Cyber Essentials is a UK government-backed certification that shows your organisation has 5 basic technical controls in place against common internet attacks. It is run by the National Cyber Security Centre and delivered by IASME. It suits organisations of any size, but it matters most if you sell to larger customers, handle personal data or bid for public sector work. It is voluntary for most businesses, the certificate lasts 12 months and the fee starts at £320 plus VAT.
What Cyber Essentials actually is
Cyber Essentials is a UK government-backed certification scheme that shows your organisation has 5 core technical controls in place against common internet-based attacks. The National Cyber Security Centre created it and IASME delivers it. You get certified by completing a verified self-assessment or, at the higher level, by passing a hands-on technical audit.
The NCSC describes it as the minimum standard of cyber security recommended by the government. That wording is worth taking at face value. It is a baseline, not a guarantee, and it is designed to stop the routine, opportunistic attacks that hit most businesses rather than targeted campaigns against large organisations.
Why the scheme exists
Most attacks on small and medium businesses are not clever. The government’s Cyber Security Breaches Survey 2025/2026 found that 43% of UK businesses, roughly 612,000 of them, reported a breach or attack in the previous 12 months. For small businesses with 10 to 49 employees the figure was 46%, and phishing was the most common type at 38%.
That lines up with what we cover in our look at what the 2026 breach figures mean for a 50-person company and why criminals increasingly prefer smaller firms. Smaller firms tend to have the same exposure as bigger ones with fewer people watching it.
The 5 controls explained
The NCSC’s Cyber Essentials overview sets out the same 5 controls for every organisation. This table shows what each one means in day-to-day terms.
|
Control |
What it means |
A practical example |
|
Firewalls |
A filter between your network and the internet |
Closing ports you do not use and removing remote admin access from the internet |
|
Secure configuration |
Setting up devices so they are hard to break into |
Removing default passwords and switching off software you do not need |
|
Security update management |
Fixing known software weaknesses quickly |
Applying critical updates within 14 days |
|
User access control |
Limiting who can reach data and what they can do |
MFA on every account and separate admin accounts |
|
Malware protection |
Stopping malicious software before it runs |
Up-to-date anti-malware or endpoint protection on every device |
Malware protection is where people often get stuck on terminology. Our guide to EDR vs antivirus vs XDR explains what counts and what goes beyond the requirement.
The 2 certification levels
Cyber Essentials is the verified self-assessment. You answer a detailed questionnaire, a senior person confirms the answers are accurate and an assessor marks them. Cyber Essentials Plus tests the same controls but adds a technical audit, where a certification body checks a sample of your devices and systems directly. Plus needs a basic certificate first, and you buy it from a certification body rather than from IASME.
Most businesses begin with the basic level. You move to Plus when a customer or contract needs independent technical evidence.
Who Cyber Essentials is for
Any UK organisation that handles customer data, uses cloud services or sells to larger businesses and public bodies can benefit from Cyber Essentials. It is voluntary for most, but central government contracts involving personal data, and many private supply chains, ask for it. Sole traders, charities and growing SMEs all qualify.
In practice it tends to fit the following groups.
- Suppliers To Central Government And Public Bodies
- Firms Answering Client Security Questionnaires
- Professional Services Handling Confidential Client Data
- Recruitment And Healthcare Providers Holding Personal Records
- Businesses Preparing For A Cyber Insurance Renewal
- Fast Growing Companies With Remote Staff And Cloud Tools
Professional services are a good example. If you run a practice, our pages on IT support for accounting firms and IT support for law firms show the wider security expectations those clients bring. The same goes for IT support for healthcare and IT support for recruitment agencies, where personal records raise the stakes.
Is Cyber Essentials mandatory?
For most businesses it is not a legal requirement. It becomes a requirement when a buyer makes it one.
