Cyber Awareness Month 2026 | Week 3: Cyber Essentials

Cyber Essentials: Getting the Basics Right

For Week 3 of Cyber Awareness Month, we're looking at Cyber Essentials, the UK Government-backed certification scheme designed to help organisations protect themselves against some of the most common cyber threats.

At its heart, Cyber Essentials is about getting the fundamentals right.

Cyber criminals will often look for the easiest route into a business. Weak passwords, unpatched software, poorly configured devices and unnecessary access can all create opportunities. Cyber Essentials focuses organisations on addressing these fundamental weaknesses and putting appropriate technical controls in place. This aligns with the Cyber Essentials material we've previously developed at DSM.

What is Cyber Essentials?

Cyber Essentials provides businesses with a clear framework for improving their cyber security and demonstrating that key protections are in place.

There are two levels:

Cyber Essentials -The standard certification uses a self-assessment process to demonstrate that your organisation has appropriate technical controls in place against common cyber attacks.

Cyber Essentials Plus - Cyber Essentials Plus covers the same technical controls, but includes independent technical verification rather than relying solely on the self-assessment.

For SMEs in particular, that gives businesses a practical benchmark rather than simply assuming their IT is "secure".

Why does it matter?

Cyber Essentials isn't simply about achieving a certificate. It's about reducing avoidable risk.

The recent critical vulnerabilities discovered in PHP are a particularly timely reminder.

On 21 October, the UK's National Cyber Security Centre urged organisations to take immediate action over two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Under certain conditions, the vulnerabilities could allow an unauthenticated attacker to remotely execute code on an affected web server. The NCSC advised organisations to identify PHP systems, prioritise internet-facing infrastructure and apply security updates.

The situation quickly became global news, with organisations taking websites offline as a precaution while systems were patched. In the UK, 32 government services were reported as having been taken offline, largely as a precaution, while updates were applied.

It's a good example of a simple reality:

You don't have to be specifically targeted to become exposed to a cyber threat.

Businesses depend on operating systems, websites, cloud platforms, applications and third-party software. When a serious vulnerability appears, the organisations that understand their environment and maintain strong patching processes are in a much better position to respond.

And that's exactly the type of cyber hygiene Cyber Essentials is designed to encourage.

Cyber security doesn't have to be overwhelming

For many organisations, the biggest challenge is knowing where to start.

Cyber Essentials provides that starting point. Instead of trying to protect against every conceivable cyber threat, it establishes a baseline of sensible technical controls and gives businesses something measurable to work towards.

For customers, suppliers and partners, certification can also provide visible reassurance that cyber security is being taken seriously.

At DSM Systems, we work with businesses to understand their existing IT environment, identify gaps and help put the right technical controls in place to strengthen their cyber security.