Cyber Gaps

The unglamorous truth about how attackers get in

Industry threat reporting consistently shows the same short list of initial access routes behind ransomware incidents: known vulnerabilities in internet-facing systems, VPN and remote access gateways that are behind on patches, credentials bought or phished from staff, and admin accounts with no multi-factor authentication.

None of that requires a zero-day. It requires an organisation that has not tightened the basics.

Why SMEs get hit

They assume they are too small to be targeted. Ransomware affiliates scan the whole internet, not a shortlist.
They have public-facing services that nobody is clearly responsible for patching.
Admin accounts are shared, reused or lack MFA.
End-user devices are managed inconsistently.
Backups exist but have never been tested end-to-end.

How the five Cyber Essentials controls map to real ransomware entry points

Firewalls and internet gateways reduce exposed services.
Secure configuration removes default accounts and unnecessary features attackers rely on.
Security update management closes the known vulnerabilities affiliates scan for.
User access control stops one compromised account from becoming domain-wide access.
Malware protection catches commodity payloads before they detonate.

See the full breakdown in the 5 Cyber Essentials controls and the specific MFA requirements for 2026.

Practical hardening checklist

Enforce MFA on every cloud admin account and every remote access route.
Patch internet-facing systems within 14 days, ideally within 48 hours for critical CVEs.
Remove unsupported operating systems and end-of-life network appliances from the internet perimeter.
Review who holds administrator rights and revoke anything unused.
Maintain an asset inventory so nothing gets forgotten on the edge.
Test backups by restoring, not by looking at green ticks in a console.

Cyber Essentials is not a ransomware guarantee. What it does is make sure the door is locked, the windows are shut and someone owns the keys.