What Cyber Essentials certification means
Cyber Essentials is a UK government-backed baseline designed to help organisations defend against common internet threats. It is a practical check of five technical areas, not a complete security programme. Certification is not a guarantee that you will never be attacked, and it is not proof of GDPR or ISO 27001 compliance.
For the standard certification, you complete a self-assessment. An assessor from a licensed Certification Body reviews it, and a senior responsible person signs it off. Cyber Essentials Plus uses the same five controls, then adds independent hands-on technical testing. If considering Plus, agree the scope and testing timetable directly with your chosen Certification Body.
A certificate is valid for 12 months. You need to renew annually and keep the controls working throughout the year—not just make changes for assessment day.
Check which 2026 requirements apply
The NCSC Requirements for IT Infrastructure v3.3 took effect on 27 April 2026. The Danzell question set applies to accounts created from that date. Before you start, confirm which question set applies to your account and check for scheme updates. The NCSC requirements and resources and IASME’s April 2026 update are the appropriate references.
Under the April 2026 marking changes, missing available MFA for cloud services is an automatic fail. So is failing to install high- or critical-risk security fixes within 14 days of vendor release for operating systems, routers or firewall firmware (A6.4), and applications or extensions (A6.5). Where the vendor provides no severity details, the 14-day rule also applies. Do not treat the assessment as a points score or assume that a planned fix will count.
Define your scope before checking controls
Your scope is the organisation, services and devices covered by your answers. It can include legal entities or business units, sites, end-user devices, business cloud services and remote or personally owned devices that access business data or services. Start with a complete inventory, then discuss any justified segmented exclusions with your assessor. You cannot simply omit cloud services that store or process organisational data.
Phones used only for MFA, native voice calls or native SMS are excluded. A personal phone that accesses work email or files is generally in scope. An ISP-provided home router is generally outside scope; an employer-supplied router is included. In-scope devices still need appropriate firewall protection: confirm how home networks, software firewalls and corporate VPN connections are covered.
Using a managed service provider (MSP) or cloud platform does not transfer responsibility for your organisation’s answers. Write down which controls your provider operates and which remain yours. Ask the assessor about scope edge cases rather than assuming a provider’s own certificate covers your business.
The five controls, in plain English
Use these as a practical gap-check, then answer against the official question set and scope rules. The exact assessment questions are authoritative.
Firewalls
Change default passwords and settings. Block unauthenticated inbound connections by default; document and approve any rules you need. Protect remote administration, and make sure devices away from a controlled network use suitable software firewalls.
Secure configuration
Remove applications and accounts you do not use, replace default passwords, require users to authenticate and lock devices when unattended. Keep the setup appropriate to the way each device is used.
Security update management
Use supported, licensed operating systems, applications, browsers, extensions and router or firewall firmware. Turn on automatic updates where possible. Install security fixes within 14 days of vendor release if they are critical or high risk, have a CVSS v3 score of 7 or more, or the vendor supplies no severity details.
Replace unsupported software, or formally segregate it only where the official scope rules allow. Do not casually exclude an old computer from your assessment. The 14-day clock starts at vendor release, not the day you deploy the update.
User access control
Give each person a unique account, grant only the access they need, and remove access when people leave. Keep separate administrator accounts for admin work. Include accounts owned by your organisation with an MSP or application provider.
Enable MFA across cloud services wherever it is available, including paid options. Registration is not enforcement: test that MFA is required for all in-scope users, not just administrators or the person who set it up.
For password-based access, follow the official password-length and brute-force protections. With MFA, the password must have at least eight characters. Without MFA, the options include at least 12 characters, or at least eight with automatic blocking of common passwords, alongside the required protection against repeated guesses. The scheme also requires no maximum-length restriction. Do not enforce routine password expiry or complexity rules; change passwords promptly after suspected compromise. Check passwordless approaches against the current requirements too.
Malware protection
Use active, up-to-date anti-malware or compliant application allow listing that is appropriate for the platform. Include relevant mobile devices. The scheme does not impose a blanket “antivirus only” answer: confirm that your chosen protection meets the applicable requirements for each platform.
A practical preparation process
Work in this order so that your answers describe the environment you will actually certify. The official self-assessment questions and IASME readiness tool are useful starting points.
