SecurityEurope & UK

Cyber Essentials

Get the basics organised before your assessment

Bring baseline security tasks and evidence together as you prepare for Cyber Essentials.

Full name
Cyber Essentials and Cyber Essentials Plus, a UK government-backed certification scheme
Issued by
UK National Cyber Security Centre (NCSC), with IASME as the Cyber Essentials Delivery Partner
Current requirements
Requirements for IT Infrastructure v3.3 and the Danzell question set, effective 27 April 2026
Levels
Cyber Essentials: verified self-assessment. Cyber Essentials Plus: the same controls, plus independent technical testing.
Nature
Voluntary certification. Required by many UK public sector contracts.
Validity
Certificates expire after 12 months and must be renewed against the requirements then in force

Overview

What Cyber Essentials is

Cyber Essentials is the UK government’s recommended minimum standard of cyber security for organisations of all sizes. It was developed by the NCSC and focuses on protection against the most common internet-based attacks, the kind an opportunist attacker carries out with widely available tools and low skill. It does not try to cover every risk. It sets a clear baseline in five technical control themes: firewalls, secure configuration, security update management, user access control and malware protection.

There are two levels. Cyber Essentials is a verified self-assessment: the organisation answers an online question set, a board member or equivalent signs a declaration that the answers are true, and an assessor at a Certification Body marks it. Cyber Essentials Plus uses exactly the same controls but adds a technical audit, in which an assessor scans and tests a sample of the in-scope devices, all internet gateways and the cloud services in scope.

IASME is the NCSC’s Delivery Partner for the scheme and licenses a network of Certification Bodies across the UK. The requirements are updated each April. The current document is Requirements for IT Infrastructure v3.3, used with the Danzell question set, effective from 27 April 2026. It replaced v3.2 and the Willow question set, covered on the Cyber Essentials v3.2 page. Accounts created before 27 April 2026 have six months from that date to certify under the previous version.

The v3.3 update makes the scheme stricter in practice. Cloud services that hold or process organisational data cannot be excluded from scope, multi-factor authentication on cloud services is required wherever it is available, and failing to use it, or failing to apply high and critical updates within 14 days, now leads to automatic failure. The board declaration also commits the organisation to maintaining compliance throughout the certification period, not just on the day of assessment.

Who it applies to

Any organisation, of any size and in any sector, can certify. It is most often asked of:

  • Suppliers to UK central government departments, their agencies, non-departmental public bodies and NHS bodies, where contracts handle personal information or provide ICT systems
  • Suppliers in the UK Ministry of Defence supply chain that handle defence information
  • UK small and medium-sized businesses that want a recognised baseline and the cyber liability insurance that comes with whole-organisation certification
  • Managed service providers and IT suppliers whose UK customers ask for it in due diligence
  • Organisations outside the UK, including Indian IT and services firms, whose UK public sector or enterprise customers ask for it

Cyber Essentials is not a legal requirement in general. Under Procurement Policy Note 014, central government buyers must ensure suppliers on certain contracts meet its technical requirements, either through certification or by showing equivalent controls.

Structure

How the scheme is organised

The scheme rests on one requirements document, a question set that applies it, and a test specification for Plus. The five control themes are the same at both levels.

Scope

Deciding what is assessed

Whole organisation or sub-set
Scope covers the whole IT infrastructure, or a separately managed sub-set segregated by a firewall or VLAN. Whole-organisation scope is recommended, and exclusions must be justified to the assessor.
Devices and accounts
Devices that can make or accept connections over the internet are in scope, including servers, end-user devices, network devices, and accounts used by suppliers or managed service providers. A scope that excludes end-user devices is not acceptable.
Cloud services
Cloud services that hold or process organisational data are always in scope. The organisation remains responsible for the controls, even where an IaaS, PaaS or SaaS provider implements some of them.
BYOD and remote working
User-owned devices that access organisational data or services are in scope. Home and remote working devices are in scope. Routers not supplied by the organisation are out of scope, so the devices need software firewalls.
Control 1

Firewalls

Every in-scope device is protected by a correctly configured firewall or a network device with firewall functions. Default administrative passwords are changed, administrative interfaces are not exposed to the internet without a documented need and MFA or an IP allow list, unauthenticated inbound connections are blocked by default, and inbound rules are approved, documented and removed when no longer needed.

