Cyber Essentials
Also known as: CE, CE+, Cyber Essentials Plus, NCSC Cyber Essentials
Cyber Essentials is a UK government-backed certification scheme designed to help organizations protect against the most common cybersecurity threats.
It focuses on five technical controls: boundary firewalls and internet gateways, secure configuration, user access control, malware protection, and patch management. There are two levels: Cyber Essentials (self-assessment verified by a certifying body) and Cyber Essentials Plus (hands-on technical verification by an external assessor). UK government suppliers handling personal data or providing certain contract types are required to hold Cyber Essentials certification.
Cyber Essentials, explained at three levels
At home
Cyber Essentials is the UK government's way of saying 'here are the five most important things every organization should do to stay safe online.' Those five things are: have a proper firewall between you and the internet, configure your systems securely rather than using default settings, limit who has access to what, use anti-malware software, and keep your software up to date. Organizations that demonstrate they have done all five earn a Cyber Essentials badge they can display to customers and partners.
At work
Cyber Essentials certification demonstrates that your organization has implemented the five baseline controls most likely to prevent common cyberattacks. The basic Cyber Essentials involves completing a self-assessment questionnaire verified and counter-signed by a certifying body. Cyber Essentials Plus adds an independent technical assessment: external assessors probe your systems to verify the controls are working, not just documented. Both levels are valid for 12 months and require annual renewal.
At home
The five Cyber Essentials controls and what they require: Firewalls (boundary devices filtering traffic, with a default-deny policy for inbound connections); Secure Configuration (no unnecessary software, default passwords changed, unnecessary accounts disabled); User Access Control (standard accounts for day-to-day use, admin access only for admin tasks, accounts reviewed annually); Malware Protection (active malware protection with current definitions); and Patch Management (critical patches applied within 14 days, unsupported software removed).
At work
The January 2022 update introduced significant changes. Cloud services used by the organization are now in scope; previously, only on-premises systems were assessed. Multi-factor authentication is now mandatory for all cloud services that store or process in-scope data. Home workers' personal devices used to access work systems must also meet Cyber Essentials requirements if those devices are in scope.
At home
Under the hood, the two levels test different things. Basic Cyber Essentials checks your answers to a detailed questionnaire about firewalls, settings, accounts, malware protection, and patching, so it proves you know the rules but not that every device follows them. Plus adds an assessor who scans your internet-facing systems, samples real laptops and phones for missing patches, and tests whether malicious attachments and downloads get blocked. In my view, basic certification is a sensible first step, but only Plus tells you the controls actually work.
At work
From a practitioner standpoint, the most common Cyber Essentials failure points are patch management (particularly for unsupported or embedded software) and privileged access (generic admin accounts, unreviewed access). Cloud adoption has made scoping complex: an organization using many SaaS tools must determine which are in scope and verify MFA is enforced for each. For larger organizations, Cyber Essentials is a useful baseline but inadequate as a complete security program: it is typically pursued alongside ISO 27001.
Real-world examples
At home
Aisha runs a 12-person digital agency and won a contract with a local council. Before signing, the council required Cyber Essentials Plus certification. Aisha worked with a certifying body, answered the self-assessment questionnaire, and passed the hands-on technical assessment. The whole process took about three weeks.
At work
The procurement team at a regional NHS Trust added Cyber Essentials Plus as a minimum requirement for all IT suppliers following NCSC guidance. During a supplier review, three vendors were identified as lacking current certification; the procurement team issued a 30-day notice to achieve certification or face suspension from the approved supplier list.
How it compares
| Feature | Cyber Essentials | ISO 27001 | NIST Cybersecurity Framework |
|---|---|---|---|
| Scope | Five specific technical controls | Full information security management system | Cybersecurity risk management framework |
| Who issues it | NCSC-approved certifying body | Accredited certification body | No certificate issued |
| Assessment type | Self-assessment (CE) or hands-on testing (CE+) | Document review + evidence testing | Self-assessment or third-party |
| Typical audience | UK SMEs and government suppliers | Any organization globally | Any organization, especially US |
| Time to achieve | Days to weeks | 3-12+ months | Ongoing (no endpoint) |
Cyber Essentials is the fastest, lowest-cost baseline certification available in the UK and focuses purely on preventing common attacks. ISO 27001 is far broader and globally recognized but requires substantially more investment. NIST CSF is a planning tool rather than a certifiable standard.
For analysts
In BA artefacts for UK-based or UK-government-adjacent projects, Cyber Essentials requirements typically appear as vendor qualification criteria and baseline security constraints on new systems. When documenting requirements for a system that includes cloud services or remote access, specify that the design must support Cyber Essentials compliance: particularly MFA for cloud access and patch management processes. Useful NFR: 'All administrative access to the system must require multi-factor authentication, and software components must receive security patches within 14 days of release, in line with Cyber Essentials requirements.'
History & origin
Cyber Essentials was launched in June 2014 by the UK government and is now overseen by the National Cyber Security Centre (NCSC), which was formed in 2016. It was developed in response to findings that a majority of cyberattacks exploit basic technical vulnerabilities that five core controls would prevent. IASME Consortium became the primary governing body for the scheme. The requirements were significantly updated in January 2022 to address cloud services, home working environments, and multi-factor authentication, reflecting the shift to cloud-first and hybrid working. Later updates made end-of-life software an automatic fail (April 2025) and, from April 2026, failing to enable MFA on a cloud service that offers it.