Skip to content

Framework

Cyber Essentials, the UK baseline certification

Reviewed 6 October 2026

Cyber Essentials

Cyber Essentials is a UK government-backed certification scheme covering five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. Cyber Essentials is self-assessed and independently verified; Cyber Essentials Plus adds hands-on technical testing by an assessor. IASME delivers the scheme on behalf of the NCSC.

Definition

What is Cyber Essentials?

Cyber Essentials verifies five specific technical controls and nothing else. It says nothing about governance, risk management, supplier assurance, incident response or staff training. That narrowness is the point: the five controls block the overwhelming majority of untargeted internet attacks, and the scheme is designed to be achievable by a small organisation in weeks rather than months.

Certification comes in two levels. Cyber Essentials is a self-assessment questionnaire, verified by a certification body. Cyber Essentials Plus covers the same five controls but adds independent technical testing - the assessor samples devices, attempts to run malicious files, and checks patch levels directly rather than taking the answers on trust.

The scheme is updated annually. The April 2026 update introduced the Danzell question set and Requirements for IT Infrastructure v3.3, applying to all applications registered from 27 April 2026. It brought stricter marking on multi-factor authentication and on timely security updates, where a shortfall is now an automatic fail rather than a finding, and increased emphasis on passwordless authentication and passkeys.

Who Cyber Essentials applies to

  • Any organisation bidding for UK central government contracts involving sensitive information, where Cyber Essentials is mandatory.
  • Suppliers to MOD contracts, where Cyber Essentials is required through the Defence Cyber Protection Partnership.
  • Small and medium organisations wanting a credible, achievable first security credential.
  • Companies whose cyber insurance renewal now asks whether they hold it.
  • Larger organisations using it as a verifiable baseline requirement for their own supply chain.

The path

How long does Cyber Essentials actually take?

Realistic elapsed durations for an organisation starting without a dedicated compliance function. Elapsed time, not effort - the two are routinely confused when this gets scoped.

  1. 011-2 weeks

    Scope and readiness check

    Establish the scope, which must cover the whole organisation or a clearly defined, network-separated subset. The 2026 scoping change removed 'untrusted' and 'user-initiated' as qualifiers, so any specified device connected to the internet is in scope - including home workers' devices used for company data.

  2. 022-6 weeks

    Close the gaps

    In practice this is usually MFA coverage, unsupported operating systems, missing patches beyond the fourteen-day window, and default credentials. The fourteen-day patching requirement for critical and high severity updates is the control that most often needs a process change rather than a one-off fix.

  3. 031-2 weeks

    Cyber Essentials assessment

    Complete the question set through a certification body. Answers must be true for the whole scope on the day of submission. A single non-compliant answer on a marked question fails the assessment, and under the 2026 marking, MFA and update shortfalls fail automatically.

  4. 042-4 weeks after CE

    Cyber Essentials Plus, if required

    Must be completed within three months of the base certification. An assessor tests a sample of devices directly: patch levels, malware protection behaviour, account separation and MFA enforcement. This is where organisations that answered optimistically get found out.

Cost and internal effort figures are being confirmed with the practice before publication: cost and effort figures · Q15

Failure points

Where Cyber Essentials programmes usually go wrong

Not the theory. The specific things that cause a delayed audit, a major non-conformity, or a certificate that does not survive its first surveillance visit.

Incomplete MFA coverage

The most common cause of failure, and under the 2026 marking an automatic one. MFA is required on all cloud services and all administrative accounts. A single service where MFA is optional, or one break-glass admin account without it, fails the assessment.

The fourteen-day patching window

Critical and high severity updates must be applied within fourteen days of release, across everything in scope, including third-party applications and browser plugins. Organisations patch the operating system reliably and miss the application layer, which is exactly what Plus testing samples.

Unsupported software still in scope

Anything no longer receiving vendor security updates fails outright. An unsupported operating system on one machine, an end-of-life database, or an old mobile device nobody has decommissioned will each fail the whole assessment.

