Cyber Essentials and Cyber Essentials Plus Explained
Cyber Essentials is the UK Government backed scheme that shows your business has the basic security controls in place. Here is how it works, what it costs and how to prepare.
How the Cyber Essentials scheme works
Cyber Essentials is run by the National Cyber Security Centre, part of GCHQ, with IASME acting as the delivery partner. IASME licenses a network of independent certification bodies across the UK, and it is one of these certification bodies that assesses your organisation and awards the certificate.
There are two levels:
- Cyber Essentials is a verified self assessment. You answer an online question set about how your IT is set up, a senior person in your organisation signs it off, and a qualified assessor from the certification body reviews your answers.
- Cyber Essentials Plus covers the same requirements but adds a hands on technical audit. An assessor tests a sample of your devices and systems to check the controls are really working. According to IASME, the Plus audit must be completed within three months of your Cyber Essentials certification.
Both certificates last for 12 months, after which you need to certify again to stay current.
The five technical controls
The NCSC organises the requirements under five technical controls. In plain English, they are:
- Firewalls. Every device should sit behind a properly configured firewall that blocks unwanted connections from the internet. Default admin passwords on routers and firewalls must be changed.
- Secure configuration. Computers, phones and cloud services should be set up securely, with unnecessary accounts and software removed and sensible screen lock settings.
- Security update management. Software must be licensed and supported by its maker. The current requirements say updates fixing critical or high risk vulnerabilities must be installed within 14 days of release, and software that is no longer supported must be removed, or kept out of scope on a separate network with no internet access.
- User access control. People should only have the access they need. Admin accounts must be separate from everyday accounts, and access to cloud services must use multi factor authentication.
- Malware protection. Devices need protection against viruses and other malicious software, for example through up to date anti malware software or by only allowing approved applications to run.
The requirements are reviewed and updated from time to time. The NCSC published version 3.3 of its requirements for IT infrastructure in April 2026, which makes clear that cloud services, such as Microsoft 365, cannot be excluded from scope. We always work from the current published version when preparing clients.
Who needs Cyber Essentials?
Cyber Essentials has been required for many UK central government contracts that involve handling personal information or providing certain IT services, and other public sector buyers and larger companies increasingly ask their suppliers for it. If you are tendering for work, check the contract requirements carefully, as some specify Cyber Essentials Plus.
Even if nobody is asking you for it, the scheme is a useful checklist. The controls are basic good practice, and putting them in place protects you against a large share of everyday attacks.
Where small businesses usually fall down
Most businesses we review are closer than they think, but the same few issues come up again and again:
- Old computers or software that no longer receive security updates.
- Staff using an admin account for everyday work.
- Multi factor authentication missing on some cloud services or admin accounts.
- Router or firewall admin passwords still set to the defaults.
- Personal phones accessing company email without any minimum security settings.
- No clear list of which devices and cloud services the business actually uses.
None of these are difficult to fix, but they need to be found first. That is what our gap analysis does.
What happens during preparation
Preparation usually starts with agreeing the scope: which parts of the business, which devices and which cloud services will be covered. For most small businesses the simplest and most valuable approach is to certify the whole organisation. We then check each device and service against the requirements, record what we find and give you a clear list of actions. Once the actions are complete, we help you work through the question set so your answers accurately reflect how your systems are set up.
Why prepare with Cyber Fits
Many of the changes needed for Cyber Essentials are the same ones we make for every managed IT support client: endpoint protection, managed updates, multi factor authentication and sensible Microsoft 365 security settings. That means preparation is often a natural step rather than a separate project, and keeping your systems compliant through the year becomes part of normal support.
We are based in Sunderland and work with businesses across the North East. If you need Cyber Essentials for a contract, or simply want to know how close you are, get in touch or start with a free IT review. You can read more about how certification works on the NCSC and IASME websites.