What is Cyber Essentials?
Cyber Essentials is a UK government-backed certification scheme, developed with the National Cyber Security Centre (NCSC) and delivered by IASME. It shows that your business has the basic technical controls in place to protect against the most common internet-based attacks.
It's increasingly requested by customers, required for some public sector contracts, and can help with cyber insurance.
The five technical controls
- Firewalls — protecting the boundary between your network and the internet.
- Secure configuration — removing default passwords, unused software and accounts.
- User access control — giving people only the access they need, with separate admin accounts and MFA.
- Malware protection — anti-malware or application controls on devices.
- Security update management — applying critical and high-risk updates within 14 days.
What changed in April 2026
The requirements were updated on 27 April 2026. The five controls stayed the same, but the bar for evidence rose. Most importantly, failing to enable multi-factor authentication on a cloud service where it's available is now an automatic fail. The update also strengthened expectations around firmware updates and asset inventories, and recognises passwordless authentication.
Always check the current requirements document from IASME before you apply, as details change.
Cyber Essentials vs Cyber Essentials Plus
Cyber Essentials is a verified self-assessment questionnaire. Cyber Essentials Plus covers the same controls but adds independent technical testing of your systems by an assessor. Plus carries more weight with larger customers and contracts.
How to get certified
- Define the scope — usually your whole business.
- Run a gap analysis against the current requirements.
- Fix the gaps: MFA, updates, admin accounts, unsupported software.
- Complete the assessment with an accredited certification body.
- Keep it up — certification is renewed annually.
We help businesses prepare and remediate — see cyber security.
