Last updated: 19 Oct 2026 03:00 Posted in: AIA
Steven Allan (CEO) explains why Cyber Essentials provides a valuable security baseline for accountants, but ongoing monitoring and management remain essential.
It is beyond debate that cyber security remains a significant risk for UK businesses. In fact, the government’s latest Cyber Security Breaches survey 2025/26 found that 43% of businesses had experienced some form of cyber security breach or attack within the last 12-month period.
In an accountancy environment where compliance is increasingly complex and client expectations surrounding security are rising, Cyber Essentials (CE) certification provides firms with a recognised, government-backed baseline for cyber security.
While it is an important element of modern security, certification alone does not make a company secure. Instead, it establishes a baseline and businesses need to recognise that cyber security requires ongoing monitoring and management. What, then, should firms do to remain protected as cyber threats continue to evolve?
The challenge facing the accountancy sector
Accountants handle and store large amounts of confidential client information, making them attractive targets for cyber criminals.
If a firm fails to maintain effective cyber security, criminals may be able to steal sensitive data, potentially causing significant financial and reputational damage. Basic protections, such as strong passwords and multi-factor authentication, can help prevent attacks but firms need to consider their security more broadly.
Cyber threats continue to evolve, while criminals can also exploit relatively simple weaknesses in an organisation’s systems and security practices.
Why Cyber Essentials matters
CE plays an important role in improving cyber resilience.
The government-backed scheme helps organisations implement a set of fundamental security controls designed to reduce exposure to common cyber threats:
● Firewalls: creating a security boundary between an organisation’s network or devices and the internet;
● Secure configuration: configuring computers, software and devices securely and removing unnecessary functionality or default settings;
● Security update management: keeping operating systems, software and devices up to date and applying security fixes promptly;
● User access control: restricting access to systems and data to those who need it, with particular controls over administrative accounts; and
● Malware protection: protecting devices against malicious software through appropriate technical measures.
The technical requirements underpinning these controls are not static. They are reviewed regularly to reflect changes in technology and cyber risk, and version 3.3 took effect in April 2026.
The latest update strengthens and clarifies the requirements in several areas. Cloud services that store or process organisational data must be included within the scope of certification, while failure to use multi-factor authentication for cloud services where it is available now results in an automatic assessment failure. The revised guidance also places greater emphasis on passwordless authentication, including passkeys, and on the importance of backups in recovering from a cyber incident.
The changes demonstrate that even the baseline provided by CE must evolve as technology and cyber threats change.
For many businesses, CE can deliver immediate benefits. Certification can support procurement requirements, improve client confidence and provide a clear framework for addressing basic cyber hygiene. Eligible UK organisations with turnover below £20 million can also receive cyber liability insurance as part of the certification.
In sectors such as accountancy, where firms hold significant amounts of confidential client information, certification can also provide reassurance that an organisation has implemented recognised baseline security controls.
However, CE is a baseline rather than a complete cyber security solution. Security requires ongoing management and monitoring. As Jamie Akhtar, CEO of CyberSmart, put it in the Making IT Simple podcast: ‘Doing something like Cyber Essentials once a year and not using software to monitor is like getting a scale and polish at the dentist then never brushing your teeth for the rest of the year.’
When Cyber Essentials isn’t quite enough
Achieving CE certification demonstrates that an organisation has met the scheme’s baseline requirements. What it does not guarantee, however, is that security controls will remain effective and consistently applied as the business and the cyber threats it faces evolve.
Cyber Essentials Plus (CE+) builds on the core certification, providing a higher level of assurance that an organisation’s cyber security controls are working in practice. Unlike standard CE certification, CE+ includes an independent technical audit and vulnerability assessment carried out by a qualified assessor. It helps businesses demonstrate their commitment to protecting sensitive data, reducing cyber risks and building trust with customers, suppliers and stakeholders.
However, even organisations that have achieved CE+ still need to manage cyber security on an ongoing basis. Systems change, new devices and users are added, software vulnerabilities emerge and security updates become available.
In practice, firms need appropriate resources, whether internally, through an external IT or cyber security provider, or through a combination of the two, to manage areas such as email security, multi-factor authentication, security updates and threat detection. The challenge is to ensure that the controls assessed during certification continue to operate effectively in practice rather than allowing gaps to develop over time.
Cyber risk in numbers
The government’s Cyber Security Breaches Survey 2025/26 highlights the scale and nature of the threat facing UK businesses:
● 43% of businesses identified a cyber security breach or attack in the previous 12 months.
● 54% of businesses in the professional, scientific and technical sector identified a breach or attack, significantly above the business average.
● 38% of all businesses experienced phishing, making it by far the most common type of breach or attack.
● 12% experienced people impersonating their organisation or staff in emails or online.
● 7% experienced viruses, spyware or other malware.
● Among businesses that identified a breach or attack, 88% of firms experienced phishing.
Security beyond certification
The most resilient, well-prepared organisations treat CE as part of a wider security strategy rather than a standalone objective.
That requires responsibility at an appropriate level within the organisation. The Cyber Security Breaches Survey 2025/26 found that 54% of UK finance and insurance businesses had a board member with specific responsibility for cyber security, compared with 31% of businesses overall.
However, staff may not always have the time or expertise to regularly monitor devices and systems, apply security updates promptly, review access controls, educate colleagues about cyber risks and ensure that policies remain aligned with changing business requirements. Firms therefore need to ensure that responsibility for these areas is clearly allocated and appropriately resourced, whether through an internal team, an external cyber security provider or a combination of the two.
External expertise can also provide additional support when new threats emerge or security and compliance requirements change.
In conclusion
CE remains a valuable place to start. It provides structure, clarity and a recognised benchmark for organisations looking to improve their cyber resilience, but certification alone should never be viewed as the destination.
CE+ builds on this by providing a higher level of assurance through independent technical testing, but the firms best prepared for today’s cyber risks are those that understand security is not something achieved once and forgotten. It must be maintained, monitored and continuously improved. The National Cyber Security Centre itself emphasises that maintaining assurance should be a continuous activity as threats, vulnerabilities, technologies and business use change.
The question is no longer whether an organisation should achieve CE certification. The more important question is what happens after it does.
Author bio
Steven Allan
CEO, Linten Technologies
"The question is no longer whether an organisation should achieve Cyber Essentials certification. The more important question is what happens after it does."
Steven Allan, CEO, Linten Technologies