iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Use the authority for the country where your business operates. A UK organisation should start with the National Cyber Security Centre (NCSC) small-organisations guidance and Cyber Action Toolkit, then consider Cyber Essentials or an NCSC-assured Cyber Advisor. A German organisation should begin with the Federal Office for Information Security (BSI) SME guidance and, where useful, a CyberRiskCheck based on DIN SPEC 27076; organisations needing a broader management system can move to Basic Protection based on IT-Grundschutz. These are different national pathways, not interchangeable certifications.
The short answer: choose by jurisdiction, then by need
NCSC material is written for organisations operating in the United Kingdom. BSI material is anchored in Germany’s legal, administrative and business environment. That context matters more than a simple feature comparison: a UK checklist does not automatically satisfy a German customer or regulator, and a German methodology does not by itself create a UK certification.
After choosing the relevant authority, identify the immediate job. A business may need everyday protective actions, a recognised baseline, help from a person, a structured information-security management approach, or instructions for an active incident. The most appropriate resource changes with that decision.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11| Business situation | UK starting point | German starting point |
|---|---|---|
| Basic actions for a small team | NCSC Small organisations guide and Cyber Action Toolkit | BSI SME “Getting started” pathway |
| External baseline or certification | Cyber Essentials | BSI guidance does not establish an equivalent certification in the material covered here |
| Hands-on implementation support | NCSC-assured Cyber Advisor | CyberRiskCheck delivered by an IT service provider |
| Broader security management | Use the NCSC resources as a practical foundation, then select a suitable management framework | Guide to Basic Protection based on IT-Grundschutz |
| Active or recent incident | NCSC Small Business Guide: Response & Recovery | BSI company incident pages, including first-aid and reporting information |
The table is a route map, not a claim that the items in one column are equivalent to those in the other.
#1 Best Overall
What the UK NCSC offers
Small organisations guide: the practical first step
The NCSC’s Small organisations guide to cyber security is designed for people who are responsible for a business but are not security specialists. The guide is organised around five jobs: securing email, securing important online accounts, protecting devices, backing up data, and spotting cyber attacks. Its instructions are intended to be actionable without requiring a technical expert.
The page was published on 9 April 2026 and reviewed on 21 July 2026. It reports that the UK has 5.5 million small organisations, that 50% of small businesses suffer a cyber incident every year, and that 85% of cyber attacks against businesses start with a scam email. Those figures are statistics reported by the NCSC guide, not independent estimates established in this article. They explain why the guide starts with accounts, email and recovery rather than advanced tooling.
The NCSC’s own message is that “Every member of the team should realise that cyber security is everyone’s business.” In practice, that means assigning ownership for actions such as multi-factor authentication, software updates, backup checks and reporting suspicious messages instead of treating security as a specialist’s private task.
The SME resource index: beyond a checklist
The NCSC’s broader Cyber security advice for small to medium-sized organisations index is useful when the five-topic guide is no longer enough. It brings together:
- the free Cyber Action Toolkit for sole traders and small businesses;
- response-and-recovery guidance for disruption;
- Exercise in a Box for practising response decisions;
- safe-use guidance for third-party services; and
- Cyber Essentials resources.
The index covers sole traders and organisations with up to 250 employees. It therefore works as a progression: start with short protective actions, practise how the organisation would react, and then decide whether an external baseline or advisory support is justified.
Cyber Essentials: a baseline certification route
Cyber Essentials is described by the NCSC as a government-backed certification scheme intended to help protect against common cyber attacks. It is valuable when a customer, procurement process or internal policy asks for a defined baseline and an assessment process. It should not be presented as a complete security programme: certification does not replace incident planning, staff awareness, supplier oversight, recovery testing or risk decisions outside the scheme’s scope.
The technical requirements are versioned. Version 3.3 became effective on 27 April 2026. Applications started before that date may continue under version 3.2, which had been effective since 28 April 2025. Check the current requirements page before beginning an application, because the applicable version depends on when the application was started and the scheme may change again.
Cyber Advisor: when the business needs a person
The NCSC Cyber Advisor scheme offers tailored advice and practical support, with an emphasis on implementing Cyber Essentials controls for small and medium-sized organisations. This is an assisted implementation route, not a substitute for deciding what the business must protect. Verify that a prospective provider is currently assured under the scheme, understand what the engagement includes, and check its experience with the organisation’s systems, suppliers and risk profile.
NCSC incident guidance
For preparation or recovery after disruption, the SME index points to the Small Business Guide: Response & Recovery. Use incident material separately from preventive checklists: the first question during an event is containment and safe recovery, not whether every long-term control has already been completed. Reporting, contractual notification and legal obligations must be established for the particular incident and sector rather than inferred from a general guide.
What the German BSI offers
SME hub: “Getting started” and “Advanced protection”
The BSI’s English-language SME hub serves two audiences. The “Getting started” route introduces basic elements step by step, includes short videos and points toward incident handling. “Advanced protection” is aimed at organisations that already understand IT terminology and current security practices, including those with internal IT teams or external service providers.
