Cyber Essentials
Cyber Essentials is a UK government-backed certification that shows an organisation has five basic technical security controls in place to stop common internet attacks. The NCSC sets the requirements and IASME runs the scheme. You answer the Danzell question set, a board member signs it, and a Certification Body marks it. Certificates last 12 months.
- Term
- Cyber Essentials
- Also known as
- CE, Cyber Essentials scheme
- Category
- Scheme and certification
- Requirement area
- A. Introducing the technical controls
- Reviewed against
- Requirements v3.3
What does the term Cyber Essentials mean in Cyber Essentials?
Cyber Essentials is a UK government-backed certification that shows an organisation has five basic technical security controls in place to stop common internet attacks.
How does Cyber Essentials apply to Cyber Essentials?
In plain terms
Think of Cyber Essentials as an MOT for your IT. It does not check everything, but it checks the basics that stop most opportunistic attacks: a locked front door, good keys, up-to-date software and a guard against harmful files. Customers and public buyers use the certificate as quick proof that a supplier has those basics in place.
What the scheme asks
The NCSC's Requirements for IT Infrastructure v3.3 organise the rules under five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. You show you meet them by completing the 2026 Danzell question set in the IASME portal. A board-level person confirms the answers are accurate, and an assessor at a Certification Body marks them. Four questions fail automatically on a No answer: A6.4 and A6.5 (critical and high-risk updates within 14 days) and A7.16 and A7.17 (multi-factor authentication on cloud services). A7.15 also fails automatically if a cloud service listed there does offer MFA.
What it does not cover
The requirements recommend backups but say backing up is "not a technical requirement of Cyber Essentials". The scheme does not assess policies, staff training or incident response either. For an independent technical audit of the same five controls, organisations add Cyber Essentials Plus.
A1.11 asks whether you have read the NCSC requirements document, and A1.14 asks where you heard about the scheme.
See what is Cyber Essentials, the requirements overview and the glossary entry for scope.
Related terms
- Certification BodyA Certification Body is an organisation licensed by IASME, the NCSC's Delivery Partner, to assess and certify applicants for Cyber Essentials and Cyber Essentials Plus.
- Cyber Essentials PlusCyber Essentials Plus is the higher level of Cyber Essentials, where an assessor independently tests your systems instead of relying only on your written answers.
- ScopeScope is the networks, hardware and software assets, and cloud services that are included in a Cyber Essentials assessment.
- Cyber Essentials certificateA Cyber Essentials certificate is the digital record, issued through a Certification Body, that an organisation has passed Cyber Essentials or Cyber Essentials Plus.
- Cyber Essentials Readiness ToolThe Cyber Essentials Readiness Tool is a free online questionnaire from the NCSC, run with IASME, that asks about your IT and gives a personalised action plan for meeting Cyber Essentials.
- Cyber insuranceCyber insurance is a policy that pays towards the costs of a cyber incident, such as a data breach or ransomware.
Frequently asked questions
Cyber Essentials is a UK government-backed certification that shows an organisation has five basic technical security controls in place to stop common internet attacks.
In the 2026 Danzell question set, Cyber Essentials comes up at A1.11, A1.14. Read those questions against the definition above so your answers use the term the way the assessor will.
Cyber Essentials relates to A. Introducing the technical controls in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.