Cyber Essentials is a government-backed certification scheme in the UK that establishes a baseline of cybersecurity practices and includes five key technical controls designed to protect organisations against common cyber threats.

If you run a business in the UK and handle any kind of digital data, Cyber Essentials should be on your radar. This government-backed cyber security scheme has become the standard baseline for protecting organisations against everyday online threats, and it is increasingly the price of entry for winning contracts and building trust with customers.

This guide breaks down everything you need to know: what the scheme covers, the five technical controls at its core, the two certification levels, costs, and how to get certified.

Key Takeaways

• Cyber Essentials is the UK government-backed scheme that certifies an organisation has five basic technical control themes and the controls they incorporate are in place against the most common cyber attacks. The NCSC calls it the minimum standard of cyber security for organisations of all sizes.
• It is owned by the National Cyber Security Centre (NCSC) and delivered by IASME, which licenses the certification bodies that assess organisations and issue certificates.
• There are two certification levels: Cyber Essentials, a verified self-assessment, and Cyber Essentials Plus, which adds independent technical testing to validate technical controls.
• Certificates last 12 months and come with free cyber insurance for eligible UK organisations. The current requirements are version 3.3, assessed through the Danzell question set since 27 April 2026.
• It is required for many UK government contracts and increasingly asked for by NHS, defence and private-sector buyers.

Cyber Essentials is the UK’s baseline cyber security certification. It confirms that an organisation has five cyber security measures (technical controls) in place that together defend against the most common cyber attacks from the internet: malware, phishing that leads to account takeover, and cyber criminals scanning for unpatched systems. Many UK buyers require Cyber Essentials from their suppliers, and it is often called Cyber Essentials accreditation.

This guide is for business owners, IT managers and anyone who has been asked for Cyber Essentials in a tender or a supplier cyber security questionnaire. It explains who runs the scheme, what the five controls are, the two certification levels, what Cyber Essentials certification costs, how long it takes and how to achieve it.

It matters because a Cyber Essentials certificate is now a routine condition of doing business with UK government, NHS and defence buyers, and because the controls it checks are the ones that stop most real attacks on small and medium organisations.

The UK government launched the scheme in June 2014, initially for small organisations that had never assessed their own security. It has since become the standard benchmark for UK organisations in the public sector, private companies and charities alike, and organisations outside the UK certify too.

Contents

• Who runs the scheme?
• What is Cyber Essentials certification?
• Accreditation or certification?
• Who needs Cyber Essentials?
• How the certification process works
• Common online threats it protects against
• The five Cyber Essentials controls
• Achieving Cyber Essentials certification
• What is Cyber Essentials Plus?
• How long it takes and lasts
• How much it costs
• Certification levels compared
• What you get with a Cyber Essentials certificate
• Free resources
• What it does not cover
• FAQs

Who runs the Cyber Essentials scheme?

The scheme is owned by the National Cyber Security Centre (NCSC) and has been delivered by IASME, as the NCSC’s sole Cyber Essentials delivery partner, since 1 April 2020. IASME licenses the certification bodies that assess organisations and issue certificates, and it maintains the public register of certified organisations. The requirements are included in a single NCSC document, Cyber Essentials: Requirements for IT Infrastructure, currently version 3.3.

What is Cyber Essentials certification?

Cyber Essentials (CE) certification is a verified self-assessment (VSE) . You answer IASME’s online self-assessment questionnaire about your IT infrastructure, a director or board member signs a declaration that the answers are true, and an IASME-licensed assessor marks it against the five key technical controls. This level is often called standard Cyber Essentials, or basic Cyber Essentials, to distinguish it from Cyber Essentials Plus.

Think of the controls as a checkpoint: if any one is missing, your organisation is exposed to the kind of attack the scheme exists to stop. Where an answer does not meet the requirement, the assessor tells you what needs to change before a certificate can be issued.

It is a good first step on the security maturity ladder because it gives every organisation, whatever its sector or size, one benchmark for basic cyber hygiene. The annual renewal is what stops complacency: the controls have to stay in place, not be set up once for the certificate.

By achieving Cyber Essentials certification, your business includes your ability:

• To demonstrate a commitment to cyber security to customers and to the supply chains you sit in.
• To get a clear picture of your organisation’s security maturity against five key technical control themes.
• To validate your controls against the most common cyber attacks.
• To satisfy business requirements for many public sector and government contracts, and many private organisations ask for it as an assurance factor.
• To win new business, because buyers use the public register of certified organisations to check suppliers.

