Cyber Essentials and Cyber Essentials Plus
Cyber Essentials certification, control by control
Cyber Essentials is the usual starting point if you sell to UK government or need to show UK customers a baseline of cyber hygiene. This page covers what each control asks for, how certification works and how to prepare.
In short
Cyber Essentials is a UK government-backed certification scheme operated by IASME on behalf of the National Cyber Security Centre (NCSC). It tests five technical controls that defend against the most common internet-based attacks. Cyber Essentials is a self-assessment verified by a certification body. Cyber Essentials Plus adds a hands-on technical audit. Both certificates are valid for one year.
What Cyber Essentials is
Cyber Essentials is a certification scheme. It checks whether you have put in place five technical controls that the NCSC treats as the baseline defence against common cyber attacks. It does not cover governance, risk management or the wider security management system that ISO 27001 addresses.
The scheme has two levels. Cyber Essentials is a verified self-assessment: you answer questions about your controls, and a certification body reviews your answers. Cyber Essentials Plus adds a hands-on technical audit in which the assessor tests your controls directly by scanning and sampling your systems.
The five technical controls
Each control addresses a specific way in. Together they block most commodity attacks.
| Control | What it covers | What the assessor checks |
|---|---|---|
| Firewalls | Boundary firewalls and internet gateways | Default deny on inbound, no unnecessary services exposed |
| Secure configuration | Removing or disabling unnecessary software and changing defaults | No default passwords, minimal attack surface |
| Security update management | Patching operating systems and applications | Critical and high patches applied within 14 days |
| User access control | Controlling who has access to data and services | Least privilege, no admin accounts for daily use |
| Malware protection | Restricting execution of known malware | Anti-malware software or application allow-listing |
Who needs Cyber Essentials
Since 2014, Cyber Essentials has been mandatory for UK government contracts that involve handling personal information or providing certain ICT products and services. Many larger UK organisations also require it from their suppliers as baseline assurance, outside government work.
For companies selling into the UK, Cyber Essentials is often the first certification buyers ask for. It is simpler and cheaper than ISO 27001, and if your controls are already in place it can be done in days.
- Companies bidding for UK government contracts
- Suppliers to organisations that require Cyber Essentials from their supply chain
- UK businesses that want to show a baseline of cyber hygiene
- Companies using it as a first step towards ISO 27001
Cyber Essentials vs Cyber Essentials Plus
Cyber Essentials is a verified self-assessment. You describe your controls, and the certification body checks your answers for completeness and consistency. Your systems are not technically tested.
Cyber Essentials Plus adds a hands-on audit. The assessor runs external vulnerability scans, checks a sample of devices for patching and configuration, tests email and web-browsing defences, and verifies access controls directly. It gives higher assurance, and more buyers now ask for it on sensitive contracts.
- Cyber Essentials
- Verified self-assessment. You describe your controls and the certification body reviews your answers.
- Cyber Essentials Plus
- Hands-on audit. On top of the self-assessment, the assessor scans and tests your systems directly.
Cyber Essentials alongside ISO 27001 and SOC 2
Cyber Essentials covers a subset of what ISO 27001 and SOC 2 address. If you already hold ISO 27001 or a SOC 2 report, the five Cyber Essentials controls are very likely in place. You still need the certification separately because the assessment method differs, but there is little extra preparation.
Many companies start with Cyber Essentials as a quick baseline and then work towards ISO 27001 for broader assurance. The technical controls carry across. ISO 27001 adds the management system around them.
The path to certification
Cyber Essentials is one of the quicker certifications to achieve. Most companies complete it in a few days to a few weeks.
-
01
Scope
Define the networks, devices and users in scope. Cloud services and home workers are included.
Your team
-
02
Self-assessment
Answer the Cyber Essentials questionnaire about your five controls.
Your team
-
03
Certification body review
A certification body reviews your answers and issues the Cyber Essentials certificate.
IASME-licensed certification body
-
04
Plus audit (optional)
If you are going for Plus, the assessor scans and tests a sample of your systems.
Certification body assessor
Who does what
Software, implementation support and the independent assessor are different jobs. This is how they divide.
| Task | Your team | Certifyi | IASME-licensed certification body |
|---|---|---|---|
| Scope | Define it | Records the scope | Reviews scope boundaries |
| Controls | Implement them | Holds controls and policies | Not involved |
| Self-assessment | Complete the questionnaire | Holds the evidence behind each answer | Reviews answers (CE) |
| Technical audit | Not involved | Lets the Plus assessor see the evidence through scoped, read-only access | Scans and tests systems (Plus) |
| The certificate | Not involved | Not involved | Issues the certificate |
How Certifyi helps
Run Cyber Essentials on the same record as your other frameworks
Certifyi does not issue your certificate. It holds the five controls, the evidence behind each answer and the policies that support them, in the same workspace as any ISO 27001 or SOC 2 work you run.
-
Tamper-evident activity log
The evidence behind each questionnaire answer stays on the control it supports, and every change to it is written to the tamper-evident activity log. Next year's renewal starts from that record.
-
Policies with review cycles
Write and review the policies that support your controls, and track who has acknowledged them.
From the blog
Cyber Essentials articles
Longer answers to the questions teams ask while they work on Cyber Essentials.
Questions
Cyber Essentials, answered
Is Cyber Essentials mandatory?
For UK government contracts involving personal data or ICT products and services, yes. Private-sector buyers increasingly expect it, but no law requires it.
How long does certification take?
Cyber Essentials can be completed in days if your controls are already in place. Cyber Essentials Plus takes longer because of the technical audit, typically one to two weeks from start to certificate.
How long is the certificate valid?
One year. You recertify annually against the current version of the scheme requirements.
Do we need Plus or is basic enough?
It depends on what your customers require. Many government contracts and larger buyers specify Plus for the higher assurance. If your contracts do not require it, basic Cyber Essentials may be enough.
Does Cyber Essentials cover cloud services?
Yes. Cloud services, SaaS applications and infrastructure as a service are in scope. You are responsible for the controls on your side of the shared responsibility model.
Can we reuse this work for ISO 27001?
Yes. The five Cyber Essentials controls are a subset of ISO 27001 Annex A, so the controls and evidence carry across. ISO 27001 adds the management system: scope, risk method, Statement of Applicability, internal audit and management review.
Preparing for Cyber Essentials?
Bring your network diagram and the contract that requires it. We can agree what falls in scope, cloud services and home workers included, and talk through what the assessment involves.
- Each customer workspace has its own database
- Every change written to a tamper-evident activity log
- Auditors get scoped, read-only access
- AI suggestions wait for a person to accept them