Cyber Essentials

Cyber Essentials is the UK government-backed certification scheme that shows you have five basic technical controls in place: firewalls, secure configuration, security update management, user access control and malware protection. No law requires it, but many public-sector, NHS and enterprise contracts do. The base level is a verified self-assessment; Cyber Essentials Plus adds an independent technical audit.

What it is and who it applies to

The National Cyber Security Centre (NCSC) owns the scheme and writes its requirements. IASME is the NCSC’s delivery partner: it sets the question set, licenses the certification bodies that mark and audit applicants, and issues the certificates.

The current edition is Cyber Essentials: Requirements for IT Infrastructure version 3.3, which the NCSC brought into effect on 27 April 2026. It applies to applications started on or after that date, which IASME assesses with its Danzell question set; applications started before that date may finish under version 3.2 and the Willow question set. Version 3.3 adds a definition of cloud services, says plainly that cloud services cannot be left out of scope, counts FIDO2 authenticators as passwordless sign-in, points software developers to the government’s Software Security Code of Practice, and stresses backups, which are still advice rather than a requirement.

Who asks for it:

• Central government and the NHS. Procurement Policy Note 014 (February 2025) asks for Cyber Essentials or Plus on contracts that handle citizens’ or staff personal data or run systems holding OFFICIAL information.
• Digital health buyers. NHS organisations assessing a digital health product use the Digital Technology Assessment Criteria, whose technical security section asks for a Cyber Essentials certificate.
• Customers and insurers. Larger customers use it as a supply-chain baseline, and cyber insurers often ask about it when they quote.

It covers any organisation of any size, from a sole trader to a large company. It sits well below ISO 27001 and SOC 2 in scope and effort: it tests five technical controls, not a management system.

This is guidance to help you understand the requirement, not legal advice.

Structure

The requirements document has no clause numbers. It sets out a scope, then five control themes, each with an aim and a list of requirements that apply to every in-scope device and cloud service. The table paraphrases each theme; the NCSC’s wording is not reproduced.

The five themes are also the citation format on these pages: “Cyber Essentials, security update management” means the requirements under that theme in version 3.3.

Certification and enforcement

There are two ways in. You can register with IASME and answer the self-assessment yourself, or hire a licensed certification body to help you prepare and answer it. Either way, the answers are an online questionnaire covering your scope and each of the five controls, and a board member or equivalent must sign them off before an assessor marks them. The assessor marks against the requirements; a pass gives you a certificate that IASME publishes in its list of certified organisations.

A Cyber Essentials certificate lasts 12 months. It is a statement about your controls on the day it was issued, not a promise about the year after, which is why buyers ask for the renewal each year.

Cyber Essentials Plus uses the same five controls and adds a technical audit by an assessor from a certification body. It must follow a passed self-assessment, within three months of that certificate and on the same scope. The assessor scans your internet-facing addresses, scans a sample of devices for missing fixes, sends test files by email and browser, checks multi-factor authentication on each cloud service, and checks that ordinary accounts cannot run administrative tasks.

The NCSC publishes the price: the certification fee starts at £320 plus VAT and rises with the size of the organisation. Plus is quoted by the certification body according to the number of devices and the complexity of the network. UK organisations with a turnover under £20 million that certify their whole organisation are entitled to cyber liability insurance arranged by IASME, with incident response support.

Nobody enforces Cyber Essentials. It is a condition of a contract or a tender: a buyer who asks for it can refuse a bid without a current certificate, and PPN 014 expects suppliers to renew it for the life of a government contract.

How the pieces fit

Scope comes first, because every requirement applies to everything inside it and nothing outside it. You then bring each of the five controls up to the requirement across that scope, answer the self-assessment, and have it signed off and marked. Plus adds the audit on the same scope. After 12 months the certificate expires and the loop starts again, with whatever has changed in your devices, cloud services and the requirements in the meantime.

Each renewal is a new self-assessment against whichever edition is current when you start it. The NCSC revised the requirements in both 2025 and 2026 (version 3.2 from 28 April 2025, version 3.3 from 27 April 2026), so an organisation that renews just after a change answers questions it has not seen before. Read the “what’s new” list before you start, not after you fail.

The weak point is usually the first box. A scope that leaves out a cloud service, a home worker’s laptop or a contractor’s admin account can pass the self-assessment and then fail the Plus audit, or fail a customer’s own check later.

If you already run an information security management system to ISO 27001, most of the five controls sit inside its technological controls and its access controls. Cyber Essentials is narrower and more prescriptive: a fixed 14-day update window, set password rules, and a fixed question set instead of your own risk assessment.

In this section

• The five Cyber Essentials technical controls: what does each control require, and which answers fail applicants most often?
• Cyber Essentials scope: what must be in scope, from cloud services to personal phones and home routers, and when is a sub-set allowed?
• Cyber Essentials self-assessment and Cyber Essentials Plus: how is the self-assessment marked, what does the Plus audit test, and when does a buyer want Plus?

How Sted maps it

Cyber Essentials is one of the standards, regulations and schemes in Sted’s catalogue. Sted treats it as required when the NHS Digital Technology Assessment Criteria apply to you, as committed when you hold or pursue it or a customer requires it, as strongly indicated when you sell to the UK public sector, and as recommended when its benefit assessment says so. Each recommendation comes with its reasons, and you select it or leave it. Administrators and Policy and Process Owners make that choice.

Selecting it and pressing Update and generate framework builds the documents it needs. For Cyber Essentials those are eight policies and 11 record templates mapped to the five controls, led by the Network Security, Configuration Management, Access Control, Malware Protection, Password and Authentication, and Threat Intelligence and Vulnerability Management policies. They come from Sted’s knowledge base and are drafted for your organisation for you to review.

Sted keeps a Statement of Applicability card for Cyber Essentials, listing its five controls. Treat it as a progress view, not as an ISO-style applicability decision. Cyber Essentials has no exclusions: every control applies to everything in scope, so a control you want to mark as excluded is a prompt to look again at your scope.

Frequently asked questions