Is it Cyber Essentials accreditation or certification?

You will see both words, and tenders and supplier questionnaires use them interchangeably. Strictly:

• Organisations are certified – When you pass, you receive a Standard Cyber Essentials or Cyber Essentials Plus certificate.
• Certification bodies are licensed – IASME licenses the certification bodies that assess organisations and issue Cyber Essentials certificates.

“Cyber Essentials accreditation” is the everyday term many buyers use for the same thing. If a tender asks whether you are “Cyber Essentials accredited”, it is asking whether you hold a current certificate, and your certificate and register entry are the evidence.

Who needs Cyber Essentials?

Cyber Essentials is not a legal requirement, but many buyers require Cyber Essentials before they will contract with you:

• Central government contracts that involve handling personal information or supplying certain ICT services, under Procurement Policy Note 014 (PPN 014 on gov.uk).
• NHS Supply Chain, which asks in-scope suppliers for Cyber Essentials Plus.
• The defence supply chain, where Cyber Essentials is the foundation of Defence Cyber Certification and the MOD has asked industry partners to reach DCC Level 0 by 31 December 2026.
• The education sector, where the College Financial Handbook expects colleges to hold Cyber Essentials and renew it every year.
• Private-sector buyers, increasingly through supplier security questionnaires.
• Insurers and brokers, some of whom ask about it when pricing cover. Certified organisations are 92% less likely to claim on cyber insurance. This means certified organisations may access better terms for cyber insurance.

It is also common in recruitment, legal services and manufacturing, where firms hold sensitive data or are part of larger supply chains. See our guide to who requires Cyber Essentials and why for each requirement and its source, and our DCC Level 0 guide for defence suppliers.

How does the Cyber Essentials certification process work?

The certification process runs in the same way for every organisation, whatever its size:

1. The NCSC sets the requirements in its Requirements for IT Infrastructure document.
2. IASME turns them into a question set for applicants. The current Self Assessment Questionnaire is called Danzell and has applied to new assessments since 27 April 2026. It replaced Willow; basic Willow assessments still in progress must be submitted by 26 October 2026. Our Danzell changes guide explains what changed.
3. You choose an IASME-licensed certification body and agree your scope with it: the whole organisation, or a clearly separated part of it. Once defined, you stick to this scope for Standard cyber essentials and same stands for Cyber Essentials Plus certification technical audit.
4. You answer the questions and a director or board member signs the declaration. The answers are your organisation’s responsibility; the assessor checks them, but does not write them.
5. An assessor marks your answers. Pass, and you are certified and listed on the public register for 12 months. For Cyber Essentials Plus, an independent assessment is conducted by a certification body where an IASME cyber Essentials assessor then tests a sample of your devices and every cloud service.

Why was Cyber Essentials created?

The government created Cyber Essentials to give organisations a clear, affordable cyber security standard that closes exactly those gaps, and to give buyers a simple way to check that suppliers have done so.

Most of the cyber attacks we see against UK organisations are not sophisticated. The argument that only big companies are targets does not hold up: cyber criminals look for insecure installations, misconfigured applications, exposed endpoints, open databases and any stepping stone to a higher level of access, whoever owns them.

When was Cyber Essentials created?

Cyber Essentials scheme started back in 2014 and has transformed over the past decade. It grew from a simple standard for government suppliers in 2014 and now spans over 200,000 certifications. Looking ahead to 2026 and beyond, the scheme continues to raise the bar – pushing businesses beyond simple compliance into genuine digital resilience.

Having delivered work across the south east asia, middle east, US, I can confirm that national bodies have shown interest worldwide in creating a Cyber Essentials equivalent standard for minimum baseline for themselves. However, it’s only the doers that get ahead. In our country, NCSC have been trendsetting this initiative, pushing this proactively ahead of others. Given the scheme has continuously adapted to combat newer threats, it has come a long way for last 12 years. It must be kept in mind that the driver here is to raise the bar for the entire SMB and public sector supply chain against the most common cyber attacks. This is one of the success measures to validate that Cyber Essentials certification scheme is working.

