What is Cyber Essentials? The plain-English guide

Cyber Essentials at a glance

Cyber Essentials in one paragraph

Cyber Essentials is a certification scheme run by IASME on behalf of the National Cyber Security Centre (NCSC), the UK government’s cyber-security authority. To get it, you answer a self-assessment questionnaire about five areas of basic security — firewalls, secure configuration, user access, malware protection and security updates — and a licensed assessor reviews your answers. Pass, and you receive a certificate that lasts twelve months. It does not require an audit, a site visit or any software to be installed: it is a description of how your business is set up, checked against a fixed set of requirements.

Who runs it, and who actually certifies you

The requirements are written by the NCSC. The scheme is delivered by IASME, which licenses a network of certification bodies — the companies you actually buy the assessment from and whose assessors review your answers. Only those IASME-licensed bodies can award the certificate. Everyone else in the picture — consultants, IT support companies, and preparation software like ReadyCert — helps you get ready; none of them can certify you.

That distinction matters when you read marketing. “Guaranteed pass” is not something anyone outside the certification body can honestly offer, and the assessment fee is paid to the certification body whoever helps you prepare.

Why a small business gets asked for it

Most businesses first hear of Cyber Essentials because someone they want to work with has made it a condition. Central government has a procurement policy that requires it for contracts involving certain kinds of personal or sensitive data, and many public bodies, councils, NHS organisations and universities ask for it as a matter of course. Larger private companies increasingly ask their suppliers to hold it, and some cyber-insurers treat it as a baseline. So the trigger is usually commercial: a tender, a supplier questionnaire, or a client’s procurement team.

There is a real upside beyond the one contract. The five controls are the measures that stop the most common, least sophisticated attacks — the ones that actually hit small businesses — and going through the questionnaire once tends to fix a handful of things that were quietly risky. Holding the certificate also answers the next client’s question before they ask it; there is a public register where anyone can check.

The two levels: Cyber Essentials and Cyber Essentials Plus

• Cyber Essentials (often called “Basic”) is the self-assessment. You answer the questionnaire in writing — you don’t normally upload evidence, though your certification body can ask for it — and a licensed assessor reviews the answers. The fee is set by IASME according to the size of your organisation and is typically a few hundred pounds plus VAT. This is the level most small businesses are asked for.
• Cyber Essentials Plus is the same five controls, verified. You must hold the basic certificate first; then an assessor tests a sample of your actual devices to confirm the controls really are in place. It costs more and is quoted individually, because it depends on how many devices you have — our rough market estimate, not an IASME figure, is from around £1,350 upwards — and is usually only required for higher-risk work.

If the request just says “Cyber Essentials”, it means the basic level. If it says “Plus”, budget for both. The cost calculator shows the fee for your size of business and what Plus adds.

The five controls, in plain English

Everything in the questionnaire hangs off five technical controls. The official names are below, with what each one means for a business of five to fifty people — and the requirements guide goes through every rule with its official question number.

1. Firewalls

Something must sit between your devices and the internet and block unexpected incoming connections. For most small businesses that is the router your internet provider supplied, plus the software firewall built into Windows and macOS (on by default in Windows, off by default on a Mac, so check). The questions are practical: is the router’s admin password still the one on the sticker (it must be changed), have its rules been looked at in the last year, and can it be managed over the internet (if so, that access needs protecting or switching off). The firewall requirements guide answers each of those questions for a typical office router.

2. Secure configuration

Devices and services should only do what you need them to. That means removing software and accounts you don’t use, changing every default password, stopping USB sticks from running things automatically, and making sure every laptop, phone and tablet locks and needs a fingerprint, face, password or PIN to open. None of it is difficult; it is mostly settings that were never looked at.

3. User access control

Who can log in, with what, and whether the extra step on the phone is switched on. Everyone has their own login; administrator accounts are separate from everyday ones and never used for email or browsing; leavers have their access removed promptly; and multi-factor authentication (MFA) is switched on for every user and every admin of every cloud service that offers it. This last point is the one that most often catches businesses out — see the MFA guide.

4. Malware protection

Each device needs at least one of: anti-malware software that updates itself and blocks known-bad websites, or a rule that only approved apps can be installed (on phones and tablets, the official app store plus a list of apps your business approves). Windows Defender, which is built in and free, counts — the malware protection guide covers Macs and phones.

