Firewalls
Control connections between your systems and the internet.
Cyber Essentials: Benefits and Requirements
A practical guide for UK organisations deciding whether to certify and how to prepare properly.
Talk to an expertA practical security baseline
Cyber Essentials is the UK government-backed baseline for protecting an organisation against common internet-based attacks. It gives customers and supply-chain partners a straightforward way to see that essential controls are in place.
It is not a replacement for wider monitoring or incident response. It creates a clear minimum standard and exposes practical gaps in devices, updates, access and cloud services.
The five Cyber Essentials controls
The current scheme assesses five connected technical control areas.
Secure configuration
Remove unnecessary accounts, services and insecure defaults.
Security updates
Keep devices, applications and firmware supported and patched.
User access control
Give people only the access they need and protect privileged accounts.
Malware protection
Prevent malicious software from running or reaching users.
Prevent malicious software from running or reaching users.
What are the benefits of Cyber Essentials?
Certification turns a technical baseline into evidence that customers, insurers and procurement teams can understand.
- A recognised baseline against common cyber attacks
- Clear evidence for customers and supply-chain partners
- Support for contract and procurement requirements
- A structured way to find common technical weaknesses
- Potential cyber liability insurance for eligible organisations
Is Cyber Essentials mandatory?
Not for every UK organisation. It may be required for particular contracts, procurement exercises or supply chains. Even when optional, it provides useful independent evidence for customers, insurers, trustees and commissioners.
Cyber Essentials or Plus?
Cyber EssentialsVerified self-assessmentRecognised baselineBest first step
Cyber Essentials PlusIndependent technical testingGreater assuranceFor higher-risk requirements
Many organisations certify at the standard level first, resolve any issues, then move to Plus when a contract or risk profile justifies it.
How to prepare for Cyber Essentials
A clear sequence prevents the assessment becoming a paperwork exercise.
- 1
Define the scope
Confirm the organisation, locations, users, devices and cloud services included.
- 2
Build an inventory
Record devices, operating systems, applications and network equipment.
- 3
Review access
Remove unused accounts and privileges that people no longer require.
- 4
Check the controls
Review updates, firewalls, malware protection and secure configuration.
- 5
Test readiness
Use the official question set and readiness tool before assessment.
- 6
Maintain the standard
Keep the controls working and recertify after 12 months.
Cyber Essentials questions
Straight answers to the questions businesses ask before starting.
What is Cyber Essentials?
Cyber Essentials is a UK government-backed certification scheme built around five technical controls that help organisations protect themselves against common internet-based cyber attacks.
Is Cyber Essentials mandatory?
It is not a universal legal requirement for every UK organisation, but it can be required for certain contracts, procurement exercises or supply chains. Even when it is not mandatory, the controls provide a recognised baseline for cyber security.
What is the difference between Cyber Essentials and Cyber Essentials Plus?
Cyber Essentials combines self-assessment with independent verification. Cyber Essentials Plus uses the same control requirements but adds a more rigorous independent technical assessment.
How long is a Cyber Essentials certificate valid?
Cyber Essentials certification is valid for 12 months, after which the organisation must recertify to maintain current certified status.
Requirements can change. Check the NCSC overview and current technical requirements before assessment.
Get expert guidance and prepare with confidence
We can review your environment, explain the questions and fix practical gaps before assessment.