What is Cyber Essentials?

What does Cyber Essentials cover?

Cyber Essentials covers the IT an organisation uses to do its business: devices, networks, software and cloud services that can accept connections from the internet or make outbound connections to it.

The NCSC organises the requirements under five technical controls, and the applicant is responsible for meeting every requirement for the scope it declares. It is deliberately a baseline. The NCSC describes what to do first as: establish the boundary of scope, review each of the five control themes, then take the steps needed to meet every requirement for that scope. A1.11 asks whether you have read the requirements document before you start.

What are the five Cyber Essentials controls?

The five Cyber Essentials controls are firewalls, secure configuration, security update management, user access control and malware protection. Each has an aim set by the NCSC in Requirements v3.3:

1. Firewalls: To make sure that only secure and necessary network services can be accessed from the internet.
2. Secure Configuration: Ensure that computers and network devices are properly configured to reduce vulnerabilities and provide only the services required to fulfil their role.
3. Security Update Management: Ensure that devices and software are not vulnerable to known security issues for which fixes are available.
4. User Access Control: Ensure that user accounts are assigned to authorised individuals only, and provide access to only those applications, computers and networks that the user needs to carry out their role.
5. Malware Protection: To restrict execution of known malware and untrusted software, from causing damage or accessing data.

Each control has its own hub on this site, with the requirement text, what assessors check, and the Danzell questions it answers. Start with the requirements overview.

How does Cyber Essentials certification work?

Cyber Essentials certification works in five stages: set the scope, meet the five controls, answer the IASME question set, have a board member sign the declaration, and have a Certification Body mark the submission.

1. Set the scope. Decide whether the whole organisation or a separately managed sub-set is being certified, and list the devices, networks and cloud services inside it.
2. Meet the five controls. Check every in-scope device and cloud service against the firewall, secure configuration, security update, user access and malware protection requirements in v3.3, and fix any gaps.
3. Answer the question set. Complete the Danzell question set in the IASME portal, describing each control specifically in the notes fields.
4. Sign and submit. A board member or equivalent signs the declaration, and the submission goes to a Certification Body for marking.
5. Receive the certificate. An assessor marks the answers. A pass issues the Cyber Essentials certificate; Cyber Essentials Plus, if wanted, follows as an audit on the same scope.

The full walk-through, with the auto-fail questions to clear first, is on how to get certified.

What is the difference between Cyber Essentials and Cyber Essentials Plus?

Cyber Essentials is a verified self-assessment; Cyber Essentials Plus tests the same requirements and adds a hands-on technical audit of a sample of your devices and cloud services by an assessor.

See Cyber Essentials Plus explained and the side-by-side comparison.

What is in scope?

The scope is either the whole IT infrastructure used for your business, or a well-defined and separately managed sub-set created with a firewall or VLAN (a sub-set). Cloud services can never be excluded, and a scope that leaves out end-user devices is not acceptable.

Either way the boundary must be clear: the business unit managing it, the network boundary and the physical location. See the scope rules in full.

Who needs Cyber Essentials?

Any UK organisation can apply, and suppliers bidding for many public sector and defence contracts need it. Certification is voluntary unless a contract, framework or customer requires it.

Central government, agencies, NDPBs and NHS bodies apply Procurement Policy Note 014 to relevant procurements, defence suppliers meet it through Def Stan 05-138, and many larger customers ask for it in supplier terms. See who needs Cyber Essentials and the sector guides.

How much does Cyber Essentials cost?

The IASME scheme fee for a Cyber Essentials self-assessment is £320 to £600 plus VAT, set by the number of staff. Assessor support and Cyber Essentials Plus are priced separately by each Certification Body. Until 31 March 2027, IASME's government-funded offer takes 75% off the fee for UK organisations with fewer than 250 staff that have not held Cyber Essentials in the last four years; see Cyber Essentials funding.

Precursor charges from £1,500 for Cyber Essentials with the IASME fee included and from £3,000 for Cyber Essentials Plus with Cyber Essentials included, all + VAT. Full breakdown on the Cyber Essentials cost page.

How long does a Cyber Essentials certificate last?

A Cyber Essentials certificate lasts 12 months from its date of issue. After that it must be renewed by completing the question set in force at the time.

Cyber Essentials Plus runs on the same annual cycle and needs a fresh self-assessment pass each year. The renewal guide covers what to re-check, and how long certification takes covers the timings.

What are the advantages of Cyber Essentials?

The advantages of Cyber Essentials are a defined security baseline, contract eligibility, free insurance for eligible organisations and a public record of certification:

• A defined baseline. The five controls address common types of internet-based attack, and each requirement is written down in the NCSC requirements document, so you know exactly what good looks like.
• Contract eligibility. Buyers applying Procurement Policy Note 014, the MoD through Def Stan 05-138, and many private customers ask for a current certificate.
• Included insurance. The Danzell question set states that eligible UK organisations with turnover under £20 million can opt in to cyber insurance free of charge on certification (A3.1).
• A searchable certificate. Certified organisations, and any legal entities included under A1.6, are listed in the Cyber Essentials certificate search and the Supply Check Tool, so customers can verify you. See how to verify a certificate.
• An annual check. Renewal every 12 months forces a fresh look at supported software, MFA coverage and firewall rules.

The NCSC's own figures for 2024/25 show the scale of the scheme: 39,790 Cyber Essentials and 12,850 Cyber Essentials Plus certifications awarded, 75% of Cyber Essentials certifications were renewals, and organisations with Cyber Essentials were 92% less likely to make a claim on their insurance (NCSC Annual Review 2025). For the cost and benefit case in full, see is Cyber Essentials worth it? and how the included cyber insurance works.

What changed in 2026?

Requirements v3.3 and the Danzell question set came into force on 27 April 2026. v3.3 defines cloud services and states they cannot be excluded from scope.

It also updates the passwordless definition to include FIDO2, introduces the Software Security Code of Practice, removes the reference to untrusted connections from the scope criteria and emphasises backups. Read the full change log.