If your practice bids for public-sector work or responds to client security questionnaires, you will have seen Cyber Essentials mentioned. It is a UK government-backed certification scheme designed to show that an organisation has basic, sensible protections in place against the most common cyber attacks.
For AEC businesses it is increasingly a commercial requirement as much as a security one: frameworks, local authorities and larger clients often ask for it as a condition of appointment.
What the certification covers
Cyber Essentials focuses on five technical control areas: firewalls and internet gateways, secure configuration of devices and software, access control, malware protection and keeping software up to date.
None of these are exotic. The value of the scheme is that it forces an honest audit of the basics, the unpatched machine in the corner of the studio, the shared admin password, the ex-employee account that was never disabled.
Cyber Essentials vs Cyber Essentials Plus
The standard certification is based on a self-assessment questionnaire, verified by a licensed certification body. Cyber Essentials Plus covers the same controls but adds independent technical testing of your systems.
For many practices, standard certification is the sensible starting point, with Plus considered when client requirements or risk profile justify it.
How AEC firms should approach it
The biggest mistake is treating certification as a one-off paperwork exercise. The questionnaire reflects the real state of your estate, so the work is in tidying that estate: building an accurate asset list, closing down legacy accounts, standardising device configuration and getting patching under control.
Done properly, the process leaves you with a better-managed, better-documented IT environment, the certificate is almost a by-product.
WIT guides clients through Cyber Essentials as part of a wider security programme, so the controls stay in place year after year rather than being rebuilt each renewal.