Cyber Essentials certification is the UK Government-recommended minimum standard for cyber security. It checks that your organisation has five basic technical controls in place, and it is awarded after an assessment of your systems. For most small businesses, the work is less about buying new tools and more about proving that devices, accounts, updates and network settings are properly managed. This guide covers the requirements, a practical checklist, the two certification levels, cost, renewal and the issues that most often hold applicants back.
What Cyber Essentials certification covers
The scheme was developed by the National Cyber Security Centre (NCSC) and is aligned to five controls designed to stop the most common internet-based threats. It targets low-skill attacks that use widely available tools, not sophisticated, targeted campaigns. The government’s own evaluation is clear that it does not address advanced, targeted threats and should be treated as a foundation for wider risk management.
That foundation has commercial value. Current certificates can support bids for government contracts involving financial or personal data, and the same page reports that organisations with the controls in place see 92% fewer cyber-related insurance claims. Many customers and suppliers now ask for the certificate as evidence in their own due diligence.
The five Cyber Essentials requirements
The requirements for IT infrastructure (version 3.3, April 2026) group the technical controls into five themes:
- Firewalls. Boundary firewalls or equivalent settings protect every device that connects to the internet.
- Secure configuration. Devices and software are set up securely, with unnecessary accounts, software and default settings removed.
- Security update management. Operating systems and applications are supported and kept patched.
- User access control. Accounts are issued only to people who need them, with appropriate privileges, and admin rights are tightly limited.
- Malware protection. Every in-scope device is protected against malicious software.
Version 3.3 also brings in a Software Security Code of Practice and updated definitions for passwordless authentication, including FIDO2. If your last assessment was some time ago, check the current question set rather than relying on what you answered before.
User access control is where small firms often have the most to tidy up. Our SME password policy guide aligns NCSC, Cyber Essentials and ICO expectations in a form you can adopt.
A readiness checklist before you apply
A sensible Cyber Essentials certification checklist starts with scope, then works through the five themes. Use this order:
- Set the scope boundary. Decide which people, devices, locations and networks are in scope. Whole-organisation certification is the usual aim, and the government notes that UK organisations under £20m turnover certifying the whole organisation are entitled to cyber liability insurance.
- List every device. Laptops, desktops, servers, phones, tablets and anything else that touches company data, including personally owned devices used for work.
- Include all cloud services. The requirements state that cloud services cannot be excluded from scope. If your team lives in Microsoft 365, our Microsoft 365 security guide shows what to configure.
- Review your network. Check router and firewall settings, and any wireless networks. If you run a guest network, these guest Wi-Fi security safeguards are a good place to start.
- Confirm patching. Remove unsupported software and make sure updates are applied within the timescales the requirements set.
- Review accounts. Remove leavers, separate admin accounts from everyday ones and enable multi-factor authentication where the service supports it.
- Confirm malware protection on every in-scope device, with a record of how it is managed.
The work is easier when you have a current asset list and a recent risk review. Our guide to finishing an IT risk assessment in eight steps will help you build both.
How to get Cyber Essentials certified
There are two routes. You can register for the self-led route through IASME, or you can hire a licensed Certification Body to support you. The self-led steps are:
- Register.
- Pay.
- Complete the verified self-assessment.
- Obtain sign-off from a board member or equivalent senior person.
- Have an assessor mark your answers.
The board sign-off matters. It makes a named senior person accountable for the accuracy of the answers, so the person who completes the questionnaire should work with whoever looks after your IT.
Cyber Essentials versus Cyber Essentials Plus
Both levels rest on the same five controls. The difference is how they are verified. Basic certification combines self-assessment with independent review of your answers. Cyber Essentials Plus uses the same protections with more rigorous independent technical testing.
| Cyber Essentials | Cyber Essentials Plus | |
|---|---|---|
| Verification | Self-assessment, marked by an assessor | Hands-on technical audit |
| Pass bar | Limited non-compliance allowed | All issues remediated before the pass |
| Price basis | By organisation size, from £320 + VAT | Size and complexity of the network |
| Timing | Starting point | Audit within three months of achieving basic certification |
Plus audits typically include external vulnerability scanning of your public IP addresses and testing of a representative sample of devices, covering every operating system in use. Choose Plus when a customer or contract asks for it, or when you want independent proof that the controls work in practice.
If you are weighing the scheme against a broader management standard, our comparison of Cyber Essentials and ISO 27001 for UK SMEs sets out when each fits.
What Cyber Essentials certification costs and how long it lasts
The NCSC states that basic certification is priced by organisation size, starting at £320 + VAT. Cyber Essentials Plus is priced according to the size and complexity of your network, so you need a quote based on your device estate.
The fee is only part of the budget. Allow for the time your team spends gathering information, and for any remedial work such as replacing unsupported devices or tightening accounts. A business that has already been managing patching and access carefully will spend far less on remediation than one starting from scratch.
Certification is renewable annually and must be renewed each year to stay current. Treat it as a yearly checkpoint on controls you run all year, not a one-off project.
Common reasons applicants fall short
- Unsupported software or operating systems left on in-scope devices.
- Patching gaps on laptops that rarely connect to the office network.
- Shared or over-privileged admin accounts.
- Scope drawn too narrowly, then undermined by cloud services or personal devices that were left out.
- No consistent malware protection across every device.
For Plus, all audit elements must be passed. High or critical vulnerabilities must be fixed and the affected system rescanned, and non-conformities under the current question set must be remediated before the audit moves on. The government also notes that weakness against basic attacks can mark an organisation out for closer attention from criminals, which is a good reason to fix these items whether or not you certify.
Getting your IT ready with Abersecure
Most of the five controls are things an IT function does every day: patching, device configuration, access management and malware protection. Abersecure provides managed cyber security and endpoint management for businesses in Aberdeen and Aberdeenshire, with Security by Default built into our support. If you would like a clear view of where your systems stand before you apply, our Cyber Risk Assessment is one place to begin. See our packages or get in touch to discuss what suits your business.
Your next step towards certification
Start by defining scope, listing devices and checking each of the five controls against the checklist above. Fix the gaps, choose your route, and decide whether Cyber Essentials certification alone is enough or whether Plus is expected by your customers. Then keep the controls running, so renewal is routine.
FAQ
How long does Cyber Essentials certification take?
That depends mainly on how ready your systems are. The assessment itself is a questionnaire, but gathering device and account information and fixing gaps usually takes the longest. If you go on to Plus, the audit must be completed within three months of achieving basic certification.
Is Cyber Essentials mandatory?
Not for every business. It is a Government-recommended standard, but current certificates can be required for certain government contracts involving financial or personal data. Customers and insurers may also ask for it, so check your contracts.
Does Cyber Essentials cover cloud services?
Yes. All cloud services your organisation uses must be included in the scope of assessment and cannot be excluded from the requirements. That includes email and file storage platforms such as Microsoft 365.
Is Cyber Essentials enough to keep us secure?
No, it is a foundation. It reduces exposure to common, low-skill attacks but does not address advanced, targeted threats, so it should sit alongside monitoring, backups, staff training and an incident plan.
