More and more businesses are being asked the same question by customers, insurers and tender documents: are you Cyber Essentials certified? If the answer is no, it can quietly cost you work. The good news is that Cyber Essentials is one of the most achievable security standards there is, provided you prepare properly.
What Cyber Essentials is
Cyber Essentials is a UK government-backed certification scheme. It is set by the National Cyber Security Centre (NCSC) and delivered by IASME through a network of licensed certification bodies. It shows that your business has the basic technical controls in place that stop the most common, unsophisticated attacks.
There are two levels. Cyber Essentials is a self-assessment: you answer a detailed questionnaire about how your IT is set up, and a certification body reviews your answers. Cyber Essentials Plus covers the same controls, but an assessor checks them with hands-on technical testing of your devices and systems. You need Cyber Essentials before you can go for Plus.
Who needs it
It is a requirement for some UK government contracts, particularly where personal or sensitive information is handled. Beyond that, larger companies increasingly ask their suppliers for it, and some insurers take it into account. For many small businesses, the most valuable part is simply being able to say yes when a customer asks.
The five controls
The whole scheme is built on five technical controls:
- Firewalls: protecting the boundary between your devices and the internet.
- Secure configuration: removing default passwords, unused accounts and software you don't need.
- Security update management: keeping operating systems and software supported and patched quickly.
- User access control: giving people only the access they need, and protecting accounts properly, including admin accounts.
- Malware protection: stopping malicious software from running.
None of these is exotic. The difficulty is applying all five consistently to every device and service in scope, not just most of them.
What changed in 2026
Since 27 April 2026, assessments use version 3.3 of the requirements and a new question set called Danzell. The five controls are the same, but the questions are stricter and clearer, particularly around multi-factor authentication on cloud services, how quickly updates are applied, and exactly what falls within scope. If you certified before and are renewing, don't assume last year's answers still pass.
Where businesses usually get stuck
In our experience, few businesses fail because of a missing firewall. They get caught out by the details:
- Scope: laptops used at home, staff phones that access email, and cloud services such as Microsoft 365 all count.
- Out-of-support software: an old operating system or application that no longer receives security updates.
- Slow patching: high-risk and critical updates must be applied within 14 days of release.
- Multi-factor authentication: it has to be on for cloud services, not just for some users.
- Admin rights: everyday accounts with administrator access they don't need.
How to get certified
The process is straightforward when it is approached in the right order. First, agree what is in scope. Then check every device and service in that scope against the five controls, and fix the gaps. Only then complete the questionnaire and submit it to a certification body. The certificate is valid for 12 months, so renewal is a yearly job worth planning for.
The NCSC publishes the full Cyber Essentials requirements if you want the official detail. If you would rather have someone check your setup, fix what needs fixing and take you through the submission, our cyber security team can prepare you for certification and renewal. A good place to start is your Microsoft 365 security settings, which cover several of the controls.
If a customer or tender is asking for Cyber Essentials, get in touch and we will tell you how far you are from passing.
