To meet Cyber Essentials requirements, you must show that every in-scope device and cloud service meets five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. The NCSC describes the scheme as the Government’s minimum recommended standard for organisations of any size. The current rulebook is version 3.3. Most failed assessments come down to scope and evidence, not missing technology. If you get those two right before you start, the certificate is far easier to win and to renew.
TL;DR
- Cyber Essentials has five technical controls. Version 3.3 of the requirements has applied since 27 April 2026.
- Scope comes first. It covers end-user devices, servers, networking equipment and every cloud service that holds your data. Cloud services cannot be excluded.
- Cyber Essentials is a verified self-assessment signed off by a board member. Cyber Essentials Plus adds a hands-on technical audit of the same controls.
- It is not a law for all businesses, but it is required for some higher-risk government contracts and is often asked for in supply chains.
- Fix the evidence gaps (patching, MFA, admin accounts, cloud settings) before you submit, not after a failed assessment.
Table of Contents
- What Cyber Essentials actually asks of you
- Scope: decide this before anything else
- The five controls, one by one
- How the assessment works
- Cyber Essentials Plus: what changes
- Is Cyber Essentials mandatory?
- Cyber Essentials, ISO 27001 and SOC 2
- A practical readiness plan
- Where multi-location businesses trip up
- Our perspective
- How we can help
- FAQ
- Sources
What Cyber Essentials actually asks of you
Cyber Essentials is a UK government-backed scheme built around five technical controls. They are designed to stop the common internet-based attacks that need little skill to run: opportunistic scanning, password guessing, commodity malware and unpatched software.
The authoritative text is the NCSC’s Requirements for IT Infrastructure v3.3. Search results and summaries often quote older versions, so work from this document. Requirements are reviewed regularly, and a certificate is judged against the version in force when you apply.
The scheme sets outcomes. It does not set products. You do not need a particular firewall brand or antivirus vendor. You need to prove that each control is working on every device and service in scope.
Scope: decide this before anything else
Scope is where most applications are won or lost. The NCSC says the assessment should cover the whole IT infrastructure used for your business, or a well-defined and separately managed subset where that is genuinely necessary.
In practice, you define the business unit that manages the infrastructure, its network boundary and its physical location. You then agree that scope with your Certification Body.
What counts as a device
The v3.3 definition is broad. It includes networking equipment, servers and end-user devices such as desktops, laptops, thin clients, tablets and smartphones, whether physical or virtual. Phones that read company email are in scope. So are virtual desktops and cloud-hosted servers.
Cloud services cannot be carved out
All cloud services that host your organisational data or services must be included. You remain responsible for making sure the controls are implemented, including for user accounts, third-party accounts and cloud services. Responsibility for some controls can be shared with the provider, depending on whether the service is IaaS, PaaS or SaaS. The applicant stays accountable either way.
That matters for multi-site and multi-cloud firms, where nobody can say with confidence which settings the provider owns and which you own. Our guide to the cloud shared responsibility model sets out who secures what at each service level, which is the question your answers must reflect.
A scoping checklist
- List every site, office and remote-working location where company devices are used.
- Inventory laptops, desktops, servers, tablets and smartphones, including virtual machines.
- List every cloud and SaaS service that holds company data, and who administers each.
- Identify every internet-facing firewall or router, including those at home-working sites if they are part of your boundary.
- Note third-party and contractor accounts that reach your systems.
- If you propose a subset, be ready to show how it is separately managed and segregated from everything else.
The five controls, one by one
The research summary of v3.3 is simple: correctly configured firewalls, removal of insecure defaults, supported and patched software, controlled least-privilege accounts, and malware protection. The detail below shows what an assessor will look for.
1. Firewalls
Every in-scope boundary needs a firewall: a hardware device at the network edge, or the host firewall on devices that leave the office. Typical requirements include:
- Changing default administrative passwords, or disabling remote administration.
- Restricting internet access to the management interface unless there is a justified, protected reason for it.
- Blocking unauthenticated inbound connections by default.
- Documenting and approving every inbound rule, and removing rules that are no longer needed.
These points follow the firewall requirements as summarised by one UK practitioner. Check the exact wording in the NCSC document. The usual failure is a forgotten rule opened for a supplier years ago and never reviewed.
2. Secure configuration
Devices and services must be set up to reduce vulnerability. That means removing or disabling unnecessary user accounts, changing default or guessable passwords, removing unnecessary software and services, and disabling autorun so that nothing executes without user authorisation. The same summary covers these points.
