In June 2014, the Cyber Essentials scheme — which is operated by the Department for Science, Innovation, and Technology (DSIT) and the National Cyber Security Centre (NCSC), and delivered through the IASME Consortium — was launched in a bid to help businesses protect themselves against the ever-changing cyber threat landscape.

A recently published report, commissioned by DSIT and conducted by Pye Tait Consulting, has revealed the scheme’s strengths since its inception nearly a decade ago, but it’s also underscored several concerns and highlighted areas of improvement.

Perhaps most notably, the report outlined that, as of the end of May 2023, there have been around 35,500 total Cyber Essentials certifications. Considering that the UK private sector boasts around 5 million businesses — around 1.1m of whom are employers — this shows that just a fraction of UK businesses have taken up the scheme.

However, uptake of the scheme is in fact rising year-on-year: in January 2017, fewer than 500 certificates were issued per month, but in January 2023, the figure was just under 3,500.

Could awareness be a factor in the scheme not having wider adoption among UK businesses? According to separate government figures, 59% of large businesses are aware of Cyber Essentials, while this falls to 50% for medium-sized businesses. Just 14% of businesses overall, however, are aware of the scheme, and just 15% of charities are aware.

According to the new DSIT report, almost two thirds (64%) of the 74 surveyed organisations that have never undertaken Cyber Essentials had not heard of it prior to taking part in the survey.

When businesses are aware of the scheme, however, the most common reason (mentioned by 34%) for undertaking it is that it’s a requirement of a public sector contract, suggesting that, in some cases, the initiative is seen as a means to an end, or a hoop to jump through.

Regarding the support that’s available to businesses undergoing the scheme, more than half of respondents (54%) described it as very helpful, and 36% said it was quite helpful. Though, more than a fifth (21%) of lapsed Cyber Essentials users described support as not very or not at all helpful.

On the question of whether the scheme is good value for money — the overall mean spend to obtain certification is estimated to be just below £5,000 — the majority (58%) strongly agree or agree, while just over a quarter (26%) are ambivalent, and nearly one fifth (16%) disagree or strongly disagree, painting a mixed picture regarding perception of value.

Recommended

• How MadeBrave is Fostering Creativity in a Post-Pandemic Workforce
• Cyber and Fraud Centre – Scotland Appoints Four New Trustees
• Virgin Galactic’s First Commercial Flight Set to Launch This Week

That said, the core goal of the Cyber Essentials scheme — to level-up cybersecurity knowledge and know-how — does seem to be having the desired effect: the majority of respondents believe that going through the Cyber Essentials process has improved their cybersecurity awareness and understanding (71%), which has thereby bolstered their ability to mitigate organisational cybersecurity risks (52%).

Further, over two thirds (67%) of respondents said that they would recommend the scheme to others, with charities and trusts especially viewing the scheme as cost-effective and accessible, suggesting that the scheme is indeed worthwhile for gaining a baseline cybersecurity knowledge.

In terms of possible improvements, the report’s writers said that “All surveyed organizations were asked in what ways they think the Cyber Essentials scheme could be improved in the future, with suggestions falling into the following five main themes: i) better tailoring and scalability; ii) improvements in communication, guidance and support; iii) reduced cost; iv) quality and scrutiny of assessments; and v) synergy with other security schemes.”

To read the full report, click here.