Harman Singh, IASME assessor and cyber security consultant, Cyphere

Talking about the impact of Cyber Essentials certification, an evaluation conducted as part of the 10-year review shows that 85% of certified organisations confirmed they have a better understanding of risks, increased awareness and are adopting a proactive approach towards cyber security. A short history of various milestones since NCSC launched Cyber Essentials is below:

• 2014: The launch – The Cyber Essentials scheme was officially launched.
• 2016: First major update – This revision aimed to address emerging threats and incorporate feedback from early adopters, ensuring the scheme remained relevant and effective.
• 2019: Over 50,000 total certifications – This shows growing popularity and increasing awareness of cyber security among UK businesses.
• 2020: A new delivery model – IASME is appointed as the NCSC’s Cyber Essentials Delivery Partner.
• 2022: 100,000th certificate issued – With over 30,000 certificates now being awarded annually.
• 2023: Need help to become certified – The Cyber Advisor scheme is launched, offering small organisations NCSC-assured advice and practical help to implement the Cyber Essentials controls.
• 2024: 10-year anniversary – The Cyber Essentials Knowledge Hub is launched. Nearly 190,000 certificates have been issued.
• 2025: Requirements update (v3.2 “Willow”) – The NCSC introduces updated technical requirements for IT infrastructure to better align with evolving cloud environments and remote working models.
• 2026: Strict enforcement & new standards (v3.3 “Danzell”) – The scheme transitions from flexible interpretation to strict compliance. Mandatory Multi-Factor Authentication (MFA) across all supported cloud services and strict 14-day patching rules become binary “pass/fail” criteria.

In between somewhere there, Cyphere became an IASME certification body in 2022.

Which common online threats does Cyber Essentials protect against?

The scheme targets the most common cyber attacks: the ones that need little skill, are run at scale, and hit organisations of every size. Each of the five controls maps to one or more of the most common cyber threats below.

• Phishing: Emails that trick staff into handing over sensitive information, passwords or opening a malicious attachment. Technical controls such as MFA, endpoint security controls such as email security and malware protection limit the damage when someone clicks.
• Malware and ransomware: Malicious software that runs on a device to encrypt or steal data delivered via email or browser. Malware protection controls at the browser and email level and secure configuration are the main defences on a system.
• Password attacks: Guessing weak passwords or reusing stolen ones against your accounts is an easy way for threat actors because of single-factor authentication in use. User access control, with MFA and the lockout rules under secure configuration, addresses this core issue.
• Exploiting unpatched software: Cyber criminals scan the internet for known vulnerabilities in out-of-date software, vulnerable software or misconfigured software. This allows them to exploit vulnerabilities to get an initial foothold in the organisation’s assets that may include desktops, laptops, servers, workstations or mobile devices. Security update management closes that window within 14 days for all critical and high-risk vulnerabilities where vendor patches are available.
• Exposed services: Remote access, admin panels, exposed services that should be internally facing or databases reachable from the Internet when they never needed to be. A well-configured firewall keeps them off the internet, blocking cyber threats and malicious traffic at the perimeter level.

Cyber Essentials does not address targeted attacks by a determined adversary, insider threats or weaknesses in software you have built yourself. That is by design; the section on its limits below explains what sits outside it.

What are the five Cyber Essentials controls?

The same five controls apply at both levels. The names below are the NCSC’s current names; older articles call them “boundary firewalls and internet gateways” and “patch management”.

1. Firewalls: a properly configured firewall at the boundary between your internal network and the internet, and and on every desktop, laptop and server, limiting the services accessible from the internet to those that are secure and necessary.
2. Secure configuration: unnecessary accounts and software removed, no default passwords, and devices that lock after repeated wrong guesses.
3. Security update management: supported software only, with high and critical updates applied within 14 days of release.
4. User access control: approved accounts, separate administrator accounts, and multi-factor authentication (MFA) on every cloud service.
5. Malware protection: anti-malware tools or application allow listing active on every in-scope device, so malicious software cannot run. Malware protection must be active on all devices in scope.

Under the Danzell Self Assessment Questionnaire, three areas carry stricter marking criteria and are automatic fails: unsupported software, a cloud service without MFA, and high or critical updates not applied within 14 days. Our guide to the five controls explains each one and what assessors look for.

Achieving Cyber Essentials certification: the step-by-step process

Whether you are going for a tender, meeting a procurement prerequisite or simply want a baseline, the route to achieving certification is the same. It also prompts your team to act on controls that might otherwise drift.

