About the book
A Practical Application of the Cyber Essentials UK Scheme
Small and medium-sized businesses have become a favourite target for cyber criminals. One click on a fake link, a password reused across several systems or a program that has not been updated is enough to bring operations to a halt, expose customer data and open the door to fraud. Almost always, the problem starts with a simple failure that could have been fixed.
The Minimum Cyber Security Every SME Needs is a practical information security guide written for two audiences: those who have never dealt with the subject, and those who already work in the field and need a proven standard to guide their own organisation or their clients.
It starts from Cyber Essentials, the scheme created by the UK government to define the baseline level of cyber security that every organisation should have, and shows how to apply it to the reality of smaller businesses, in clear language and without jargon.
Beyond the five technical controls, the book covers scope, the threats that hit SMEs hardest, backup and recovery, incident response, security culture, the UK GDPR and a plan for the first 90 days, with checklists and guides for checking the measures with the IT provider.
How to use the book
To organise the business's security step by step: define the scope, implement the five controls, set up backups and incident response, and follow the IT provider's work with checklists.
For those who want to study the scheme's requirements: the control chapters follow the Danzell question set and explain what each question is looking for and what evidence is expected.
Contents
How it relates to Cyber Essentials
The chapters on the controls follow, question by question, Danzell, the 2026 question set used by the IASME Consortium for the Cyber Essentials self-assessment.
Each chapter opens with a map of the questions covered and explains what each question is looking for, which answer is accepted and what evidence the assessor expects to see.
Beyond the technical side, the book includes template policies and procedures to adapt to the business's own situation, such as an information security policy.
Each topic is illustrated with real cases, and the text brings together quotations and academic references for readers who want to explore further.
Audience
For those who have never organised their business's security. The book turns each control into management decisions and shows what to ask, what to require and how to check it has been done, without needing to master the technical side.
For professionals who serve small and medium-sized businesses and need a minimum baseline to organise assessments, set priorities and explain to clients, in business language, why each measure matters.
For lawyers who advise businesses and need to understand basic security controls in order to draft contracts with technology suppliers, advise on UK GDPR matters and act in the event of incidents or regulatory inspections.
For service providers who need to put minimum protection in place with limited resources, including when larger clients require evidence of security across their supply chain.
Start with the controls that need to be working before an incident forces your business to start.