Do you need Microsoft 365 Business Premium for Cyber Essentials?

Last reviewed 2 November 2026 against the Cyber Essentials requirements v3.3 (Danzell question set).

The straight answer: what Business Standard can and cannot do

The NCSC and IASME care about whether the five technical controls are in place — not which software brand you buy to achieve them. If your business runs on Microsoft 365 Business Standard (or Business Basic), you already get:

• Exchange Online email, SharePoint, OneDrive and Teams.
• Security Defaults in Microsoft Entra ID, which turns on Multi-Factor Authentication (MFA) for all users and blocks legacy authentication protocols — covering the cloud MFA rule for Microsoft 365 itself.

What Business Standard lacks is any central way to manage, lock down or report on your staff laptops, Macs and phones: it does not include Microsoft Intune, Conditional Access (Entra ID P1), or Microsoft Defender for Business. On Business Standard, you must either configure every laptop and phone manually (and re-check them every fortnight) or buy third-party Remote Monitoring and Management (RMM), antivirus and Mobile Device Management (MDM) tools.

Comparison: Business Basic vs Business Standard vs Business Premium for Cyber Essentials

Note on mobile phones: Under NCSC Requirements v3.3, anti-malware software protects Windows and macOS computers, while phones and tablets can meet the malware protection control through application allow-listing (restricting installs to official app stores).

*Prices shown are Microsoft’s published UK commercial list prices per user per month on an annual commitment, excluding VAT, as of November 2026 (Microsoft UK).

Who can stay on Business Standard — and a worked example for a 10-person firm

• 1 to 4 staff in one room: If you have three Windows 11 laptops on one desk, no personal phones checking work email, and you are happy to check Windows Update, Defender Firewall and local accounts by hand on each machine, staying on Business Standard (£10.80/user/month + VAT) is completely reasonable.
• Worked example for a 10-person hybrid firm: Upgrading 10 users from Business Standard (£10.80) to Business Premium (£16.90) costs an extra £6.10 per user per month + VAT — £61/month + VAT (£732/year + VAT) across the whole firm. In return, you don’t need separate third-party Mac/Windows endpoint security, MDM for personal phones, or manual laptop checks, and under Danzell’s new director declaration you can prove compliance all year from one dashboard.