Passwords are the visible part of this control. If your policy needs a rewrite, these strong password rules for organisations are a useful benchmark for minimum length and handling. Remember that for cloud services, a good password is not enough on its own: MFA is required.
3. Security update management
All in-scope software must be licensed and supported. Fixes for high and critical vulnerabilities must be applied within 14 days of release. In practice that means a patching process with records. Unsupported operating systems and end-of-life firmware on routers are common causes of failure. If a device cannot be patched, it either leaves the scope in a controlled way or gets replaced.
4. User access control
Accounts must be controlled: created only with proper approval, given the least privilege needed, and removed when no longer required. Administrator accounts are kept separate from everyday accounts, so that nobody browses the web or reads email with admin rights. Multi-factor authentication is required for cloud services wherever it is available.
The usual gaps are shared accounts, leaver accounts left active, and admin rights granted to whole teams for convenience.
5. Malware protection
Each in-scope device needs protection that prevents or limits malware execution. Anti-malware software, application allow-listing and sandboxing are the recognised approaches. What matters is that the protection is switched on, current and actually configured, not merely installed.
How the assessment works
Cyber Essentials is self-assessment, but not self-certification. GOV.UK describes it as a questionnaire that an independent Certification Body verifies before the certificate is awarded.
The NCSC sets out two routes. On the self-led route you register through IASME, pay, and complete the verified self-assessment. A board member or equivalent signs off the answers, and an assessor then marks them. Or you can use a licensed Certification Body for support. The NCSC also offers a free question set to prepare with.
The sign-off matters. A director is putting their name to statements about every device and cloud service. That is a good reason to build the evidence first and answer second.
Answering well
- Answer from evidence, such as exports from your device management tool and screenshots of firewall and MFA settings, not from memory.
- Keep the scope description consistent with your answers. An assessor who sees a laptop count that does not match your user count will ask why.
- Treat “not applicable” with care. It needs a reason that holds up.
- Write down the owner of each control so the answers can be repeated next year.
Cyber Essentials Plus: what changes
Plus uses the same five controls and adds a technical audit. After you pass Cyber Essentials, you agree the audit scope with your Certification Body. The audit includes scans of each public IP address in scope and testing of representative devices, including each operating-system type. It checks software updates, malware protection, account separation and MFA for in-scope cloud services. The audit must be completed within three months of your most recent Cyber Essentials certification, and every required test must pass.
The tests are practical. According to the same guidance, they confirm that supported software is current, that high and critical fixes were applied within 14 days, that malware protection is configured correctly, that standard users cannot perform administrator tasks, and that MFA is used for cloud access.
The IASME test specification adds process requirements. They include written permission to test, confirmation that the Plus scope matches the valid Cyber Essentials certificate, technical verification of scope and segregation for any subset, identification of samples and timing, and retention of verification evidence for at least the life of the certificate.
| Cyber Essentials | Cyber Essentials Plus | |
|---|---|---|
| Controls | Five technical controls | The same five controls |
| Method | Verified self-assessment, signed by a board member or equivalent | Technical audit including external scans and device sampling |
| Prerequisite | None | A valid Cyber Essentials certificate, with the audit within three months of it |
| Evidence | Your answers | Tested results on your real systems |
| Best when | You need a baseline | A customer or contract wants independent testing |
The jump from one to the other is not new controls but proof. If your answers on paper were optimistic, Plus will show it. A pre-audit technical check, such as a vulnerability scan or an IT security audit, is the cheapest way to find that out first.
Is Cyber Essentials mandatory?
Not for every business. PPN 014 says the scheme is not automatically required for every UK organisation or every public contract. It applies to central-government departments, executive agencies, non-departmental public bodies and NHS bodies procuring higher-risk contracts with relevant data, systems or government-business characteristics.
When it applies, the contracting body must apply effective and proportionate cyber-security controls. Cyber Essentials or Plus is one way to meet them, and equivalent controls must also be accepted. Where certification is required, it must be renewed annually for the length of the contract, and evidence is needed before the contract is awarded.
For private-sector firms the pressure is commercial. Financial services, law firms, healthcare suppliers and retailers often find that a client’s security questionnaire or tender asks for the certificate. The practical point: start early. Evidence is requested before award, so a certificate you do not hold yet can cost you the bid.
