# Cyber Essentials, Essential Eight and other free government guidance

> What Cyber Essentials requires and costs in the UK, what followed the Essential Eight in Australia, and the free small business guides of Canada and the US.

Each of our four countries publishes free **cyber security guidance for small businesses**. The UK adds a paid certification, Cyber Essentials, with requirements updated on April 27, 2026. Australia evolved the Essential Eight into the ASD Essentials in October 2026, but points small businesses to a new handbook. Canada has baseline controls and an optional certification; the US relies on CISA, NIST, and FTC guides.

**Key takeaways**

1. As of November 10, 2026, a Cyber Essentials self-assessment costs £320 plus VAT for an organization with zero to nine employees, and the certificate is valid for 12 months.
2. On October 15, 2026, the ASD evolved the Essential Eight into the ASD Essentials, a framework written mainly for large organizations, and it published a separate handbook for small businesses.
3. Canada's baseline controls for small and medium organizations contain 13 baseline controls and five organizational controls, aimed at organizations with fewer than 500 employees.


## Free government cyber security guidance for small businesses

Pick the guide of your country first, then decide whether a certification is worth it: the guides are free, and only the UK's Cyber Essentials has a set price. This comparison is part of [protecting a small team's logins](/guides/account-security/team-security/), and the UK's [Cyber Essentials overview](https://www.ncsc.gov.uk/cyberessentials/overview) is the most complete example of the genre.

All four countries agree on the basics: multifactor authentication, updates, backups, limited administrator rights, and staff who know how to spot and report a scam. They differ on certification, on detail, and on how recently they were revised.

### The four countries at a glance

| Country | Main guide for small businesses | Certification | Cost |
|---|---|---|---|
| UK | NCSC small organizations guide (April 2026) | Cyber Essentials, Cyber Essentials Plus | Guide free; certification from £320 + VAT |
| Australia | ASD small business handbook (October 2026) | None required | Free |
| Canada | Cyber Centre baseline controls; Get Cyber Safe guide | CyberSecure Canada (optional) | Guides free; certification price not published |
| US | CISA Cyber Essentials; NIST quick-start guide; FTC pages | None in these guides | Free |

### UK: Cyber Essentials

Cyber Essentials is the minimum standard the UK government recommends for any organization. It rests on five technical controls: firewalls, secure configuration, security update management, user access control, and malware protection. Its requirements, version 3.3, have applied since April 27, 2026, with a question set named “Danzell” for any assessment bought since then.

For accounts, the requirements are concrete: unique credentials for each user, separate accounts for administration, accounts removed when someone leaves, and MFA always for cloud services. Passkeys based on FIDO2 count as MFA. Without MFA, passwords must be at least 12 characters, or eight with a blocklist of common passwords, and should not be forced to expire on a schedule.

The self-assessment is sold through IASME, the NCSC's delivery partner. Prices on November 10, 2026:

| Employees | Price |
|---|---|
| 0 to 9 | £320 + VAT |
| 10 to 49 | £440 + VAT |
| 50 to 249 | £500 + VAT |
| 250 or more | £600 + VAT |

The certificate lasts 12 months. Cyber Essentials Plus adds an independent technical test, priced on quote. IASME offers a 75% discount to UK micro, small, and medium organizations that have not held Cyber Essentials in the last four years, subject to funding, for assessments bought by March 31, 2027.

UK-based organizations certified as a whole, with a turnover under £20 million, can opt into an included cyber insurance policy, capped at £25,000. It does not cover money stolen by fraud, which matters if your main fear is a fake invoice.

The NCSC also offers free help: a 30-minute consultation with an NCSC-assured Cyber Advisor, the Cyber Action Toolkit launched in October 2025, the Check your cyber security tool, and Exercise in a Box.

### Australia: from the Essential Eight to a small business handbook

The Essential Eight lists eight mitigation strategies: patching applications, patching operating systems, multifactor authentication, restricting administrative privileges, application control, restricting Microsoft Office macros, user application hardening, and regular backups. Its maturity model, last updated in November 2023, runs from level zero to three, and the ASD's educational pack recommends level one for small businesses. No certification is required.

On October 15, 2026, the ASD [evolved the Essential Eight](https://www.cyber.gov.au/publication/transitioning-from-the-essential-eight) into the ASD Essentials for enterprise IT, written mainly for government, critical infrastructure, and large organizations. For a small team, the reference is now the [small business cyber security handbook](https://www.cyber.gov.au/publication/small-business-cyber-security-handbook) of October 7, 2026, which starts with three measures: MFA, updates, and backups.

To report a cybercrime, a small business uses ReportCyber; the Australian Cyber Security Hotline, 1300 CYBER1 (1300 292 371), answers 24 hours a day.

### Canada: baseline controls and CyberSecure Canada

The Cyber Centre's [baseline cyber security controls](https://www.cyber.gc.ca/en/guidance/baseline-cyber-security-controls-small-and-medium-organizations), version 1.2 (page last modified in 2020), target organizations with fewer than 500 employees and follow an 80/20 rule: most of the benefit for a fraction of the effort. They contain 13 baseline controls and five organizational ones. On accounts, they ask for two-factor authentication wherever possible, and always for financial, administrator, cloud administration, privileged, and executive accounts; password changes only on suspicion of compromise; and administrator accounts used for administration only.

CyberSecure Canada certifies small and medium businesses against a national standard, through certification bodies accredited by the Standards Council of Canada; no price is published. Get Cyber Safe's guide for small businesses offers a simpler 10-step version.

### US: CISA, NIST, and the FTC

In the US, three free sources cover the ground:

- **CISA's Cyber Essentials** addresses leaders of small businesses in six elements, from “Yourself” to “Your Crisis Response.” Its page “[Secure Your Business](https://www.cisa.gov/audiences/small-and-medium-businesses/secure-your-business)” asks for phishing-resistant MFA where available and an incident plan drilled at least once a year.
- **NIST SP 1300**, the small business quick-start guide to the Cybersecurity Framework 2.0 (February 2024), organizes everything in six functions, from Govern to Recover.
- **The FTC's** small business pages cover the basics, email authentication, remote access, vendors, and cyber insurance.

### Turning the guides into a to-do list

The guides overlap more than they differ. Our [checklist for teams of two to 20](/guides/account-security/team-security/checklist/) merges them into 15 steps, with the agency behind each.

### The training part

Every guide above asks you to train your staff. See [the free courses and kits for a small team](/guides/account-security/team-security/security-training/), country by country.



---

**Prices:** checked on November 10, 2026 on the providers' official websites, in the currency and country shown. A lower monthly price often requires paying for a full year, and promotions change without notice. Amounts may have changed since then.