Most attacks are not sophisticated. They are automated scans looking for an easy way in: an unpatched laptop, a default password, an account without multi-factor authentication. Cyber Essentials closes those doors with five technical controls. A certificate shows your customers, insurers and the organisations you supply that you have done so.
Who runs it?
- The NCSC owns the scheme and writes the technical standard, Cyber Essentials: Requirements for IT Infrastructure v3.3 (April 2026).
- IASME is the NCSC's delivery partner. It runs the assessment platform and licenses the certification bodies.
- Certification bodies such as Get Cyber Certified mark your assessment and issue your certificate. You choose which certification body to work with, and the certificate is the same IASME Cyber Essentials certificate whichever you choose.
Certification lasts 12 months, so you renew it every year.
The five controls
Cyber Essentials checks five technical controls across every device, account and cloud service that handles your organisation's data.
| Control | What it means in practice | What we often see when marking |
| Firewalls | Every device and internet connection sits behind a correctly configured firewall, with default admin passwords changed. | Router admin passwords left at the factory default. |
| Secure configuration | Unused software and accounts are removed, default passwords are changed, and devices lock when left. | Old user accounts still active after staff have left. |
| Security update management | Supported software only, with high-risk and critical updates applied within 14 days of release. We recommend 7 days or less. | An unsupported operating system or browser still in use on one device. |
| User access control | Everyone has only the access they need, admin accounts are separate from day-to-day accounts, and multi-factor authentication (MFA) is on for every cloud service that offers it. | MFA missing on one cloud service, which is now an automatic fail. |
| Malware protection | Anti-malware or application allow-listing on every in-scope device. | Phones and tablets left out of the plan. |
Under the April 2026 requirements, every cloud service your organisation uses is in scope and cannot be excluded. That means Microsoft 365 or Google Workspace, but also your accounting software, messaging apps, social media accounts and domain registrar. Our April 2026 requirements guide covers the changes in detail.
Cyber Essentials or Cyber Essentials Plus?
Cyber Essentials Plus confirms that you have done Cyber Essentials correctly. If you need to evidence your Cyber Essentials, choose CE+. If not, its only other benefit is showing a higher commitment to cyber security.
| Cyber Essentials | Cyber Essentials Plus | |
| How it works | A verified self-assessment: you answer the question set, and an assessor marks it | The same controls, plus hands-on technical testing of a sample of your devices by an independent assessor |
| When to choose it | Most organisations, and most contracts that ask for Cyber Essentials | A contract or customer that asks for CE+, or a higher-risk contract |
| What you need first | Nothing | A current Cyber Essentials certificate. CE+ must be completed within three months of it |
| Price | From £319 + VAT (Marking Only) or from £650 + VAT (Supported) | By quote, based on the size of the sample tested |
Under the current rules, CE+ has a single 30-day remediation window. If the first sample fails, a new random sample is selected, with up to three working days' notice. If the second sample shows the same missing updates, CE+ fails and IASME revokes the Cyber Essentials certificate. That is why, if you get your Cyber Essentials through us, we recommend our Supported Service, and we offer an optional pre-CE+ check before testing.
How Cyber Essentials Plus works
What it does for your organisation
The main benefit is fewer easy ways in for attackers. The others follow from having a certificate that proves it.
- Win and keep contracts. Central government, the NHS, the Ministry of Defence supply chain and a growing number of private buyers ask suppliers for Cyber Essentials before they share data or award work.
- Free cyber insurance. UK organisations with a turnover under £20m that certify their whole organisation can opt in to cyber liability insurance arranged by IASME, with £25,000 of cover and access to an incident response helpline. It is subject to IASME's terms.
- Customer trust. You appear on IASME's public register of certified organisations, and you can use the Cyber Essentials badge on your website, tenders and email signatures.
- A clear picture of your own IT. Working through the question set shows you what devices, accounts and cloud services you actually have, which many organisations have never written down.
- Peace of mind for the board. The MD or trustees get independent confirmation that the basics are in place, without needing to understand the technical detail themselves.
Who needs Cyber Essentials?
The Government expects every UK organisation, from a sole trader to a large enterprise, to have Cyber Essentials. It becomes a formal requirement when a customer or contract asks for it.
