Cyber Essentials is the UK government-backed scheme that shows an organisation has the basic technical controls in place to stop the most common internet-based attacks. Many public sector contracts and a growing number of private ones ask for it. It is achievable for almost any organisation, but people still fail on the same handful of points.
What it covers
The scheme checks five technical controls:
- Firewalls: devices and networks protected by a correctly configured firewall.
- Secure configuration: default passwords changed, and unnecessary software and accounts removed.
- Security update management: only supported software, kept up to date.
- User access control: accounts only where they are needed, administrator rights kept to a minimum, and multi-factor authentication on cloud services.
- Malware protection: anti-malware or application allow-listing on every device in scope.
The current requirements
The current version is v3.3 of the NCSC's Requirements for IT Infrastructure, in effect from 27 April 2026. Points worth knowing in v3.3: cloud services cannot be excluded from scope, there is now a definition of what counts as a cloud service, passwordless authentication explicitly includes FIDO2, and backing up data gets more emphasis. Authentication to cloud services must always use multi-factor authentication.
Cyber Essentials or Cyber Essentials Plus
Both assess the same five controls. Cyber Essentials is a self-assessment questionnaire, checked by a certification body. Cyber Essentials Plus adds a technical audit of a representative sample of your user devices, your internet gateways and any servers reachable from the internet. Both certificates are valid for 12 months. IASME, which delivers the scheme, lists basic Cyber Essentials for an organisation with up to nine employees at £320 plus VAT.
Where people fail
- Unsupported software. Anything that no longer receives security updates, such as an old version of Windows, an old browser or a forgotten server, has to be removed or genuinely taken out of scope.
- Patching too slowly. Updates for vulnerabilities the vendor rates as critical or high risk, or with a CVSS v3 score of 7 or more, must be installed within 14 days of release. Turn on automatic updates wherever you can.
- Missing multi-factor authentication. Every cloud service your staff sign in to needs it, not just email.
- Administrator accounts used for everyday work. Administrators need a separate account that is used only for administration.
- A scope that does not match reality. Home-working laptops, cloud services and staff-owned phones that access company email are usually in scope.
How to prepare without a scramble
- List what you have: devices, servers, cloud services, and who uses them.
- Read the questions early. IASME publishes the question set, so you can draft honest answers before you buy the assessment.
- Fix the gaps first. It is usually unsupported software, multi-factor authentication and administrator accounts.
- Keep evidence of your settings, so your answers are easy to stand behind, and so Cyber Essentials Plus is straightforward if you need it later.
- Put the renewal date in the diary. The certificate expires after 12 months.
If you would like help getting ready, or a second pair of eyes on your answers before you submit them, get in touch.
Sources
- NCSC, Cyber Essentials overview: ncsc.gov.uk/cyberessentials/overview
- NCSC, Cyber Essentials resources and the v3.3 requirements: ncsc.gov.uk/cyberessentials/resources
- IASME, Cyber Essentials: iasme.co.uk/cyber-essentials
- IASME, Cyber Essentials FAQ: iasme.co.uk/cyber-essentials/frequently-asked-questions