- 01Choose an owner and set the scope.
Identify the senior responsible person and the organisation, people, locations, devices and business services covered.
- 02Build an inventory.
Record devices and OS versions, business cloud services, user and administrator accounts, remote access and who manages each item.
- 03Check all five controls.
Use the current official question set to identify real gaps. Notes on settings, owners and changes can help you draft accurate answers; they are not a claim that every note must be submitted as evidence for standard CE.
- 04Make and record the changes.
Fix the controls, check that changes are in effect, and keep useful internal records. Do not answer “yes” to a change that is still planned.
- 05Review and complete assessment.
Have the senior responsible person review the complete, truthful answers. Buy and complete assessment through IASME or a licensed body, and respond to any assessor clarification.
- 06Maintain and renew.
Keep updates, access, MFA and protection in operation. Set a reminder to renew before the 12-month certificate expires.
- Name a senior responsible person and agree the legal entities, sites and services in scope.
- List devices, operating system versions, business cloud services, accounts and remote access.
- Check every in-scope device and service against each of the five controls.
- Fix gaps first; note what changed and who owns ongoing maintenance.
- Review the final answers honestly with the senior responsible person before submission.
Fees and choosing an assessment route
IASME’s published fees for the standard self-assessment, checked on 26 October 2026, are based on employee band:
| Employees | IASME published fee |
|---|---|
| 0–9 | £320 + VAT |
| 10–49 | £440 + VAT |
| 50–249 | £500 + VAT |
| 250+ | £600 + VAT |
These are IASME’s published standard fees and may change. They exclude remediation, software licences, support and Cyber Essentials Plus; Plus is quoted to scope. Confirm current charges and assessment arrangements with IASME’s scheme information or your chosen licensed Certification Body. Preparation time depends on your starting point; no fixed turnaround or pass can be promised.
Common mistakes that cause avoidable problems
- Leaving out personal devices or cloud apps. Find every service and device that accesses work information before settling scope.
- Registering MFA but not enforcing it. Check the sign-in experience for all in-scope users and every relevant cloud service.
- Missing unsupported software or firmware. Include operating systems, office applications, browsers, router and firewall firmware in your inventory.
- Starting the patch deadline on the wrong day. Count 14 days from the vendor’s release, not your deployment date.
- Assuming an MSP’s certificate is yours. The applicant organisation remains accountable for its scope and answers.
- Answering “yes” before a change is live. Assess the environment in place, not the plan in a ticket.
- Treating certification as one-and-done. Maintain controls across the year and renew every 12 months.
Frequently asked questions
What does Cyber Essentials certification involve?
Cyber Essentials is a UK government-backed baseline against common internet threats. The standard level is a verified self-assessment reviewed by an assessor at a licensed Certification Body and signed off by a senior responsible person. Cyber Essentials Plus adds independent hands-on technical testing of the same five controls.
How much does Cyber Essentials cost?
IASME's published standard self-assessment fees, checked on 26 October 2026, are £320 + VAT for 0–9 employees, £440 + VAT for 10–49, £500 + VAT for 50–249 and £600 + VAT for 250 or more. Remediation, licences, support and Cyber Essentials Plus are not included; Plus is quoted to scope. Fees may change.
How long does it take to prepare?
There is no reliable one-size-fits-all preparation time. It depends on your scope, the devices and services you use, and the gaps you find. Identify and fix real gaps before completing the assessment; do not answer yes to a change that is only planned.
Does Cyber Essentials guarantee that my business will not be hacked?
No. It is a baseline that helps protect against common internet threats, not a guarantee against attack and not proof of GDPR or ISO 27001 compliance. Your controls need to be maintained throughout the certificate year.
Are backups one of the five Cyber Essentials controls?
No. Backups are strongly recommended to help your organisation recover, but they are not a sixth Cyber Essentials technical control or a mandatory technical requirement of the scheme.
Can my IT provider's certificate cover my business?
No. Your organisation remains responsible for its own scope and answers when it uses an IT provider or cloud services. Document who manages each control and agree any justified segmented exclusions with your assessor.
Official sources
This guide was prepared and reviewed on 26 October 2026. Scheme rules and prices can change; use the current official materials and speak to your Certification Body about your circumstances.