A Practical Application of the Cyber Essentials UK Scheme
A practical guide that helps small and medium-sized businesses turn cyber security concepts into concrete controls that protect their operations.
About the book
One click on a fake link, a reused password or an unpatched program is enough to bring operations to a halt.
Small and medium-sized businesses have become a favourite target for cyber criminals. One click on a fake link, a password reused across several systems or a program that has not been updated is enough to bring operations to a halt, expose customer data and open the door to fraud. Almost always, the problem starts with a simple failure that could have been fixed.
The Minimum Cyber Security Every SME Needs is a practical information security guide written for two audiences: those who have never dealt with the subject, and those who already work in the field and need a proven standard to guide their own organisation or their clients.
It starts from Cyber Essentials, the scheme created by the UK government to define the baseline level of cyber security that every organisation should have, and shows how to apply it to the reality of smaller businesses, in clear language and without jargon.
Minimum viable security
“Those who chase perfection end up putting off every initiative. Those who implement the essentials need to start with what they can actually implement, maintain and sustain.”
Small and medium-sized businesses do not need to start with the perfect architecture. They need to start with the controls that genuinely reduce their exposure. The book applies the logic of the minimum viable product to cyber security: implement the minimum necessary first, with discipline and consistency, and build from there. It is not a guarantee against every attack, but a solid foundation on which a business can grow.
Cyber Essentials
The technical core of Cyber Essentials: five controls that, when properly implemented and maintained, reduce a business's exposure to the most common attacks.
Control what enters and leaves the network and each device, closing ports and services that do not need to be exposed to the internet.
Removes unnecessary accounts, software and features, changes default passwords and adjusts devices so they are not left open as they come from the factory.
Keeps systems and applications supported by the vendor and applies critical security fixes within a short timeframe.
Ensures each person has only the access they need, with strong authentication and separate administrator accounts.
Prevents malicious software from being installed or run, using active anti-malware or an allow list of approved applications.
More than the five controls
Beyond the technical controls, the book covers backups, incident response, security culture, the UK GDPR and how to get started.
Firewalls, secure configuration, security updates, user access control and malware protection, explained in detail.
How to define the scope, from the office network to cloud services, home working and personal mobile phones used for work.
Ransomware, phishing, leaked passwords and other attack vectors relevant to small and medium-sized businesses.
How to set up backups that can survive a ransomware attack.
A practical guide to what to do in the first thirty minutes of an incident.
How to make security a routine, not just a tool.
What the UK GDPR requires on security, and how to handle personal data breaches, the ICO and the people affected.
A step-by-step roadmap to start structuring the business's security.
Checklists throughout the book and guides to help the business ask its IT provider for the right measures and check that they are in place.
Controls and certification
The chapters on the controls follow, question by question, Danzell, the 2026 question set used by the IASME Consortium for the Cyber Essentials self-assessment.
Each chapter opens with a map of the questions covered and explains what each question is looking for, which answer is accepted and what evidence the assessor expects to see.
Beyond the technical side, the book includes template policies and procedures to adapt to the business's own situation, such as an information security policy.
Each topic is illustrated with real cases, and the text brings together quotations and academic references for readers who want to explore further.
Audience
For those who have never organised their business's security. The book turns each control into management decisions and shows what to ask, what to require and how to check it has been done, without needing to master the technical side.
For professionals who serve small and medium-sized businesses and need a minimum baseline to organise assessments, set priorities and explain to clients, in business language, why each measure matters.
For lawyers who advise businesses and need to understand basic security controls in order to draft contracts with technology suppliers, advise on UK GDPR matters and act in the event of incidents or regulatory inspections.
For service providers who need to put minimum protection in place with limited resources, including when larger clients require evidence of security across their supply chain.
The author
A lawyer specialising in digital law, cyber security, privacy, data protection and digital fraud, Ricardo Córdoba Baptista brings together both the technical and the legal perspectives of information security.
He has worked in this field for more than twenty years, and that experience shapes the book's practical approach.
Blog
Short articles on information security for small businesses, written for people who need to decide and act.
A step-by-step roadmap for an SME to start structuring its information security in the first 90 days, with realistic priorities.
Read articleWhat the UK GDPR requires on the security of personal data, how basic cyber security controls support it and what to do when a breach happens.
Read articleA practical guide to the first minutes of an incident: isolate devices, preserve evidence, bring in the right people and assess data protection obligations.
Read articleStart with the controls that need to be working before an incident forces your business to start.