Cyber Essentials Mark: What Does an SME Need Before a Big Customer's Security Questionnaire Lands?

If a larger customer sends you a security questionnaire, the answer you want to give is "yes, and here is the paperwork". In practice that means six or seven things written down and genuinely working: a list of your devices, accounts and data; software updates applied on a schedule; antivirus on every machine; one named account per person with the right level of access; a backup you have actually restored from; and a one-page plan for what happens when something goes wrong. Those are the core of Singapore's Cyber Essentials mark, and they are what the questionnaire is asking about underneath the jargon. Assembling them in October is an administrative job of a few days. Being asked in January without them is a stalled tender.

Why are larger customers suddenly asking SMEs about cyber security?

Because their own auditors made them. A listed company, a bank, a government agency or a multinational's regional office now has to demonstrate that it checks its suppliers, not only itself. The cheapest way to do that across hundreds of vendors is to push a standard questionnaire down the chain and file the answers. You are not being singled out. You are being processed.

The commercial consequence is what matters. The questionnaire almost never arrives on its own. It arrives attached to something you want: a contract renewal, a larger purchase order, a new-vendor onboarding form, a tender submission. A slow or vague answer delays the thing you were chasing. A supplier who replies in two days with a certificate attached reads as lower risk than one who goes quiet for three weeks and then asks what multi-factor authentication means.

What does the Cyber Essentials mark actually require?

The Cyber Security Agency of Singapore pitched the Cyber Essentials mark at organisations with little or no in-house IT. It is deliberately about hygiene rather than advanced defence, and it groups into a short list you can audit yourself in an afternoon:

• Assets. You know what hardware, software, data and user accounts exist, and who holds each one.
• Secure configuration. Default passwords changed, unused features and services switched off.
• Updates. Operating systems and applications patched on a schedule, not whenever someone clicks the reminder.
• Antivirus. Installed and actually running on every laptop and phone used for work, including personal devices if staff use them.
• Access control. One account per person, multi-factor authentication on email and anything touching money, and access removed on an employee's last day.
• Backup. Copies held separately from the live system, with at least one restore you have tested and dated.
• Incident response. A short written plan naming who is called, in what order, when something breaks.
• Awareness. Staff told in writing what a phishing message looks like and what they must never do.

Certification is assessed by an approved third party and runs for a fixed term before renewal, so it behaves like a one-off project with a periodic refresh rather than a permanent overhead. There is a higher tier, the Cyber Trust mark, aimed at organisations with more complex risk profiles. Most SMEs being asked these questions want Cyber Essentials, not Cyber Trust.

Will cyber insurance cover you without these controls in place?

This is where the cost hides. A cyber insurance application asks almost exactly the same questions as the customer questionnaire: do you enforce multi-factor authentication, do you keep backups separate from the network, do you train staff on phishing. Your answers become part of the contract you are signing.

If you answer yes when the honest answer is "mostly" or "we intended to", you have bought a policy that can be challenged at the one moment you need it to pay. That is worse than being uninsured, because you have paid a premium for an outcome you may not get. Insurers also price on these controls, so the same work that satisfies your customer tends to reduce the premium. Do the controls first, then answer the application from what is actually true.

What should you decide in October rather than January?

Four decisions, and they are small:

• Certify, or just be ready? If one named customer has already asked, or you tender for corporate and public sector work, certification pays for itself as a sales document. If nobody has asked yet, do the controls and skip the certificate for now.
• Who owns it? One person, by name, with the authority to switch things off. Shared ownership of security means no ownership.
• Does it sit in the 2027 budget? Assessment fees, a password manager, backup storage and any device replacements belong in next year's numbers, decided now while the budget is still open.
• What do you send customers in the meantime? A one-page security summary covering the eight areas above, signed and dated. It answers eighty percent of questionnaires without a certificate.

How much does this cost, and is there funding?

The assessment fee quoted by certification bodies varies with your headcount and how complex your systems are, so get two quotes rather than budgeting from a figure you read somewhere. The larger cost is usually internal time: someone has to inventory the devices, chase staff onto multi-factor authentication, and run a real restore test.

Some security tools, and in some cases certification and consultancy work, fall under government support schemes, but the supportable list and the rates change. Check what is currently listed before you assume a subsidy, and remember that the grant processing queue thickens badly towards year end. If funding is part of your plan, the application needs to be in motion in October, not after the Christmas shutdown.

What if you decide not to certify at all?

That is a legitimate choice, and for many smaller businesses it is the right one this year. But separate the certificate from the controls. The certificate is a sales and procurement asset. The controls are what stop you losing a week of trading to ransomware and what keep your insurance honest. Declining the certificate while skipping the controls is not a cost saving, it is an unpriced bet on nothing going wrong during your busiest quarter.

Frequently asked questions

How long does Cyber Essentials certification take from a standing start? Expect a few weeks in practice. The self-assessment work is days, but fixing what the self-assessment exposes, usually missing multi-factor authentication, untested backups and old staff accounts still active, takes longer than the paperwork, and the assessor's schedule is outside your control.

Can we answer a customer's security questionnaire honestly without any certification? Yes, and most SMEs do. Answer each question factually, state plainly what you do not yet have, and attach your one-page security summary with a date on it. Procurement teams accept a documented gap with a remediation date far more readily than a confident answer that falls apart on inspection.

Our staff use their own laptops and phones. Does that block certification? No, but it has to be addressed rather than ignored. You need a written position on personal devices used for work, covering antivirus, screen locks, what company data may be stored locally, and what happens to that data when the person leaves.