Is Cyber Essentials actually worth it for a small business?

Honestly, it depends on why you'd be doing it. If a client, tender, or insurer is asking for it directly, the answer is straightforward: yes, because without it you can't win the contract or meet the policy condition, and the cost of certification is small next to what you'd lose by not having it. That's the case for a large share of businesses that get certified.

If nothing external is asking for it, the calculation is less clear-cut. The controls themselves (MFA everywhere it should be, timely patching, sensible access control, malware protection, and a properly configured firewall) are worth doing regardless, because they're the basics that stop the most common attacks. But the formal certification on top of that is a real cost in time and, usually, money, and if you've got no contractual or insurance driver and genuinely low exposure (a tiny team, no sensitive client data, nothing customer-facing), it's reasonable to fix the gaps yourself and skip the certificate for now.

If you've got no contractual or insurance driver and genuinely low exposure, it's reasonable to fix the gaps yourself and skip the certificate for now.

What tips the balance for most businesses in between: a first assessment forces you to actually look at things that get put off indefinitely otherwise (who still has admin rights they don't need, which laptop is three OS versions behind, whether MFA is actually switched on for the free tools your team uses day to day). Even businesses that don't strictly need the certificate often find the process worth it just for that.

The fastest way to work out which camp you're in is to see what would actually fail today. Run the free 5-minute readiness check and you'll have a specific answer instead of a guess.