5. Security update management

Every operating system and every application must still be supported by its maker, and high-risk and critical security updates — and any the vendor doesn’t rate — must be installed within 14 days of release. Automatic updates are the practical way to meet this; updating “when we remember” or once a month can miss the window. An unsupported operating system anywhere in scope — a laptop still on a retired version of Windows, for example — fails the assessment on its own.

Scope: what is actually being certified

Before the five controls, the questionnaire asks what is in scope. For a small business the honest and simplest answer is the whole organisation: every laptop, desktop, phone and tablet that touches work data, every router and firewall, any servers, and every cloud service you sign into. Three rules from the 2026 requirements catch people out:

• Cloud services cannot be excluded if they store or process business data. Your email, accounting, file storage and CRM are all in — and so are business social-media accounts, which count as cloud services and need MFA. See Cyber Essentials and cloud services.
• A personal phone is in scope if it is used to read work email or open work files. It is only out of scope if it is used solely for the phone’s built-in calls and texts, or two-factor codes. The BYOD rules and the mobile device requirements say what an in-scope phone must do.
• Home workers: a router your business supplied is in scope; a home worker’s own broadband router is not, and you rely on the laptop’s software firewall instead — see Cyber Essentials and home workers.

A scope with no end-user devices at all is not valid. Read the scope guide for worked examples.

What changed in 2026

Cyber Essentials is updated roughly once a year, and each question set has a name. The current IASME question set is “Danzell”, aligned to version 3.3 of the NCSC requirements; it came into force on 27 April 2026 and replaced “Willow”. What v3.3 actually changed is mostly definitions and scope wording: a definition of cloud services and a definitive statement that they cannot be excluded from scope, an updated passwordless definition that includes FIDO2, and more emphasis on backups (still not required). The rules that most often catch renewals out are not new: MFA on every cloud account (automatic fails at A7.15 to A7.17), the 14-day rule for high-risk updates (A6.4 and A6.5), and unsupported operating systems (A6.1). The 2026 changes guide goes through each one.

What Cyber Essentials does not ask for

It is worth knowing what is not required, because a lot of advice online adds things. Backups are recommended but are not a technical requirement of the scheme. There is no requirement for security-awareness training, penetration testing, a written risk register, or an ISO-style management system. Passwords do not need symbols and numbers, and do not need to be changed on a schedule — the requirements actually advise against both, as the password policy guide explains. Cyber Essentials is deliberately a baseline: five controls, done properly.

How much it costs

There are three costs. The assessment fee, set by IASME by organisation size and paid to your certification body — a few hundred pounds plus VAT for a small business, and the only unavoidable cost. Your time: working out scope, switching on MFA everywhere, checking every device, and writing a handful of short policies. And any help you buy, from nothing at all to several consultant days. The technical controls themselves are mostly settings in software you already pay for; the expensive case is a device too old to run a supported operating system. The cost guide puts real numbers on all three, and the cost calculator works them out for your situation.

How long it takes, and how long it lasts

The questionnaire itself can be answered in an afternoon once you know your answers. The time goes into finding them: listing devices and cloud services, confirming MFA is on for every account, and fixing whatever that turns up. A tidy business of ten people with modern laptops and Microsoft 365 or Google Workspace can be ready in a few hours spread over a week or two; one with old hardware or shared logins takes longer, because the fixes are real. The certificate is valid for twelve months, after which you reassess against whatever the current question set is.

How to get certified, in four steps

1. Find out where you stand. Go through the five controls and scope rules honestly and write down every gap. The interactive checklist is the free, manual way to do this; the readiness check asks the questions for you and flags the automatic fails first.
2. Fix the gaps, automatic fails first. Switch on MFA for every user of every cloud service, turn on automatic updates, deal with any unsupported device, change the router’s admin password. Most of it is ten minutes per tool.
3. Write the short policies. A scope statement, an asset list, and a page each on passwords, joiners and leavers, updates and malware. For a small business these are short by design.
4. Buy the assessment and submit your answers. Choose an IASME-licensed certification body, pay the fee for your organisation size, and transfer your answers into their portal. The assessor reviews them and either certifies you or tells you what to fix.

The hardest step is almost always the first: knowing, in plain terms, whether you would pass before you pay.