1. Agree your scope with a certification body: the whole organisation or, for complex organisations, a segregated part of it. Cloud services and end-user devices (desktops, laptops, thin clients, tablets and smartphones) cannot be left out, and personal devices that access work data or services are in scope, with narrow exceptions (see our BYOD rules). See Cyber Essentials scope.
2. Preview the questions using IASME’s free question set preview.
3. Check the three automatic-fail areas first, because any one of them fails the assessment outright.
4. Fix the gaps and gather evidence for each control.
5. Complete the self-assessment in the IASME portal and submit it with a director’s or board members’ signed declaration. Our self-assessment guide walks through it.
6. An assessor marks it. Anything non-compliant can be corrected and resubmitted within two working days.
7. Receive your Cyber Essentials certificate and register entry.
8. For Cyber Essentials Plus, complete the remote technical audit within 90 days.
9. Add a renewal preparation reminder well ahead of 12 months’ time.

Our Cyber Essentials checklist turns these steps into a readiness list you can work through.

What is Cyber Essentials Plus?

Cyber Essentials Plus is the higher of the two certification levels. You complete the same questionnaire, and Cyber Essentials Plus adds independent technical testing: an assessor from your certification body tests whether the controls actually work on a sample of your in-scope devices and on every cloud service you use.

The scope is the same as your basic certificate; what changes is the evidence. The self-assessment tells the assessor what you believe is in place, and the audit shows what is actually there. Our Cyber Essentials Plus requirements guide covers each test.

What the CE Plus audit tests?

The NCSC’s Cyber Essentials Plus Test Specification sets out five tests and how they are conducted:

1. An external vulnerability scan of your internet-facing IP addresses, which the test Specification calls the remote vulnerability assessment. This external vulnerability scan checks for any vulnerabilities that are rated critical or high or above a CVSS score of 7.0. Authorisation forms are required to be signed by the customer organisation to permit us to conduct the assessment over the Internet, complying with the Computer Misuse Act.
2. Internal vulnerability scan of sampled devices, run with credentials, checking that high and critical updates were applied within 14 days, run remotely.
3. Malware tests are conducted by email and by web browser on sampled devices during an online conference call.
4. MFA checks are also part of a user-interactive audit session on every cloud service, for a standard user and an administrator.
5. Account separation check, confirming that standard users cannot run administrative tasks. This is also part of a user interaction-based show-and-tell technical audit session.

The first two test cases mentioned above are conducted remotely. Cyphere delivers this as a remote audit: the user shares their screen, and the assessor watches each test run based on test cases 3,4 & 5 from the above list. On-site testing happens only where it is genuinely needed and agreed with you in advance. If findings need fixing, you have 30 days to fix and retest them, and the whole technical audit must be completed within 90 days of the basic certificate.

Suggested read: Cyber Essentials Plus checklist.

Free download: Cyber Essentials changes April 2026 (Willow to Danzell)

How long does it take, and how long does it last?

The question set for a standard Cyber Essentials application takes a few hours for a prepared organisation; the preparation around CE+ is the real work. A well-prepared organisation can achieve standard Cyber Essentials certification (VSE) in one to two weeks; where technical baselines need putting in place first, treat it as a project of 4-5 weeks to a couple of months. See how long Cyber Essentials takes.

After successful certification, both certificates last 12 months from the day the application is assessed and marked as a pass. Renewal is a fresh assessment against the Cyber Essentials requirements current at the time, so the controls have to stay in place all year. See our renewal guide.

How much does Cyber Essentials cost?

Cyber Essentials pricing has two parts. Standard Cyber Essentials costs £500 to £700 + VAT; IASME sets the fee and bands it by organisation size, so it is the same whichever certification body you use.

Cyber Essentials Plus pricing is set by each certification body; with Cyphere it starts from £1,299 + VAT for organisations under 50 staff, covering both levels, the readiness check and the audit, and is £999 + VAT alongside a Cyphere security engagement.

Our cost guide has the full fee tables and the costs outside the fee.

Certification levels: Cyber Essentials or Cyber Essentials Plus?

Buying an audit you are likely to fail is poor value; certify at the basic level, fix the gaps, and move to Plus when a customer asks for it, or you are ready. Our comparison of Cyber Essentials vs Cyber Essentials Plus goes into the choice in detail.

What do you get with a Cyber Essentials certificate?

After achieving Cyber Essentials certification, you receive:

• A Cyber Essentials certificate valid for 12 months, at the level you achieved, demonstrating compliance with Cyber Essentials requirements.
• An entry on IASME’s public register of certified organisations, which buyers use to check suppliers (see our certificate check guide).
• The right to display the successful certification badge (or cyber essentials certification logo) on your website and marketing materials.
• Free cyber insurance: Organisations domiciled in the UK or Crown Dependencies with annual turnover under £20 million that certify the whole organisation can opt in to £25,000 of cyber liability insurance at no extra cost, including a 24-hour incident response helpline (IASME). This cyber liability insurance covers events such as extortion threats, data breach, ransomware, business interruption and regulatory investigations.