Home and personal devices misunderstood

Scoping changed in 2026 to remove the qualifiers that let organisations argue devices out of scope. If a device connects to the internet and touches organisational data, it is in scope, and bring-your-own-device arrangements need to be answered honestly rather than defined away.

Answering for the intended state

The questionnaire asks what is true today. Answers describing the position after a planned rollout are wrong on the day and become visible during Plus testing, where the assessor checks the devices rather than reading the answers.

Letting it lapse

Certification lasts twelve months. Contracts and insurance policies requiring it check the current certificate, and a lapse can put a bid or a renewal at risk. It needs an owner and a diary date, not a note in a project plan that closed.

Dates that apply

The deadlines attached to Cyber Essentials

  • In force · 5 months agoRequirements for IT Infrastructure v3.3 and the Danzell question set apply

Verified 6 October 2026Full regulatory horizon ->

How we run it

Cyber Essentials, delivered in sprints

  • 01Scope agreed against the 2026 rules honestly, including home working, rather than defined narrowly and challenged at assessment.
  • 02A pre-assessment against the current Danzell question set, so you find the automatic-fail items before the certification body does.
  • 03MFA and patching addressed as process changes with owners, because both recur every twelve months.
  • 04Asset discovery to surface the unsupported device or end-of-life service nobody has on the register.
  • 05Cyber Essentials Plus prepared for as technical testing rather than paperwork, since that is what it is.
  • 06A renewal cycle set up with a named owner, so the certificate does not lapse the month before a bid.

Choosing between them

Cyber Essentials or ISO 27001?

Cyber Essentials verifies five technical controls and can be achieved in weeks. ISO 27001 certifies an entire information security management system and takes months. They are not competing options at the same level: Cyber Essentials is a baseline that proves specific hygiene, and it is mandatory for many UK public sector contracts, which ISO 27001 does not substitute for. ISO 27001 is what an enterprise buyer asking about governance, risk assessment and supplier management wants, and Cyber Essentials will not satisfy that conversation. Many organisations hold both, and doing Cyber Essentials first is a sensible way to close obvious technical gaps while a longer ISO 27001 programme runs.

ISO 27001

FAQ

Cyber Essentials: questions people actually ask

What is the difference between Cyber Essentials and Cyber Essentials Plus?

Both cover the same five technical controls. Cyber Essentials is a self-assessment questionnaire verified by a certification body, relying on the organisation's own answers. Cyber Essentials Plus adds independent technical testing, where an assessor samples devices and checks patch levels, malware protection, account separation and MFA enforcement directly. Plus must be completed within three months of the base certification.

How long does Cyber Essentials take?

The assessment itself takes one to two weeks. The realistic total is four to eight weeks, because most organisations need to close gaps first - usually MFA coverage, patching cadence and unsupported software. An organisation already running current systems with MFA enforced everywhere can complete it in around two weeks. Cyber Essentials Plus adds a further two to four weeks.

What changed in Cyber Essentials in April 2026?

The Danzell question set and Requirements for IT Infrastructure v3.3 apply to all applications registered from 27 April 2026. The five core controls are unchanged. Marking became stricter on multi-factor authentication and on timely security updates, where a shortfall now fails the assessment outright rather than being recorded as a finding. The user access control section places greater emphasis on passwordless authentication and passkeys, and scoping was tightened so that any specified device connected to the internet is in scope.

Is Cyber Essentials mandatory?

It is mandatory for UK central government contracts that involve handling sensitive or personal information, and for many MOD contracts through the Defence Cyber Protection Partnership. It is not a legal requirement for private sector organisations generally, though it increasingly appears as a contractual condition in supply chains and as a question on cyber insurance applications.

How long does Cyber Essentials certification last?

Twelve months. Recertification requires completing the current question set again, which will normally have changed, since the scheme is updated annually. Contracts and insurance policies that require it check for a current certificate, so a lapse can jeopardise a bid or a renewal.

Related

ISO 27001ISO 42001SOC 2NIST AI RMFNIST 800-53PCI DSSGDPR

Start

Three ways in, depending on how close the deadline is.

Or just email a human: hello@cloudgap.ai

We reply within24 hours