Compliance · Cyber Essentials
Cyber Essentials & Cyber Essentials Plus
The UK government-backed baseline for cyber hygiene. Cyber Essentials is a verified self-assessment; Cyber Essentials Plus adds an independent, hands-on technical audit.
Last reviewed . Regulation moves, so check the regulation tracker for the current position.
What it is
A baseline that proves the basics are in place.
Cyber Essentials covers five technical control areas: firewalls, secure configuration, user access control, malware protection, and security update management.
Cyber Essentials (the standard tier) is a self-assessment that is independently verified. Cyber Essentials Plus adds a hands-on technical audit of your systems for stronger assurance.
Current requirements
What changed in April 2026.
Accounts registered from 27 April 2026 are assessed against the current IASME question set, known as Danzell, which implements version 3.3 of the Requirements for IT Infrastructure.
- Cloud services that hold your organisation’s data are in scope and can no longer be excluded
- Multi-factor authentication is required on every cloud service that offers it
- Passwordless methods such as passkeys and FIDO2 security keys are formally accepted as MFA
- Critical and high-risk security updates must still be applied within 14 days, and unsupported software removed or segregated
Who needs it
Often the first ask, and a sensible floor for everyone.
It is required for many UK public-sector contracts and increasingly named in client supplier audits and insurance questionnaires.
Even where it is not mandated, it is a credible, affordable baseline that demonstrates you take the fundamentals seriously.
What Plus tests
What the Cyber Essentials Plus audit checks.
Plus takes the same five controls and tests that they are genuinely operating. The audit can run remotely or on site, and any failed checks have to be fixed and retested before the certificate is issued.
- An external scan of your internet-facing services
- Authenticated vulnerability scans of a representative sample of user devices
- Checks that security updates, malware protection and secure configuration are in place on those devices
- Tests of your email and web defences using benign simulated malicious content
- Confirmation that multi-factor authentication is enforced on your cloud services
Gap analysis
A Cyber Essentials gap analysis, before you submit.
A gap analysis checks your estate against the five controls and the current question set before anything goes to the certification body: device and software inventory, unsupported software, high and critical updates applied within 14 days, multi-factor authentication on every cloud service that offers it, admin rights, firewall rules and malware protection.
The output is a short list of what to fix and in what order, so the self-assessment is accurate first time and a Plus audit holds no surprises.
Timeline
How long it takes, and how it renews.
Cyber Essentials typically takes a few weeks from kick-off, most of it preparation: once the controls are in place, the certification step itself is quick. Cyber Essentials Plus typically takes four to six weeks, and the Plus audit has to be completed within three months of gaining the standard certificate.
Both certificates renew every year. The first year is the heavy lift; after that, renewal is routine if the controls have been kept current in between.
Common pitfalls
The gaps that most often cause a fail.
All four are findable in advance, which is why a pre-assessment comes before anything is submitted.
- Unsupported software still in use, such as an operating system past end of life
- Multi-factor authentication enabled for some users or services but not all, especially cloud admin accounts
- Devices that have slipped behind on security updates, often laptops that are rarely on the network
- An inaccurate scope, so the assessor samples devices nobody prepared
How we help
From scope to certificate, then kept current.
- Scope the assessment and identify gaps before you submit
- Close those gaps and gather the evidence assessors actually accept
- Certification delivered through certified assessment partners
- Maintain it year-round through continuous compliance, so renewal is routine
FAQ
Questions buyers actually ask
What is the difference between Cyber Essentials and Cyber Essentials Plus?
Both cover the same five controls: firewalls, secure configuration, user access control, malware protection and security update management. Cyber Essentials is a self-assessment that a certification body verifies. Cyber Essentials Plus adds a hands-on technical audit, in which an assessor scans and tests a sample of your devices and services to confirm the controls are actually working.Is Cyber Essentials mandatory?
It is not a legal requirement, but it is required for many UK public-sector contracts and is increasingly named in client supplier audits, procurement frameworks and cyber insurance questionnaires. For many organisations the practical answer is that a client or contract has made it mandatory.How long does Cyber Essentials certification last?
Certificates are renewed annually. Renewal is a fresh assessment, and for Plus another technical audit, so it pays to keep the controls current through the year rather than rebuilding the evidence each time.Are cloud services in scope for Cyber Essentials?
Yes. For accounts registered from 27 April 2026, cloud services that hold your organisation’s data can no longer be excluded from scope. Multi-factor authentication remains required on every cloud service that offers it, and passkeys and FIDO2 security keys are now formally accepted as MFA.What happens if we fail the Cyber Essentials Plus audit?
Failed checks do not end the process. You fix the findings and the assessor retests them before the certificate is issued. The better route is to find those gaps first, through an accurate inventory, a patch sweep, an MFA check and a pre-assessment, so the audit holds no surprises.Who can help us through Cyber Essentials and close what the assessment finds?
We can. We run a gap analysis against the five controls, tell you what to fix and in what order, prepare you for the Plus audit, and see any failed checks through to the assessor’s retest before the certificate is issued. Certification itself is delivered through certified assessment partners, and we keep the controls current so renewal is routine.Who issues the Cyber Essentials certificate?
Certificates are issued by certification bodies licensed under the scheme, which IASME runs on behalf of the NCSC. Threat Protect scopes the work, closes the gaps and keeps the controls current, with certification delivered through certified assessment partners.
Ready for Cyber Essentials?
Tell us about your setup and we’ll map the quickest credible path to certification.
Book a call Also available in AWS Marketplace