AI coding assistants in a small development team: a practical guide
How a small development team can adopt AI coding assistants well: the kinds of tool, where they save time, review habits, secrets and a two-week trial.
· 7 min readA new customer sends over their supplier questionnaire. Somewhere between the insurance details and the bank account form is a question you may not have seen before: "Do you hold Cyber Essentials certification?"
If you're not sure what it is, you're in good company. Many well-run businesses first hear about it this way. The reassuring part is that Cyber Essentials is a sensible, achievable baseline, and plenty of small businesses already have most of it in place without knowing.
This article explains what the scheme is, what it asks of you, how the two levels differ, and how to prepare without it taking over your month.
What Cyber Essentials is
Cyber Essentials is a UK government-backed certification scheme. It was developed by the National Cyber Security Centre (NCSC), and it's delivered by IASME, which runs the network of certification bodies and assessors.
The NCSC describes it as the minimum standard of cyber security the government recommends for organisations of all sizes. In practice, it's a set of sensible basics that protect against the most common problems: someone guessing or reusing a password, a laptop that hasn't had its updates, or an account that should have been closed when a person left.
It isn't an exhaustive security audit, and it doesn't ask you to buy expensive tools. It asks you to show that the basics are done, and done consistently.
The five areas it covers
The scheme looks at five technical controls. In plain English:
| Control | What it means for you |
|---|---|
| Firewalls | Your internet connection and devices have a barrier that only lets through what's needed. Most modern routers and computers already include one; it just needs setting up properly. |
| Secure configuration | Devices and software are set up sensibly: default passwords changed, unused accounts and software removed, and screens locking when left. |
| Security update management | Software is supported by its maker and kept up to date. High-risk and critical updates are applied within 14 days of release. |
| User access control | People only have the access they need. Admin accounts are kept separate and used sparingly, and multi-factor authentication (a second check, such as a code on your phone) is switched on. |
| Malware protection | Computers have protection against harmful software, such as the antivirus built into modern operating systems, kept active and up to date. |
None of these will surprise an IT support company, and that's rather the point. They're the habits that make the biggest difference for the least effort.
What changed in 2026
The requirements are updated from time to time. The current version, v3.3, applies to assessments started after 26 April 2026, and IASME's summary of the changes is worth a read if you certified before then. A few points matter most for small businesses:
- Multi-factor authentication is required on cloud services wherever it's available. That includes Microsoft 365 or Google Workspace, your accounts software, your CRM and anything else you log in to online. Missing it means an automatic fail.
- Cloud services can't be left out of scope. If your business data lives there, it counts.
- Updates have firm deadlines. High-risk and critical updates to operating systems, router firmware and applications must be applied within 14 days, and not doing so is also an automatic fail.
- Passwordless sign-in, such as passkeys, is recognised as a more secure option than passwords.
If that reads like a lot, it usually isn't. For many businesses the main job is switching on multi-factor authentication everywhere and making sure updates install automatically.
Cyber Essentials and Cyber Essentials Plus
There are two levels, and both cover the same five controls.
Cyber Essentials is a verified self-assessment. You answer a set of questions about how your business is set up, a director or equivalent signs it off, and a qualified assessor reviews the answers. The NCSC says pricing depends on the size of the organisation and starts at £320 plus VAT.
Cyber Essentials Plus adds independent technical testing. An assessor checks a sample of your devices and accounts to confirm the controls work in practice. According to IASME's guidance, the Plus audit takes place within three months of your Cyber Essentials certification, or at the same time. The cost depends on the size and complexity of your network.
Both certificates are valid for 12 months, so it becomes a yearly routine. For most small businesses, the basic level is the right place to start. Plus is worth considering when a customer asks for it, or when you'd like the reassurance of an independent check.
Who asks for it, and why it helps
Customers and supply chains. A growing number of organisations ask suppliers to hold Cyber Essentials before they'll work with them, and it often appears in tender and onboarding questionnaires. Having it ready means one less hurdle when an opportunity comes along.
Government contracts. Central government departments, their agencies and NHS bodies expect suppliers on certain higher-risk contracts to hold Cyber Essentials or Cyber Essentials Plus, as set out in Procurement Policy Note 014. Other public bodies often follow the same approach.
Insurance. The NCSC notes that organisations with a turnover under £20m that certify their whole organisation are entitled to cyber liability insurance arranged by IASME, including round-the-clock incident response support. It's worth checking the current terms, and how it sits alongside any cover you already have.
Your own peace of mind. Perhaps the best reason is the simplest. Working through the requirements gives you an honest picture of where things stand, and a short list of tidy-ups that genuinely look after the business. In our work with family-owned businesses, we often find that the process itself is as useful as the certificate.
How to prepare
A calm approach works well:
- Read the questions first. IASME publishes the self-assessment question set, and the NCSC links a free readiness tool that produces a tailored action plan. Both are on the NCSC's Cyber Essentials page.
- List what's in scope. Laptops, desktops, phones and tablets used for work (including personal devices used for business email), your internet router, and every cloud service that holds business data.
- Check the quick wins. Multi-factor authentication on every cloud service, automatic updates switched on, unsupported devices and software retired, and leavers' accounts closed.
- Separate admin accounts. People who manage systems should use a separate admin login for that work, and an everyday account for email and documents.
- Decide on your route. You can register and complete the assessment yourself, or work with a certification body, which can help interpret the questions. The NCSC also mentions a free 30-minute consultation for small and medium-sized businesses.
If you have an IT support company, ask them early. They'll know your setup and can often handle much of the technical side. If you don't, an "accidental IT person" with a free afternoon and the question set can usually get a long way.
A sensible first step
This week, open the readiness tool or the question set on the NCSC's page and spend an hour reading through it with whoever looks after your IT. Make a simple list of anything you're unsure about.
Then check one thing straight away: is multi-factor authentication switched on for your email and every other cloud service your team logs in to? If not, that's the single most valuable change you can make, with or without a certificate.
If Cyber Essentials is on your list for the year, it fits neatly into a one-page technology plan.
If you'd like a hand getting ready, or a second pair of eyes on your Microsoft 365 or Google Workspace setup before you apply, our Cloud & Microsoft 365 service covers exactly this, and we're always happy to talk it through.
