In short. A UK small business has four kinds of cyber security obligation: the law that applies to everyone (UK GDPR, the Data Protection Act 2018, the Computer Misuse Act and PECR), sector regulation, contractual requirements such as Cyber Essentials, and standards such as PCI DSS if you take card payments. This checklist sets out which apply to you and the ten things to have in place and be able to evidence.
A UK small business has four kinds of cyber security obligation: the law that applies to everyone (UK GDPR and the Data Protection Act 2018, the Computer Misuse Act 1990 and PECR), sector regulation if you are in a regulated industry, contractual requirements from customers and frameworks (most often Cyber Essentials or Cyber Essentials Plus), and standards such as PCI DSS if you take card payments. This checklist sets out which apply to you, what each actually requires, and the ten things to have in place and be able to evidence.
The government’s Cyber Security Breaches Survey 2025/2026 found that 43% of UK businesses identified a breach or attack in the previous year, but only 5% hold Cyber Essentials. The gap between those two numbers is where most small business compliance work sits.
Which obligations apply to you
| Obligation | Applies if | What it requires in practice |
|---|---|---|
| UK GDPR and Data Protection Act 2018 | You process personal data (every business with staff or customers) | Appropriate technical and organisational security; breach notification to the ICO within 72 hours where there is risk to individuals; fines up to £17.5m or 4% of turnover |
| Computer Misuse Act 1990 | Always | Unauthorised access is an offence. Relevant because any security testing of your systems needs written authorisation from the owner |
| PECR | You send marketing emails or texts, or use cookies | Consent and opt-out rules for electronic marketing and tracking |
| NIS Regulations 2018 (and the Cyber Security and Resilience Bill) | You are an operator of essential services or, once the Bill passes, a medium or large managed service provider or data centre | Registration with a regulator, security duties and incident reporting. Most small businesses are outside scope |
| PCI DSS | You store, process or transmit card payments | Quarterly vulnerability scans (requirement 11.3) and annual penetration testing (11.4) among others; scope depends on how you take payments |
| Cyber Essentials / Cyber Essentials Plus | A customer, framework or insurer asks; PPN 014 for higher-risk government contracts; NHS Supply Chain for in-scope suppliers | The five technical controls, self-assessed (CE) or audited (CE+); valid twelve months |
| IASME Cyber Assurance | A customer wants governance and data protection evidence beyond Cyber Essentials, or ISO 27001 is asked for and you are small | Fourteen themes covering governance, risk, people, physical, legal and resilience; Level 1 verified, Level 2 audited |
| Sector regulators (FCA, SRA, CQC and others) | You are regulated | Sector-specific expectations; for example the SRA expects firms to take reasonable steps and to report successful cyber attacks |
The ten-point checklist
1. Know what you have and who is responsible for it
A list of your devices, systems, cloud services and the personal data each holds, with a named owner. Every obligation above starts from this and no assessor or regulator will take you seriously without it. It does not need a tool; a maintained spreadsheet is enough for most small businesses.
2. Meet the five Cyber Essentials controls
Firewalls, secure configuration, security update management, user access control and malware protection, applied to every device and cloud service including staff phones used for work. These are the NCSC’s definition of the minimum and they stop the majority of untargeted attacks. Whether or not you certify, this is the baseline. Our guide to the five controls explains what each requires and where businesses fall short.
3. Turn on multi-factor authentication everywhere it exists
Email, accounting, CRM, payroll, remote access, cloud consoles, and the domain registrar and DNS provider that everyone forgets. Under the current Cyber Essentials requirements, MFA missing on a cloud service that offers it is an automatic fail; in practice it is also the single control that prevents the most breaches.
4. Patch within 14 days and remove what is out of support
High and critical security updates applied within 14 days of release, automatic updates on wherever possible, and nothing running that its vendor no longer supports. Windows 10 left support in October 2025; if you still run it, that is your first job.
5. Give people the access they need and no more
Named accounts, a joiners-and-leavers process that removes access on the day someone leaves, and administrator accounts kept separate from the accounts people use for email and browsing. Review who has access to what at least annually.
6. Back up, and prove the backup restores
Three copies of important data, on two types of media, with one held offline or otherwise out of reach of an attacker who has your credentials. Test a restore periodically. Backups you have never restored are a hope, not a control, and they are also your answer to ransomware.
7. Train staff and give them a way to report
Short, regular awareness training on phishing and payment fraud, and a simple route for reporting something suspicious without blame. The Breaches Survey found phishing the most common attack type for 38% of businesses; a member of staff who reports a suspicious email within minutes is worth more than most technical controls.
8. Know how you would report a personal data breach
UK GDPR gives you 72 hours from becoming aware of a breach that risks individuals to notify the ICO. Write down who decides, who notifies, and what information the ICO will ask for. In April 2025 the ICO fined a Merseyside law firm £60,000 after a cyber attack; part of the failure was taking 43 days to notify.
9. Check your suppliers
Under UK GDPR you remain accountable for personal data processed by your suppliers. Know which suppliers have access to your systems and data, what security they can evidence (Cyber Essentials is the simplest ask), and put breach notification and minimum security terms in contracts. Remove supplier access when a contract ends.
10. Test, and keep the evidence
Certification tells you the controls are declared; testing tells you they work. For most small businesses that means Cyber Essentials Plus, which independently audits the five controls, and a penetration test of anything you expose to the internet, at least annually and after significant change. Keep the reports, the remediation records and the retest results. When a customer, insurer or regulator asks what you do about cyber security, this is the evidence.
Certification: which one, and when
Cyber Essentials is the right first certification for almost every UK small business: it is inexpensive, quick if the controls are in place, and increasingly required by customers and public sector frameworks. Cyber Essentials Plus adds an audit and is what most contracts that specify certification actually ask for. IASME Cyber Assurance is the next step when a customer wants evidence of governance, risk management and data protection as well as technical controls, and it is accepted by a growing number of sectors as an alternative to ISO 27001 for small companies. We explain the difference between the two Cyber Assurance levels in our guide to IASME Cyber Assurance Level 1 vs Level 2.
Incursion Cyber Security is an IASME-licensed certification body for all three, and a penetration testing consultancy for the testing in point ten. Our Cyber Essentials and Cyber Essentials Plus pages set out the process and prices.
Frequently asked questions
Is Cyber Essentials a legal requirement?
No. It is required by contract: for higher-risk central government contracts under PPN 014, by NHS Supply Chain for in-scope suppliers, and by many private sector customers and insurers. It is the simplest way to evidence the security UK GDPR requires.
Does UK GDPR require penetration testing?
Not by name. It requires security appropriate to the risk and a process for regularly testing and evaluating the effectiveness of your measures. For any business with internet-facing systems, penetration testing is the accepted way to meet that.
What happens if we do not report a breach in time?
Failing to notify is itself an infringement, with a separate maximum fine of £8.7m or 2% of turnover. The ICO has fined organisations specifically for late notification.
We are a five-person company. Does all of this apply?
UK GDPR, the Computer Misuse Act and PECR apply regardless of size. Cyber Essentials prices are banded by size and the controls scale down. The checklist above is written to be achievable for a five-person company with a competent IT provider.
Where do we start?
Points one to four. If you do nothing else this quarter, inventory what you have, enable MFA everywhere, patch within 14 days and remove anything unsupported. Then talk to us about certifying it.