Cyber Essentials: The UK Scheme
We have sat in enough board meetings to know how Cyber Essentials is often framed: a box to tick, a certificate to file, and a topic to revisit once a year. That framing misses the point. This is a government-backed baseline that closes off the most common ways attackers get into UK organisations, and when we treat it as a practical security exercise rather than paperwork, it genuinely reduces risk. In this guide, our team walks through what the scheme actually requires, who needs it, what it costs, and how it connects to the wider shift towards stronger digital identity and passwordless authentication.
What Is Cyber Essentials and Why Does It Exist?
Cyber Essentials is a UK government-backed certification scheme launched in 2014 and developed by the National Cyber Security Centre (NCSC). It was created to give organisations of every size a clear, achievable set of protections against the most common cyber threats, rather than an open-ended security framework that only large enterprises could afford to implement. IASME is the accreditation body that delivers Cyber Essentials certification across the UK, working with a network of licensed certification bodies.
The scheme exists because the majority of successful attacks are not sophisticated. They exploit unpatched software, weak access controls, and misconfigured devices. Cyber Essentials targets exactly those weaknesses.
The Origins: From Government Mandate to Industry Standard
The scheme grew out of the UK government’s own security requirements for suppliers handling sensitive data. What began as a mandate for public sector contracts evolved into a recognised industry standard, adopted far beyond government supply chains. Today, thousands of UK organisations hold certification, and it is frequently referenced in procurement documents, insurance questionnaires, and supplier due diligence.
How It Fits Into the UK’s Wider Cybersecurity Strategy
Cyber Essentials sits alongside frameworks such as the NCSC’s Cyber Assessment Framework and guidance like the 10 Steps to Cyber Security. It is deliberately narrower: five technical controls, independently verifiable, achievable by a small team. We see it as the floor rather than the ceiling, the minimum hygiene layer on which a broader cybersecurity and digital identity strategy can be built.
The Two Levels: Cyber Essentials and Cyber Essentials Plus
There are two certification levels, and the difference matters when clients or insurers ask what you actually hold.
Cyber Essentials: Self-Assessment Basics
The standard Cyber Essentials certification is a self-assessment. You complete an online questionnaire covering the five technical controls, and a certification body reviews your answers. There is no technical testing of your systems at this level. It is affordable, fast, and suitable for organisations that want to demonstrate a baseline commitment.
Cyber Essentials Plus: What the Audit Involves
Cyber Essentials Plus requires independent verification by a certification body. This means technical audits, including vulnerability scans and on-site assessments of a sample of your devices and systems. An assessor will test whether the controls you claimed in your self-assessment are genuinely in place. It costs more and takes longer, but it carries significantly more weight with clients and insurers because an independent party has confirmed the result.
Which Level Does Your Organisation Need?
Our guidance is straightforward:
- Choose standard Cyber Essentials if you need a baseline, are bidding for contracts that specify it, or are early in your security journey.
- Choose Cyber Essentials Plus if a client, insurer, or framework explicitly requires verified certification, or if you handle sensitive data and want demonstrable assurance.
- Consider Plus if you are in a supply chain where larger partners are pushing security requirements down to suppliers.
The Five Technical Controls You Must Implement
The scheme covers five technical controls: firewalls, secure configuration, user access control, malware protection, and security update management. These align with NCSC guidance and are mandatory for certification. Fail any one of them and you will not pass.
Firewalls and Secure Configuration
Every device connected to the internet must be protected by a firewall, whether that is a boundary firewall at the network edge or a host-based firewall on the device itself. Secure configuration means removing default accounts and passwords, disabling unnecessary services, and changing manufacturer defaults before devices go into production. Both controls sound basic, and that is precisely why they work.
User Access Control and Malware Protection
User access control requires that accounts are created only for people who need them, with the minimum privileges necessary, and that administrative accounts are separate from everyday accounts. Malware protection means approved anti-malware software on all devices, kept up to date and configured to block known threats. In our experience, weak access control is the single most common gap we find during preparation.
Patch Management: Why It’s Non-Negotiable
Security update management requires that operating systems and software are patched within 14 days of a critical or high-risk update being released. This is non-negotiable because unpatched vulnerabilities remain one of the primary routes attackers use. If your patching is ad hoc, fix that before you attempt certification.
