Is there good evidence that a small set of basic security controls prevents most harm? And how strong is that evidence, really? The second question turned out to be the interesting one.
The headline numbers are weaker than they sound. Government bodies and the scheme's delivery partner say certified organisations are 92% less likely to make an insurance claim, a figure that was 80% earlier, and no insurer, period, sample or method has been published for either. The official evaluation of Cyber Essentials didn't measure attacks at all: 8% of users asked had noticed fewer incidents and 35% had not. A UK government survey found businesses following Cyber Essentials reported more incidents, 70%, than businesses overall at 55%, though the report suggests they may simply notice more. A Canadian study allowing for size and sector found holding a certification didn't predict fewer incidents.
The better evidence is about controls rather than certificates. An Israeli study that allowed for firm size and sector found four basic precautions linked to a fall in the chance of an incident from 69% to 21%, though incidents were self-reported. Microsoft and Google report that MFA stops most account takeovers on their own services. One modelling study finds the Cyber Essentials controls would mitigate most sampled vulnerabilities, if applied almost perfectly. Organisations that once held Cyber Essentials were breached, but in every case I found the certificate had lapsed or didn't cover the breached systems, which is an illustration rather than a rate.
So the basics are probably worth doing, and I'd do them, but almost none of that rests on the numbers people quote at you. Reviews of the field say nobody has shown which controls work best, and the US list of exploited vulnerabilities doesn't even record how attackers got in. The gap between "these controls are sensible" and "these controls prevent 92% of claims" is where most of the marketing lives.