Whether that adds up for your organisation is covered in the benefits post here: is Cyber Essentials worth it?

Free resources before you pay

• The question set preview: IASME publishes the full question set free.
• The readiness tool: IASME’s free online tool turns your answers into an action plan.
• The Cyber Essentials Knowledge Hub: IASME’s guidance on each control, operating systems and scope.
• Cyber Advisors: advisers working for NCSC Assured Service Provider organisations under the Cyber Advisor scheme, who give small organisations practical support to put the controls in place. You can work on your application with any licensed assured service provider or agree on a readiness plan internally and aim for certification.
• The NCSC’s requirements document is free to download.

Does Cyber Essentials protect against all cyber attacks?

No, and it does not claim to. It is built to stop common, opportunistic cyber attacks from the internet. It does not test your web applications, detect a targeted attacker, or cover backups, incident response or wider risk management. Cyber Essentials protects against approximately 80% of common cyber attacks.

For organisations that need governance and data protection evidence as well, IASME Cyber Assurance builds on the Cyber Essentials certificate; Cyphere certifies both of its levels. Our framework comparison sets out the options.

Cyber Essentials and UK GDPR

Cyber Essentials certification is not a GDPR requirement, and certification does not make an organisation GDPR compliant. It does evidence appropriate technical cyber security measures, which is part of what UK GDPR expects from any organisation handling personal data.

How Cyphere delivers Cyber Essentials certification

From the assessor’s desk

We are an IASME-licensed certification body with our own assessors, so the people who help you prepare understand exactly how submissions are marked. An engagement runs from a scoping conversation, through a readiness check against the three automatic-fail areas, to submission, marking and, where needed, the Cyber Essentials Plus assessment, delivered remotely. We publish our prices and answer questions throughout, because Cyber Essentials should be a straightforward baseline, not a mystery.

Harman Singh, IASME-licensed Cyber Essentials assessor, Cyphere

Talk to an IASME-licensed assessor

What is Cyber Essentials? FAQs

What is Cyber Essentials in plain English?

A UK government-backed certificate showing your organisation has five basic security controls in place: firewalls, secure configuration, security updates, user access control and malware protection. It is assessed by an IASME-licensed certification body and lasts 12 months.

Is Cyber Essentials mandatory?

No, not by law. It is required by many government contracts, asked for by NHS Supply Chain and defence buyers, and increasingly by private-sector customers. See which buyers require it and why.

Who certifies Cyber Essentials?

IASME-licensed certification bodies, on behalf of the NCSC. You can check a certification body’s licence in IASME’s directory. See our certification body guide.

Is Cyber Essentials the same as ISO 27001?

No. Cyber Essentials certification covers five technical controls; ISO 27001 is an international standard for a full information security management system. See Cyber Essentials vs ISO 27001.

Is “Cyber Security Essentials” the same thing?

Usually, yes. People often search for “Cyber Security Essentials” when they mean the government’s Cyber Essentials scheme. The official name is Cyber Essentials, and that is the name to use in tenders and on your website.

Can organisations outside the UK get Cyber Essentials?

Yes. Organisations outside the UK certify in the same way, and IASME publishes guidance for them. Its value depends on whether your customers are in the UK supply chain, because UK buyers are the ones who recognise it.

Explore the Cyber Essentials guides

Requirements and assessment

• Cyber Essentials requirements
• Cyber Essentials Plus requirements
• Cyber Essentials self-assessment
• Cyber Essentials scope
• BYOD requirements
• Supported operating systems
• April 2026 Danzell changes

Planning and cost

• Cyber Essentials cost
• How long does Cyber Essentials take?
• Cyber Essentials checklist
• Is Cyber Essentials worth it?

Comparisons and choices

Cyber Essentials vs Cyber Essentials Plus

Cyber Essentials vs ISO 27001

Cyber Essentials vs ISO 27001 vs SOC 2

Choosing a certification body

Sector and supply chain

Is Cyber Essentials mandatory?

Cyber Essentials for NHS suppliers

DCC Level 0 for defence suppliers

Checking a Cyber Essentials certificate

After certification

Cyber Essentials renewal

Why organisations fail Cyber Essentials