Who Needs Cyber Essentials? UK Requirements and Incentives
Cyber Essentials is not legally mandatory for all UK organisations. However, it is mandatory for UK government contracts involving certain sensitive data, and it is increasingly requested by insurers and supply chains. IASME and the NCSC actively promote it for SMEs as a proportionate first step.
Government Contracts and Supply Chain Demands
If you bid for central government contracts that involve handling sensitive or personal data, certification is typically a requirement. Beyond government, large prime contractors frequently require Cyber Essentials from their suppliers, meaning certification can be the difference between winning and losing work.
Insurance and Client Expectations
Cyber insurers increasingly ask about certification during underwriting. Some offer reduced premiums or clearer terms for certified organisations. Clients in regulated sectors now include it in standard supplier questionnaires. Holding certification shortens those conversations considerably.
SMEs and the Cost of Doing Nothing
For SMEs, the calculus is simple. Certification costs a few hundred pounds; a ransomware incident can cost tens of thousands, plus downtime and reputational damage. We have seen small firms lose weeks of trading to incidents that basic controls would have prevented.
The Certification Process: Steps, Costs, and Timelines
The process is more manageable than most people expect. Typical costs range from around £300 for the basic certification to over £1,500 for Plus, with timelines of a few weeks depending on how ready your environment is.
Choosing a Certification Body
Start by selecting a certification body licensed by IASME. Compare pricing, turnaround times, and the support they offer during preparation. Some provide templates and readiness checks; others simply assess. For first-time applicants, we recommend choosing a body that offers guidance.
Preparing for Assessment
Preparation follows a predictable sequence:
- Confirm scope, which devices, networks, and cloud services are in scope.
- Review your current state against the five controls.
- Remediate gaps, patching, access rights, firewall rules, and configuration.
- Complete the self-assessment questionnaire.
- For Plus, schedule the technical audit and prepare evidence for the assessor.
Renewal and Continuous Compliance
Certification is valid for 12 months and must be renewed annually. Renewal is not a formality: you must be able to show that controls have been maintained. We encourage clients to treat the certificate as a by-product of ongoing good practice rather than an annual scramble.
How Cyber Essentials Fits With Digital Identity and Passwordless
User access control is one of the five controls, and authentication sits at its heart. This is where Cyber Essentials connects directly to the broader digital identity conversation, including the move towards passwordless authentication.
Authentication as a Control, Not a Checkbox
Multi-factor authentication is not explicitly mandated by the scheme in every scenario, but strong authentication makes access control genuinely enforceable. Weak or shared passwords undermine every other control you implement. We treat authentication as a control in its own right, reviewed and tested rather than assumed.
The Passwordless Path to Compliance
Passwordless methods such as FIDO2 security keys and Windows Hello can support compliance while reducing cyber threats. They remove the phishing risk associated with passwords, simplify access reviews, and give you stronger evidence of control effectiveness during an audit. For organisations preparing for Cyber Essentials Plus, moving away from passwords is one of the most durable improvements available.
FAQ
Is Cyber Essentials mandatory in the UK?
Not for all organisations. It is mandatory for UK government contracts involving certain sensitive data, and it is frequently required by insurers, larger clients, and supply chain partners. For everyone else, it is voluntary but strongly recommended.
How long does certification take?
Standard Cyber Essentials can be completed in a few weeks if your controls are already in place. Cyber Essentials Plus takes longer because it includes vulnerability scans and on-site assessments. Timelines depend heavily on how much remediation is needed beforehand.
How much does Cyber Essentials cost?
Costs typically range from around £300 for the basic certification to over £1,500 for Cyber Essentials Plus, depending on your organisation’s size, scope, and chosen certification body. Remediation work may add to that figure.
Do I need Cyber Essentials Plus instead of the basic level?
If a client, insurer, or framework explicitly requires verified certification, you need Plus. Otherwise, the basic level is a reasonable starting point. Many organisations begin with standard certification and upgrade later.
Does Cyber Essentials cover cloud services and remote working?
Yes. The controls apply to the devices, accounts, and services you use, including cloud services and remote-working setups. Scope is defined during preparation, and cloud environments are assessed like any other part of your estate.
Cyber Essentials is a starting point, not a finish line. The five controls close the doors attackers use most often, but they are the foundation of a continuous cybersecurity and digital identity strategy, not a replacement for one. We encourage every UK organisation to treat certification as the beginning of an ongoing discipline: keep patching, keep reviewing access, strengthen authentication, and move towards passwordless where you can. That is how a tick-box exercise becomes genuine resilience.