- Central government and NHS contracts. Under PPN 014, which has applied since 24 February 2025, departments, agencies and NHS bodies must require Cyber Essentials, CE+ or equivalent controls on higher-risk contracts. That includes handling citizens' personal data, staff payroll or expenses data, and ICT systems at OFFICIAL level. The certificate must be renewed every year for the life of the contract. Read our guide to which contracts require Cyber Essentials.
- Defence suppliers. Cyber Essentials is part of the Ministry of Defence's supply-chain requirements. We certify Cyber Essentials; for Defence Cyber Certification (DCC), we pass your enquiry to our chosen, trusted DCC provider, who will be in touch with you directly. See Cyber Essentials for defence suppliers.
- Sectors where clients and regulators expect it. Law firms (including legal aid providers), accountants, financial services, schools and charities. Find guidance for your sector.
An expectation for every UK organisation
Cyber Essentials is no longer just for contract holders. Since 2025, the Government and the NCSC have asked every UK organisation to put it in place, and large organisations to require it from their suppliers.
| Date | Who | What it says |
| 7 July 2026 | Department for Science, Innovation and Technology | The Cyber Resilience Pledge, launched at 10 Downing Street, asks signatories to require Cyber Essentials across their supply chains. |
| 15 April 2026 | Secretary of State for Science, Innovation and Technology and the Security Minister | An open letter to business leaders tells organisations to "get the basics right with Cyber Essentials" and extend it to their supply chains. |
| 2025 | NCSC | The NCSC Annual Review 2025 says "It's time to act. Get Cyber Essentials certified", and asks large organisations to improve adoption across their supply chains. |
| Ongoing | NCSC | The Cyber Essentials overview describes it as the minimum standard recommended by the Government for organisations of all sizes. |
In practice, this means that more of your customers will ask for your certificate, even if you have never bid for a government contract. The NCSC reports that organisations holding Cyber Essentials are 92% less likely to make a claim on their cyber insurance.
What does Cyber Essentials cost?
The cost depends on how much help you want and, for Cyber Essentials Plus, how much testing is needed. Our prices start at:
| Service | From | What's included |
| Cyber Essentials Marking Only | £319 + VAT | You complete the assessment; we mark it and issue your certificate if you pass |
| Cyber Essentials Supported | £650 + VAT | A gap analysis with a senior assessor, every answer checked before submission, and your certificate |
| CE Readiness Assessment | £350 + VAT | A pre-check of where you stand, with feedback on each non-compliant item (certification not included) |
| Cyber Essentials Plus | By quote | Hands-on technical testing, priced on the size of the sample tested |
Prices are “from” prices and depend on the size of your organisation. Compare all packages or find the right package in six quick questions.
How certification works with us
The time from purchase to certificate depends mostly on how much needs fixing before you submit.
- Choose your service. Marking Only if you are confident you meet every requirement; Supported if you want an assessor to guide you and check your answers first. It comes down to your appetite for risk. Not sure? Use the package finder.
- Scope your organisation. List every device, account and cloud service that handles your data. On our Supported Service, your assessor checks your scope before you submit, because it is where most mistakes start. Read how to scope Cyber Essentials.
- Complete the question set. You answer the questions on the IASME assessment platform.
- Pre-check (Supported Service only). Your assessor reviews your answers and flags any gaps before you submit. We work closely with your chosen contact to help your organisation move to compliance.
- Submit for marking. Your assessor marks the submission against the NCSC requirements.
- Receive your certificate. Your certificate is issued and your organisation appears on the IASME register. Renew every 12 months.
For our Supported Service: 100% of applicants who have followed our advice and who have submitted within the required deadlines have passed. How we achieve this.
Questions people ask
Is it Cyber Essentials accreditation or certification?
People often search for “Cyber Essentials accreditation”, but the correct term is certification. Your organisation is certified against the NCSC’s requirements by an IASME-licensed certification body such as Get Cyber Certified. Whichever word you use, it’s the same Cyber Essentials certificate.
Is Cyber Essentials a legal requirement?
No, but the Government expects every UK organisation to have it, and it is a formal requirement when a contract, customer or insurer asks for it.
How long does certification last?
12 months. Renew before it expires so your certificate never lapses.
Can I do it myself?
Yes. You can complete the self-assessment yourself, and our Marking Only service is designed for organisations that are confident they meet the requirements. If there is any doubt, our Supported Service checks your answers before you submit.
What happens if I fail?
Your assessor tells you what needs fixing so you can put it right. Our Supported Service reduces that risk by checking everything before submission.
More answers in our FAQs and the Resource Hub.