The landing page is available in English, but some linked business documents are German-language materials. Check the language of each document before assigning it to staff or a supplier. Availability, registration requirements and document versions can differ between linked resources.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →CyberRiskCheck: a consulting assessment for small and micro enterprises
The BSI describes CyberRiskCheck as consulting based on DIN SPEC 27076. IT service providers deliver the assessment, which is adapted to small and micro enterprises. It is therefore a structured consulting option rather than a consumer software purchase or a piece of network equipment.
The material does not establish a universal current price or subsidy. Ask the provider or consult current official programme information about eligibility, scope, deliverables, language and cost. Do not describe completion of a CyberRiskCheck as equivalent to Cyber Essentials or as a universally recognised certification; the evidence establishes a consulting pathway, not cross-recognition.
Basic Protection based on IT-Grundschutz
The BSI’s English Guide to Basic Protection based on IT-Grundschutz is an entry point for companies beginning information-security work. It describes safeguards that can be implemented with limited financial and personnel resources and covers technical, infrastructural, organisational and personnel topics within a holistic management approach.
Rank #3
This makes Basic Protection suitable for a company that wants an organised way to identify assets, responsibilities, threats and safeguards rather than a list of isolated technical fixes. A short guide does not, by itself, guarantee certification or complete protection. The organisation still has to establish scope, assign owners, implement measures and review whether they work.
Free tools Windows power users keep installed
One-click scans. No signup required.
Broader BSI business material
BSI business guidance frames information security as a strategic and management responsibility. Its business resources include basic cyber-security measures, vulnerability and update management, and IT-Grundschutz profiles. Some items, including material associated with the Alliance for Cyber Security, may require registration or be available only in German. Confirm the access conditions for the specific document your team intends to use.
The scale of the German SME audience is substantial: BSI Magazine reported that 99.4% of companies in Germany were SMEs, using Federal Statistical Office data from 2021. That is a 2021 measurement reported in a 2023 magazine article, not a current 2023 or 2026 count.
A foreword to the BSI Basic Protection guide by Arne Schönbohm, who was then President of the Federal Office for Information Security, states: “Not only the government can contribute to cyber security in Germany, but also every company – regardless of the size – must make a contribution.” The wording supports management ownership; it should not be used to imply that he holds that role today.
BSI incident material
The BSI company incident pages provide first-aid resources, incident-reporting information, an emergency card and a “Top 12” measures document aimed primarily at SME IT managers and administrators. These resources address response, reporting and prevention after an event. They are not a replacement for an organisation-specific incident plan or jurisdiction-specific legal advice.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Which resource fits the job?
| Question to answer | Choose the UK route when… | Choose the German route when… |
|---|---|---|
| Where do we start? | The organisation operates in the UK and needs non-technical actions for email, accounts, devices, backups and attack recognition. | The organisation operates in Germany and wants an SME pathway that separates introductory and advanced material. |
| Do we need a baseline that customers can recognise? | A UK-facing customer or procurement process asks for Cyber Essentials; confirm the applicable requirements version. | The organisation needs a German methodology or assessment; discuss CyberRiskCheck or IT-Grundschutz with an appropriate provider or adviser. |
| Do we lack in-house expertise? | Consider an NCSC-assured Cyber Advisor after defining the desired outcome. | Consider a CyberRiskCheck provider and verify its scope, language, qualifications and terms. |
| Are we ready for management-level security? | Use the practical NCSC controls as a foundation and select a management approach appropriate to the organisation. | Use Basic Protection based on IT-Grundschutz as an approachable structured method. |
| Has an incident happened? | Use NCSC response-and-recovery guidance and establish any reporting duties separately. | Use BSI incident first-aid and reporting resources and establish any reporting duties separately. |
Business size and maturity also affect the choice. A sole trader may need a short action list and help configuring accounts. A 200-person company with an internal IT team may need asset ownership, supplier controls, exercises and a repeatable management process. Neither authority’s entry-level material is a reason to skip those decisions.
A practical UK implementation path
- Confirm scope. List the legal entity, locations, employees, critical services, cloud services and outsourced IT that the business wants to protect.
- Work through the small-organisations guide. Assign an owner for email and account security, device protection, backups and attack reporting. Record completion dates and exceptions rather than assuming that a policy document equals implementation.
- Use the Cyber Action Toolkit and SME index. Add response-and-recovery preparation, third-party-service checks and an exercise appropriate to the team’s size.
- Decide whether a baseline is needed. If customers or procurement require Cyber Essentials, read the current requirements and determine whether the application falls under version 3.3 or a permitted earlier version.
- Get implementation help if necessary. Compare the organisation’s needs with the services of an NCSC-assured Cyber Advisor. Agree deliverables, access requirements, evidence and handover before work begins.
- Test recovery. Confirm that backups can be restored, accounts can be recovered and staff know how to escalate a suspected scam or compromise.
A practical German implementation path
- Choose the BSI SME pathway. Start with “Getting started” if staff need plain-language fundamentals; use “Advanced protection” when an IT team or service provider can work with technical terminology.
- Check language and access. The SME landing page is in English, but linked documents may be German or may require registration. Assign material that the responsible people can actually use.
