Cyber Essentials: what is it and does your business need it?

What Cyber Essentials is

Cyber Essentials is the minimum standard of cyber security the government recommends for organisations of all sizes. It is built around five technical controls designed to protect against the most common internet-based attacks: firewalls, secure configuration, security update management, user access control and malware protection.

The scheme is assessed through a self-assessment questionnaire, verified by a licensed certification body. The requirements are reviewed and updated every year — the current version came into effect in April 2026 — so certification reflects the scheme as it stands when you apply, not when you last looked at it.

Why organisations get certified

For some organisations the reason is straightforward: a customer, contract or insurer asks for it. Cyber Essentials is required for some UK government contracts and is increasingly requested in supply chains, so certification can be a condition of doing business rather than a choice.

For others, the value is in what it demonstrates. Certification gives customers and suppliers independent confirmation that your organisation meets a recognised baseline of cyber security — and working through the requirements gives you a clear checklist of the fundamentals. What it is not is a guarantee: no certificate can promise you won't be attacked, and the controls still need to be maintained once the assessment is over.

Cyber Essentials or Cyber Essentials Plus?

Cyber Essentials Plus covers the same five controls, but adds independent technical testing: an assessor checks that the controls are actually in place rather than relying on your answers alone.

Which one is right for you depends on what you need it for. Some contracts specify Plus, and some organisations choose it for the higher level of independent assurance it provides. Where no particular level is required, the choice comes down to the assurance your customers expect and the confidence you want in your own arrangements.

Preparing sensibly

The organisations that find certification straightforward are usually the ones that already have the fundamentals in place: devices kept up to date, access limited to what people need, and basic malware protection in place.

Multi-factor authentication deserves particular attention. Under the current requirements, where a cloud service offers multi-factor authentication — whether included, free or as a paid option — it must be enabled for the accounts using that service. If it is available and not in place, the assessment is an automatic failure. This applies to cloud services rather than every system you use, but for most smaller organisations cloud accounts are exactly where it matters most.

It is also worth understanding scope before you apply. Certification doesn't have to cover everything you operate — the scheme allows a defined scope, subject to its requirements — but the devices, cloud services and remote working arrangements within that scope all need to be considered, and cloud services can't simply be left out. Deciding the scope early avoids surprises later.

If you are not sure where you stand, a gap assessment against the five controls will tell you what needs attention before you apply — which is usually quicker and cheaper than discovering problems during the assessment itself.