The clearest example is central government. Procurement Policy Note 014 applies from 24 February 2025 and asks buyers to require Cyber Essentials or Cyber Essentials Plus, or equivalent controls, on contracts involving citizens’ personal information, government staff data or systems handling OFFICIAL information. Where certification is required it must be renewed every year for the length of the contract, and suppliers must show evidence before the contract is awarded. The note also tells buyers not to take a blanket approach, so a tender will tell you exactly what applies.
Outside government, the requirement usually arrives through a customer questionnaire or a supplier onboarding form. If that is happening to you, our overview of why your business should become Cyber Essentials accredited covers the commercial case in more detail.
How much it costs and how it works
IASME sets the assessment fee by organisation size, and the current IASME fees are below. Cyber Essentials Plus is priced separately by the certification body.
|
Organisation size |
Cyber Essentials fee (excluding VAT) |
|
0 to 9 employees |
£320 |
|
10 to 49 employees |
£440 |
|
50 to 249 employees |
£500 |
|
250 or more employees |
£600 |
The process itself is straightforward. You prepare, buy the assessment and complete it online within 6 months. A senior person confirms your answers, and an assessor reviews them, usually within 3 working days. If you meet every requirement, the certificate is issued straight away. In our experience, most organisations take around 4 to 8 weeks from a first conversation to certification, mainly because fixing gaps takes longer than answering questions.
The fee is rarely the main cost. Replacing unsupported laptops, buying MFA licences and tidying admin accounts usually cost more than the certificate.
Free cyber insurance can also come with certification. UK organisations with turnover under £20m that certify their whole organisation receive cyber liability insurance arranged by IASME. Insurers still ask their own questions at renewal, which we explain in our guide to cyber insurance renewals, MFA and old PCs.
What changed in April 2026
The Danzell question set applies to assessment accounts created after 26 April 2026, according to the IASME update on the 2026 changes. Two points catch people out.
- MFA is now mandatory for every cloud service where it is available, and missing it is an automatic fail
- Cloud services can no longer be excluded from scope
Updates for high-risk and critical issues must also be applied within 14 days of release. That puts your Microsoft 365 setup squarely in scope, which we explain in Cyber Essentials cloud scope for Microsoft 365 and Cyber Essentials v3.3 and Copilot and ChatGPT use. If your passwords are a concern, read about passkeys, FIDO2 and Cyber Essentials, and for patching see the 72-hour patch window.
What Cyber Essentials does not cover
A certificate shows your controls were in place when you were assessed. It does not watch your systems afterwards, and it will not stop a determined attacker.
It also has no monitoring, backup or incident response requirement. For that you need other layers, such as managed SOC services and MDR services for round the clock detection and response, and email security services against phishing. Cyber incident response and business continuity services cover what happens when something still goes wrong. Our explainer on business email compromise shows why the access controls still matter after you pass.
Getting ready for certification
We help UK businesses get their IT estate ready for certification, and an accredited partner carries out the assessment itself. That keeps the result independent. Our Cyber Essentials support starts with a gap assessment and moves through the fixes.
In our experience, the sticking points are rarely the firewall. They are usually MFA that is missing on some cloud services, old devices that no longer receive updates and admin accounts used for everyday work.
A few practical starting points help.
- Make A List Of Every Cloud Service Your Staff Use
- Check MFA Is On For Every User
- Replace Or Retire Unsupported Devices
- Separate Admin Accounts From Everyday Accounts
Personal phones are a common weak spot, so see our guide to Microsoft 365 BYOD, and our Microsoft 365 leaver checklist closes off forgotten access. Ongoing vulnerability management services help you meet the 14-day update rule without a scramble. If your scope is unclear, our IT consulting team can map it, and our cloud services and Office 365 support handles the tenant settings. If you have offices in several countries, our global IT support and European IT support teams can help keep the controls consistent across sites.
Talk to us about your Cyber Essentials readiness
If a customer has asked for Cyber Essentials, or you want to know whether you would pass today, we can review your estate and show you what needs fixing first. Contact Northern Star to arrange a readiness conversation.