- Complete the basic actions. Establish account, update, backup, device, supplier and incident responsibilities. Keep an evidence list so managers can see what is implemented and what remains open.
- Consider CyberRiskCheck. If the organisation needs an external assessment adapted to a small or micro enterprise, contact an IT service provider delivering the DIN SPEC 27076-based service. Confirm current eligibility, price, language and deliverables.
- Move to Basic Protection when the scope expands. Use the IT-Grundschutz-based guide to consider technical, infrastructural, organisational and personnel safeguards as one management system.
- Practise incident handling. Keep the BSI emergency and first-aid material accessible to the people who will make decisions during an outage or suspected compromise.
What multinational businesses should do
A company operating in both countries should not force one national resource to stand in for the other. Map systems and legal entities by country, then give each location the relevant authority’s guidance. A shared corporate control set can reduce duplication, but the evidence and terminology used to demonstrate that control may differ for a UK customer, a German customer or a local authority.
Keep separate records for jurisdiction-specific certifications, assessments, reporting contacts and language versions. Ask procurement and legal teams whether a customer requires a named scheme, a contractual control set or evidence of an assessment. “We use NCSC guidance” or “we follow IT-Grundschutz” is not, by itself, proof that a particular contract or statutory duty has been met.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Incident branch: what to do if you have an IT security incident
Preventive guidance cannot safely substitute for an incident process. When a suspected compromise, ransomware event, account takeover or serious data loss occurs:
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minute- Use the NCSC response-and-recovery material for a UK organisation, or the BSI company incident resources for a German organisation.
- Record what happened, when it was noticed, which systems and accounts are affected, and who is making decisions.
- Protect evidence and avoid destructive actions that could make investigation or recovery harder.
- Contain the affected accounts or systems in a way that does not destroy required evidence or business-critical data.
- Use known-good recovery procedures and verify backups before restoring broadly.
- Check contractual, regulatory, insurance and law-enforcement reporting duties independently; the general guidance does not determine those obligations for every business.
- After service is restored, document the cause, the control failure and the corrective action, then test the change.
Keep the response document, emergency contacts and recovery credentials available through a method that still works if the primary email or identity system is unavailable.
Common mistakes and how to avoid them
Treating the two authorities as interchangeable
NCSC and BSI resources serve different national contexts. Use the authority that matches the organisation’s operating jurisdiction, then check customer and regulatory requirements for any additional evidence.
Assuming a certification is a complete security programme
Cyber Essentials addresses a baseline for common attacks. It does not remove the need for recovery testing, incident decisions, supplier oversight, staff training or risk management outside its requirements.
Calling a consulting assessment a certification
CyberRiskCheck is described as consulting based on DIN SPEC 27076. Confirm exactly what the provider assesses and delivers; do not imply a universal certificate or cross-recognition that the BSI material does not establish.
Recommended Free Tools
Using an outdated version
Cyber Essentials requirements are versioned, with v3.3 effective from 27 April 2026 and transitional treatment for applications started under v3.2. BSI linked documents can also have their own publication and revision dates. Check the live official page or document before making a policy or procurement decision.
Best Value
Ignoring language and access barriers
An English landing page does not guarantee that every linked BSI document is in English. Check whether registration is required and whether the people implementing the control can understand the source material.
Buying technology before assigning responsibility
Both pathways begin with ownership and basic practices. A business that has not assigned account, backup, update and incident responsibilities will not fix the underlying risk simply by purchasing another security product.
Decision checklist
- Is the legal entity and primary operation in the UK, Germany or both?
- Does the business need basic actions, a certification baseline, consulting, management methodology or incident help?
- Who owns email, identities, devices, backups, suppliers and incident decisions?
- What customer, procurement, insurance or regulatory evidence is required?
- Which current version, language and access conditions apply to the chosen document?
- How will the business prove that a control works, especially restoration and account recovery?
- When will the organisation review changes in systems, staff, suppliers and official guidance?
FAQs
Can a German company use Cyber Essentials instead of BSI guidance?
It can read the material, but the sources do not establish that Cyber Essentials satisfies a German requirement or is recognised as equivalent to IT-Grundschutz or CyberRiskCheck. Check the exact customer, contractual or regulatory requirement in Germany.
Is IT-Grundschutz the German equivalent of Cyber Essentials?
No equivalence is established here. Cyber Essentials is a UK government-backed baseline certification scheme for common attacks. Basic Protection based on IT-Grundschutz is an entry point to a broader, holistic information-security management approach.
Does a CyberRiskCheck have a standard price?
The BSI material covered here does not establish a universal current price or subsidy. Ask the delivering IT service provider or consult current official programme information.
Which resource is best for a sole trader?
A UK sole trader can begin with the NCSC Cyber Action Toolkit and small-organisations guide. A German sole trader should start with the BSI SME “Getting started” route. The right next step depends on the systems, customers and support available.
Where should a business look during an active incident?
Use the NCSC Small Business Guide: Response & Recovery in the UK, or the BSI company incident pages in Germany. Establish reporting and legal duties separately for the incident and sector.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