Control 2

Secure configuration

Unnecessary accounts, software and services are removed or disabled, default passwords are changed, and auto-run is disabled. Users are authenticated before accessing organisational data. Devices are locked with a biometric, password or PIN, protected against brute-force guessing, with a minimum of six characters where the credential only unlocks the device.

Control 3

Security update management

All in-scope software is licensed and supported, and unsupported software is removed or isolated. Automatic updates are enabled where possible. Updates that fix vulnerabilities the vendor rates critical or high risk, or with a CVSS v3 base score of 7 or above, or with no severity given, are applied within 14 days of release.

Control 4

User access control

Accounts are created through an approval process, use unique credentials, and are removed or disabled when no longer needed. Administrative accounts are separate and not used for email or browsing. MFA is used wherever available and always for cloud services. Passwords are protected against brute force and meet minimum length rules, and passwordless methods such as FIDO2 authenticators and passkeys are recognised.

Control 5

Malware protection

Every in-scope device runs an active malware protection mechanism: anti-malware software that is kept updated, prevents malicious code from running and blocks malicious websites, or application allow listing where only approved, validly signed applications can run.

Plus

Cyber Essentials Plus technical tests

Remote vulnerability assessment
An external scan of the applicant’s internet-facing IP addresses for weaknesses an opportunist attacker could exploit.
Patching check
An authenticated vulnerability scan of sampled devices for missing fixes older than 14 days.
Malware protection check
Tests that anti-malware or application allow listing works on sampled devices.
MFA check
The assessor observes sign-in to each cloud service from an untrusted device to confirm MFA is enforced.
Account separation check
Confirms that standard user accounts cannot run administrative processes without further authentication.

Implementation roadmap

How to implement it, step by step

A typical route to a first Cyber Essentials certificate, and on to Plus. A small, well-managed organisation can move quickly; the time depends on how much of the estate needs work.

  1. 1

    Choose the level and the route

    Decide between Cyber Essentials and Plus, often guided by a contract or a customer. Choose to self-lead through IASME or to work with a licensed Certification Body.

    OutputsTarget levelCertification route
  2. 2

    Define the scope

    Agree whether to certify the whole organisation or a segregated sub-set, and record every legal entity, location and network in scope. Remember that cloud services cannot be excluded.

    OutputsScope statementLegal entity list
  3. 3

    Build the inventory

    List end-user devices, servers, network devices, cloud services, BYOD devices and operating systems in scope, with versions, so that support status and updates can be checked.

    OutputsDevice and software inventoryCloud service list
  4. 4

    Check against the five controls

    Preview the question set and compare the estate with each control. Record every gap with an owner, especially unsupported software, missing MFA on cloud services and late updates.

    OutputsGap listRemediation plan
  5. 5

    Remediate

    Close the gaps: enable MFA, turn on automatic updates, remove unsupported software, separate administrative accounts, tighten firewall rules and confirm malware protection on every device.

    OutputsConfiguration evidenceUpdate records
  6. 6

    Complete the self-assessment

    Answer the question set accurately and have a board member or equivalent sign the declaration. The assessor marks the answers and may ask for clarification.

    OutputsSubmitted question setSigned declaration
  7. 7

    Arrange Plus testing, if required

    Book the technical audit within three months of the self-assessment certificate. The self-assessment must be finalised and unchanged before testing starts.

    OutputsSample planTest results
  8. 8

    Maintain and renew

    Keep the controls working throughout the year, since the declaration now commits the organisation to that. Renew before the 12-month expiry, answering the question set again against the requirements then in force.