Cyber Essentials, ISO 27001 and SOC 2
Cyber Essentials is a defined baseline of five technical controls. ISO 27001 and SOC 2 are broader assurance frameworks. Many firms use Cyber Essentials as a first step and then add a broader framework as customer demands grow. Our comparison of Cyber Essentials, ISO 27001 and SOC 2 explains how to choose between them for a multi-location business.
A practical readiness plan
- Agree scope. Use the checklist above and write it down. Settle it with your Certification Body before you answer questions.
- Inventory and patch. Get a full device list and bring everything onto supported software. Clear high and critical fixes inside 14 days.
- Clean up accounts. Remove leavers and unused accounts, split admin from daily accounts, and turn on MFA for every cloud service that offers it.
- Review the perimeter. Check every inbound firewall rule, remove the ones with no owner, and change defaults.
- Confirm malware protection. Make sure it is on, updating and configured on every device type.
- Test before you submit. An independent technical check will find what the assessor would. For anything exposed to the internet, penetration testing scope is worth settling early, particularly where cloud services sit outside the main network.
- Get sign-off. The board member or equivalent signs only once the evidence exists.
- Diarise renewal. Certification runs on an annual cycle where contracts require it, so make the controls business as usual.
Where multi-location businesses trip up
The controls themselves are not hard. Doing them consistently across offices, countries, contractors and cloud tenants is. Three patterns come up again and again.
- Shadow cloud. A team signs up for a SaaS tool, which is then in scope but not in your inventory.
- Uneven patching. The head office is current while a branch router runs firmware years out of support.
- Inherited accounts. Third-party and legacy accounts carry admin rights nobody remembers granting.
Each of these is an operations problem. Continuous visibility, through vulnerability management and monitoring, is what turns a one-off certificate into a standing control.
Our perspective
We treat Cyber Essentials as a floor, not a finish line. The five controls are sensible, and a business that meets them has removed the easy routes in for an attacker. But a certificate is a snapshot. The risk for a multi-location business is the months between assessments, when a new office, a new SaaS tool or a delayed patch quietly takes you out of line.
That is why we pair the scheme’s controls with ongoing visibility. Vulnerability management shows you where patching has slipped. An IT security audit gives you findings in plain language and a roadmap you can act on, rather than a generic checklist. Managed SOC and SIEM services watch the environment between assessments, so an incident is spotted and handled quickly.
Our approach is to adapt support to each client’s operations and industry, and to scale as the organisation grows. If you are preparing for Cyber Essentials or Plus, start from the evidence, not the form.
Shirish
How we can help
If you are preparing for certification across several sites or cloud environments, our IT security audit reviews your position against what the assessor will look for and gives you a clear roadmap of what to fix. Our vulnerability management services help you keep patching and configuration under control once you are certified. For a broader view of our support for global businesses, see Zero Through.
For an independent view of your internet-facing systems before a Plus audit, our penetration testing shows how an attacker would see you.
FAQ
What is Cyber Essentials?
It is the UK Government’s minimum recommended cyber-security standard, aligned to five technical controls that prevent common internet-based attacks. It suits organisations of any size. You show you meet it through a verified self-assessment, or through the Plus audit for independent testing.
What is the difference between Cyber Essentials and Cyber Essentials Plus?
Both cover the same five controls. Cyber Essentials relies on a questionnaire signed by a board member and checked by an assessor. Plus adds a technical audit with external scans and sampled device testing, which must happen within three months of your Cyber Essentials certification.
Do I need Cyber Essentials to bid for government contracts?
Only for certain higher-risk contracts. PPN 014 applies to central government bodies and NHS bodies, and equivalent controls must also be accepted. Where certification is required, you must renew it annually for the contract term and show evidence before award.
Can I leave cloud services out of scope?
No. Cloud services that host your organisational data or services must be included. The provider may share responsibility for some controls, but you remain responsible for making sure all controls are implemented.
Which version of the requirements applies now?
Version 3.3 of the NCSC Requirements for IT Infrastructure has applied since 27 April 2026. Check the NCSC resources page before you apply, because requirements are reviewed and updated regularly.
Sources
- Cyber Essentials overview, NCSC
- Cyber Essentials help and resources, NCSC
- Cyber Essentials: Requirements for IT Infrastructure v3.3, NCSC
- Cyber Essentials Requirements for IT Infrastructure v3.3 (document library), NCSC
- PPN 014: Cyber Essentials scheme, GOV.UK
- How to certify to Cyber Essentials Plus, IASME
- Cyber Essentials Plus Test Specification v3.2, IASME
- The five Cyber Essentials technical controls
- 7 strong password rules for organizations
