What Cyber Essentials actually is
Cyber Essentials is a UK Government-backed certification scheme developed by the National Cyber Security Centre (NCSC) and administered by the IASME Consortium. Launched in 2014, it sets out five fundamental technical controls that, when properly implemented, protect against the vast majority of common internet-based attacks.
It is not an audit of your entire security posture. It is a verified baseline — a way of demonstrating that the most exploited, most preventable vulnerabilities in your business have been addressed. Think of it as the MOT of cybersecurity: it does not guarantee nothing will ever go wrong, but it confirms that the fundamentals are in order.
Sources: GCA / NCSC; AMVIA citing DSIT Cyber Security Breaches Survey 2025
The five controls — in plain English
Cyber Essentials requires five technical controls to be in place and verifiably active. These are not complex enterprise measures — they are the fundamentals that most attacks exploit when they are absent.
Firewalls
A boundary firewall must be in place between your internet connection and your devices. This includes routers, and any software firewall on devices that connect to the internet directly. Default configurations that expose unnecessary services are a fail.
Secure configuration
Devices and software must be configured securely from the outset — default passwords changed, unnecessary software removed, and only the services you actually need left running. Factory settings on routers are one of the most common failure points.
Access control
User accounts should only have the access they genuinely need. Admin rights restricted to those who require them. Under v3.3, Multi-Factor Authentication (MFA) is mandatory on all cloud services — no exceptions and no workarounds.
Malware protection
Protection against malicious software must be in place on all in-scope devices. This can be achieved through application allowlisting, sandboxing, or signature-based malware scanning — the approach must be appropriate for the device type.
Patch management
Software and operating systems must be kept up to date. Under the current standard, critical and high-severity patches must be applied within 14 days of release. Any software that is no longer supported by its vendor — including Windows 10 after October 2025 — must be removed from scope or updated. This is one of the most commonly failed controls.
Cyber Essentials vs Cyber Essentials Plus
There are two levels of certification. Which one you need depends on what you are trying to achieve and who is asking for it.
Cyber Essentials
A verified self-assessment. You answer a questionnaire about your controls, which is reviewed and verified by a certification body. No independent technical testing.
- Right for most SMEs as a starting point
- Satisfies most public sector supply chain requirements
- Includes £25,000 free cyber liability insurance (under £20m turnover)
- Typically completed in 2–4 weeks
- Renewed annually
Cyber Essentials Plus
Everything in CE, plus an independent technical audit of your systems by an assessor — verifying that the controls are genuinely in place, not just described.
- Required for Ministry of Defence supply chain contracts
- Required for NHS suppliers handling NHS data or IT services
- Increasingly specified by large private sector clients
- Carries significantly more weight in tenders and procurement
- Prerequisite for CE must be completed first
Source: IASME Consortium — Cyber Essentials; AMVIA citing NCSC 2025 data
Who needs it — and why the answer is changing
Until recently, Cyber Essentials was largely seen as relevant to businesses bidding for government contracts. That picture has shifted considerably in the past 12 months.
Government suppliers
Mandatory for all public sector contracts involving personal data or IT services under Procurement Policy Note 014. Since April 2025, required for all public sector contracts over £5 million.
NHS and healthcare suppliers
NHS Supply Chain requires Cyber Essentials Plus from suppliers handling NHS data or providing digital services. This requirement cascades to subcontractors.
Defence sector suppliers
The Defence Cyber Certification scheme, which came into force in December 2025, requires CE as the baseline across all four certification levels in the supply chain.
Private sector supply chains
Large organisations are now being asked by government to audit CE coverage across their supplier base. If you supply a large business, expect to be asked for your certificate — if you haven't been already.
Insurance applicants
Cyber insurers increasingly use CE as a benchmark. Certified businesses receive better premium rates, fewer exclusions, and stronger cover. Some ransomware-specific policies now require CE as a condition.
Any business wanting a baseline
Even without a contractual requirement, the five controls address the vulnerabilities that account for the majority of successful attacks against UK SMEs. CE is the fastest credible way to implement and evidence them.
The supply chain pressure is accelerating. The UK Government's Cyber Resilience Pledge, launched in April 2026, commits large organisations to auditing CE coverage across their supplier bases and reporting findings at board level. As the NCSC put it directly: "basic cyber hygiene is no longer optional, but the baseline, the absolute minimum we should expect of any serious organisation operating in the modern economy." If you are in any supply chain, the question is not whether you will be asked — it is when.
Source: CyberSmart — Cyber Essentials Supply Chain Pledge, April 2026
What does certification cost?
Certification fees are set by IASME and vary by organisation size. As a guide for UK SMEs:
- Micro-organisations (up to 9 staff) — from around £300 for the self-assessment
- Small businesses (10–49 staff) — typically £400–£500
- Medium businesses (50–249 staff) — typically £500–£800
- Cyber Essentials Plus — adds the cost of an independent technical audit on top, typically £1,000–£3,000 depending on complexity
Certification is renewed annually. Many businesses also work with a consultant or Cyber Advisor to prepare — particularly for a first attempt, where a gap analysis avoids the cost and delay of a failed submission.
The free insurance benefit. UK organisations with an annual turnover under £20 million that achieve Cyber Essentials certification for their whole organisation automatically receive £25,000 of cyber liability insurance at no extra cost — including access to a 24-hour incident response helpline covering technical, legal, and crisis management support. For many SMEs, this alone offsets a significant portion of the certification cost.
Source: AIS Tech — Cyber Essentials Certification: The Complete 2026 Guide
Common reasons businesses fail first time
A failed submission delays certification by weeks and incurs re-assessment costs. These are the most common causes:
- Unsupported software still in use — running Windows 10 after its October 2025 end-of-support date, or using applications that no longer receive security patches, is an automatic fail.
- Default passwords not changed on routers, firewalls, or network equipment.
- MFA not fully implemented — partial rollout, where some cloud accounts have it and others don't, does not satisfy the requirement.
- Admin accounts used for daily work — staff browsing the web and reading email with administrator privileges is a control failure.
- Incorrect scoping — attempting to exclude devices or services without proper justification is a red flag for assessors.
- Answering questions about intended controls rather than current ones — the assessment covers what is in place now, not what you plan to implement.
A pre-assessment gap analysis — working through each control against your actual current setup — prevents almost all of these. It also gives you a clear remediation list before any money is spent on the formal assessment.
Ready to get certified — or not sure where you stand?
GET-IT supports UK SMEs through the full Cyber Essentials process — from initial gap analysis and remediation through to submission and certification, with a first-time pass guarantee.
Not sure whether you need CE or CE Plus, or whether you are ready to submit? A free 30-minute readiness call costs nothing and answers both questions clearly.
Book a Free Readiness Call Send Us a Message[ Remote. First-time pass guarantee. No jargon. ]