What is Cyber Essentials and do I need it?

If a customer has asked "are you Cyber Essentials certified?", or a tender lists it as a requirement, here is what it actually involves.

What it is

Cyber Essentials is a scheme run by the NCSC (the National Cyber Security Centre, part of GCHQ), with a company called IASME delivering it. It sets out the basic security controls that stop the most common attacks, the kind that try thousands of businesses at once looking for an easy way in.

There are two levels:

• Cyber Essentials: you answer a detailed online questionnaire about your setup, and an independent certification body checks your answers.
• Cyber Essentials Plus: the same controls, but an assessor also tests your systems hands-on.

What it checks

Five things, which together cover most of what goes wrong for small businesses:

1. Firewalls: something sits between your devices and the internet and blocks what shouldn't get through.
2. Secure configuration: devices and software are set up securely, with default passwords changed and things you don't need switched off.
3. Security updates: software is supported and kept up to date.
4. User access control: people only have the access they need, and admin accounts are only used for admin.
5. Malware protection: protection against harmful software.

It covers everything that handles your business data: laptops, phones, servers, your office router and your cloud services such as Microsoft 365 or Google Workspace.

What changed in April 2026

The scheme is updated every year. The current version (v3.3, with the "Danzell" questions) applies to applications from 26 April 2026. The changes that catch people out:

• Two-step login is a must. Not using multi-factor authentication (a code or app on your phone as well as a password) on a cloud service where it is available is now an automatic fail.
• Cloud services can't be left out. They are always in scope.
• Critical updates within 14 days. High-risk and critical security updates for operating systems, firmware and applications must be installed within 14 days of release.

What it costs

• Certification: from £320 to £600 plus VAT for Cyber Essentials, depending on the size of your organisation. It is renewed every year.
• Cyber Essentials Plus: priced by each certification body, and more because of the hands-on testing.
• Getting ready: this is the part that varies. If your setup is already in good shape, very little. If you need to update devices, change settings or turn on two-step login across the business, it takes some work.

There is a useful extra: UK organisations with a turnover under £20 million that certify their whole organisation can opt in to free cyber insurance with up to £25,000 of cover, including a 24-hour incident helpline. It lasts as long as the certificate.

Do you need it?

You need it if:

• You bid for central government contracts that handle personal or sensitive information. Government buying rules (PPN 014) require it for central government, its agencies and the NHS.
• You supply the Ministry of Defence. Defence contracts commonly require it too: check the contract.
• A customer asks for it. Larger companies increasingly require it from their suppliers.

It is worth having anyway if:

• You hold customer data and want a clear, independent check that the basics are right.
• You want to show customers and insurers you take security seriously.
• You'd like the free insurance.

How to get it

1. Check where you stand. Go through the requirements and be honest about the gaps. The most common: old devices that no longer get updates, admin accounts used day to day, and two-step login not turned on everywhere.
2. Fix the gaps.
3. Apply through IASME or one of its certification bodies, and answer the questionnaire.
4. Renew each year, and keep things in shape in between.

When to call someone

Call for help if:

• You aren't sure what counts as "in scope" for your business.
• You have older devices, a server or a mix of cloud services and don't know whether they pass.
• You've started the questionnaire and got stuck, or failed once already.

I prepare small businesses for Cyber Essentials and fix the gaps. To be clear: I don't issue the certificate. A certification body does that, and charges its own fee.

Sources

• NCSC: Cyber Essentials overview
• IASME: changes to Cyber Essentials for April 2026
• NCSC: Cyber Essentials requirements for IT infrastructure v3.3
• IASME: Cyber Essentials cost
• IASME: free cyber liability insurance
• Cabinet Office: PPN 014, Cyber Essentials scheme