Cyber Essentials, Essential Eight and other free government guidance

Free government cyber security guidance for small businesses

Pick the guide of your country first, then decide whether a certification is worth it: the guides are free, and only the UK’s Cyber Essentials has a set price. This comparison is part of protecting a small team’s logins, and the UK’s Cyber Essentials overview is the most complete example of the genre.

All four countries agree on the basics: multifactor authentication, updates, backups, limited administrator rights, and staff who know how to spot and report a scam. They differ on certification, on detail, and on how recently they were revised.

The four countries at a glance

UK: Cyber Essentials

Cyber Essentials is the minimum standard the UK government recommends for any organization. It rests on five technical controls: firewalls, secure configuration, security update management, user access control, and malware protection. Its requirements, version 3.3, have applied since April 27, 2026, with a question set named “Danzell” for any assessment bought since then.

For accounts, the requirements are concrete: unique credentials for each user, separate accounts for administration, accounts removed when someone leaves, and MFA always for cloud services. Passkeys based on FIDO2 count as MFA. Without MFA, passwords must be at least 12 characters, or eight with a blocklist of common passwords, and should not be forced to expire on a schedule.

The self-assessment is sold through IASME, the NCSC’s delivery partner. Prices on November 10, 2026:

The certificate lasts 12 months. Cyber Essentials Plus adds an independent technical test, priced on quote. IASME offers a 75% discount to UK micro, small, and medium organizations that have not held Cyber Essentials in the last four years, subject to funding, for assessments bought by March 31, 2027.

UK-based organizations certified as a whole, with a turnover under £20 million, can opt into an included cyber insurance policy, capped at £25,000. It does not cover money stolen by fraud, which matters if your main fear is a fake invoice.

The NCSC also offers free help: a 30-minute consultation with an NCSC-assured Cyber Advisor, the Cyber Action Toolkit launched in October 2025, the Check your cyber security tool, and Exercise in a Box.

Australia: from the Essential Eight to a small business handbook

The Essential Eight lists eight mitigation strategies: patching applications, patching operating systems, multifactor authentication, restricting administrative privileges, application control, restricting Microsoft Office macros, user application hardening, and regular backups. Its maturity model, last updated in November 2023, runs from level zero to three, and the ASD’s educational pack recommends level one for small businesses. No certification is required.

On October 15, 2026, the ASD evolved the Essential Eight into the ASD Essentials for enterprise IT, written mainly for government, critical infrastructure, and large organizations. For a small team, the reference is now the small business cyber security handbook of October 7, 2026, which starts with three measures: MFA, updates, and backups.

To report a cybercrime, a small business uses ReportCyber; the Australian Cyber Security Hotline, 1300 CYBER1 (1300 292 371), answers 24 hours a day.

Canada: baseline controls and CyberSecure Canada

The Cyber Centre’s baseline cyber security controls, version 1.2 (page last modified in 2020), target organizations with fewer than 500 employees and follow an 80/20 rule: most of the benefit for a fraction of the effort. They contain 13 baseline controls and five organizational ones. On accounts, they ask for two-factor authentication wherever possible, and always for financial, administrator, cloud administration, privileged, and executive accounts; password changes only on suspicion of compromise; and administrator accounts used for administration only.

CyberSecure Canada certifies small and medium businesses against a national standard, through certification bodies accredited by the Standards Council of Canada; no price is published. Get Cyber Safe’s guide for small businesses offers a simpler 10-step version.

US: CISA, NIST, and the FTC

In the US, three free sources cover the ground:

• CISA’s Cyber Essentials addresses leaders of small businesses in six elements, from “Yourself” to “Your Crisis Response.” Its page “Secure Your Business” asks for phishing-resistant MFA where available and an incident plan drilled at least once a year.
• NIST SP 1300, the small business quick-start guide to the Cybersecurity Framework 2.0 (February 2024), organizes everything in six functions, from Govern to Recover.
• The FTC’s small business pages cover the basics, email authentication, remote access, vendors, and cyber insurance.

Turning the guides into a to-do list

The guides overlap more than they differ. Our checklist for teams of two to 20 merges them into 15 steps, with the agency behind each.

The training part

Every guide above asks you to train your staff. See the free courses and kits for a small team, country by country.