The UK Government and the National Cyber Security Centre (NCSC) have launched a major new cyber security campaign urging businesses to “lock the door on cyber criminals.”
Designed particularly with small and medium-sized enterprises (SMEs) in mind, the message is simple but critical: cyber security is no longer optional. As digital dependency grows, so too does the financial and operational impact of cyber crime. For SMEs, this campaign could not be more timely.
The growing risk for SMEs
Cyber crime is no longer just a problem for large enterprises with deep pockets and complex IT estates. SMEs are now prime targets because attackers know they often lack dedicated cyber security teams or mature protection strategies.
The statistics behind the government’s campaign paint a stark picture:
- The average cost of a cyber incident is £195,000, a potentially crippling blow for many SMEs1.
- 50% of small businesses have suffered a cyber breach or attack in the last 12 months, proving that no organisation is too small to be targeted2.
- Businesses with Cyber Essentials certification make 92% fewer insurance claims, showing that even basic controls significantly reduce risk3.
- Cyber crime is estimated to cost UK businesses £14.71 billion every year, creating a heavy burden on the wider economy4.
These figures don’t just highlight the scale of the threat; they reveal a major opportunity for SMEs to strengthen their defences and protect their future.
Why cyber essentials is a smart starting point
At the centre of the government’s messaging is the Cyber Essentials certification scheme, a practical baseline of cyber security controls designed to protect organisations against the most common online threats.
Developed by experts at the National Cyber Security Centre (NCSC) and the Department for Science, Innovation and Technology (DSIT), Cyber Essentials focuses on 5 key protections:
- Firewalls and internet gateways.
- Secure configuration of systems.
- Software updates and patching.
- User access control.
- Malware protection.
These aren’t complex enterprise technologies; they’re foundational measures that address the weakest entry points attackers exploit most often.
And the data shows they work. Businesses with Cyber Essentials certification make 92% fewer cyber insurance claims than those without5. That’s a powerful indication that even simple controls make a measurable difference.
Building cyber resilience
While certification is a great starting point, cyber security should not be seen as a tick-box exercise. The real value comes from building long-term resilience, the ability to prevent attacks where possible and recover quickly when incidents do occur.
This means combining technical controls with:
- Staff awareness training to reduce human error.
- Regular risk assessments.
- Backup and recovery strategies.
- Incident response planning.
When these elements work together, businesses are far better equipped to withstand modern cyber threats.
What this campaign means for SMEs
The government’s message is clear: cyber security is now a business essential, not an IT nice-to-have. With threats increasing and costs rising, SMEs that take action today will be better protected tomorrow.
This campaign should act as a wake-up call for organisations that have delayed investment in cyber security. By adopting recognised standards like Cyber Essentials and embedding good security practices into everyday operations, SMEs can reduce their exposure to risk, strengthen customer trust, and support the UK’s wider effort to combat cyber crime.
Free tools and support for SMEs
Recognising that many small businesses do not have in-house IT or cyber security specialists, the campaign focuses on making support simple and accessible. It promotes a range of free tools and resources designed to help organisations take their first steps towards stronger protection.
These include the Cyber Essentials Readiness Tool, which offers an online self-assessment to highlight potential vulnerabilities, alongside free 30-minute consultations with a National Cyber Security Centre-assured cyber adviser for SMEs preparing for certification.
Businesses can also explore key materials in advance, such as the Cyber Essentials Question Set and the Requirements for IT Infrastructure guidance, enabling them to understand what is required and evaluate their level of readiness before beginning the formal application process.
A chance to act now
For many SMEs, the biggest barrier to better cyber security is knowing where to start. The government’s campaign provides that starting point, and the statistics prove that even small improvements can make a big difference.
Cyber criminals are already testing the doors. Now is the time for businesses to lock them.
Need some help?
Our team comprises of highly qualified professionals with extensive experience in guiding organisations through the CE and CE+ certification processes. We understand the intricate requirements and provide tailored guidance to meet your specific requirements. With a deep knowledge of the full IT stack, including infrastructure, applications, and data management, we offer end-to-end guidance to ensure your IT environment is secure and compliant with CE standards.
We’ll work closely with you to understand your challenges, offering bespoke guidance and support at every step. With a high success rate in helping clients achieve their CE and CE+ certifications, our proven methodologies ensure you meet all standards efficiently and effectively.
We support organisations across the UK in achieving and maintaining CE and CE+ certification with confidence.
Our security specialists combine deep technical expertise with real-world experience across the full IT stack, from infrastructure and networks to applications, cloud environments and data management. We understand that CE accreditation isn’t just about meeting a checklist; it’s about building a secure, resilient and compliant IT environment that protects your organisation long term.
We work in partnership with you to understand your current posture, identify any gaps and deliver clear, practical guidance tailored to your organisation. Our structured, proven approach simplifies the certification journey, helping you meet CE and CE+ standards efficiently and with minimal disruption.
Achieving certification is just one part of a strong cyber security strategy. Many of the organisations we support also strengthen their security posture through proactive services such as Penetration Testing and our Cyber Assurance bundles, practical, SME-focused solutions designed to provide ongoing protection, visibility and peace of mind.
Businesses urged to “lock the door” on cyber criminals as new government campaign launches - GOV.UK
Cyber Security, MDR, Penetration Testing, Blogs, SIEM, Cyber Resilience, Backup, Disaster Recovery, Cyber Assurance