    OutputsRenewal planOngoing evidence

Audit and evidence guide

What auditors look for, and the evidence to keep

Cyber Essentials is assessed by an assessor at a Certification Body licensed by IASME. The self-assessment is marked on the answers given. Plus adds an independent technical audit of the same controls.

The certification cycle

  1. Step 1

    Register and answer the question set

    The organisation registers through IASME, alone or with a Certification Body, and completes the question set for the agreed scope.

  2. Step 2

    Declaration and marking

    A board member or equivalent signs that the answers are true. An assessor marks the submission, and some answers, such as missing MFA on cloud services or late updates, now lead to automatic failure.

  3. Step 3

    Certificate issued

    The certificate is issued and listed. The point in time for the assessment is the date the certificate is issued, so systems must be supported on that date.

  4. Step 4

    Plus technical audit

    Within three months, an assessor tests a sample of devices, all internet gateways and every cloud service in scope. A failed update sample must be remediated and retested, and a second failure leads to revocation of the self-assessment certificate.

  5. Step 5

    Annual renewal

    Both certificates expire after 12 months. The organisation reassesses against the current requirements to stay certified.

What reviewers look for

  • A scope that matches the real estate, with every legal entity and cloud service listed
  • MFA enforced on every cloud service where it is available
  • High and critical updates applied within 14 days across operating systems, firmware and applications
  • No unsupported operating systems or applications in scope
  • Separate administrative accounts not used for email or browsing
  • Default passwords changed and unnecessary accounts and software removed
  • Firewall rules approved, documented and reviewed
  • Malware protection active on every in-scope device
  • Leavers’ accounts removed promptly and access reviewed

Key timelines

Certificate validity (both levels)12 months
High and critical updates appliedWithin 14 days of release
Plus audit after self-assessmentWithin 3 months
Requirements v3.3 and Danzell effective27 April 2026
Accounts created before 27 April 20266 months under v3.2
Requirements updates take effectTypically in April

Evidence to keep, by area

Examples to guide your evidence library. Your auditor or regulator decides what is sufficient.

Scope

  • Scope statement and network diagram
  • Legal entities in scope
  • Justification for exclusions

Inventory

  • Device and operating system list
  • Cloud service list
  • BYOD register
  • Software support status

Firewalls and configuration

  • Firewall rule approvals
  • Admin interface settings
  • Hardening and device lock settings

Updates

  • Automatic update settings
  • Patch reports
  • Removal of unsupported software

Access

  • MFA settings for each cloud service
  • Account approval process
  • Admin account list
  • Leaver records

Malware protection

  • Anti-malware coverage report
  • Allow list policy where used

Areas that often need attention

  • Cloud services left out of scope or without MFA
  • An unsupported operating system or browser still in use on a single device
  • Updates applied in more than 14 days, especially for firmware and applications
  • Administrators using their admin accounts for day-to-day work
  • BYOD devices that access email but were not counted in scope
  • Firewall rules with no recorded business need
  • Controls in place on the assessment day but allowed to lapse afterwards

How Netra helps

Where each part of the work lives in Netra

Netra loads Cyber Essentials as requirements and tasks, so the five controls are owned, evidenced and kept current through the year. Work done here also counts towards frameworks such as ISO 27001:2022 (Requirements) wherever the same control applies.

Each control owned and tracked

Task Engine

Requirements arrive as tasks with owners and due dates. Recurring tasks for update checks, access reviews and firewall rule reviews keep evidence current between renewals.

Readiness against each control theme

Compliance Centre

Status is derived from completed tasks and evidence, never typed in, so gaps are visible before the question set is answered.

Device, software and cloud inventory

Asset Management

Assets are linked to the tasks that cover them, so it is clear which devices and cloud services have evidence for each control.

Supporting policies

Policy Hub

A policy library generated at onboarding, covering areas such as access control and patching, with a policy score.

Readiness reviews and Plus preparation

Audit Centre

Run an internal readiness audit with findings and corrective actions, using evidence held in a tamper-evident vault.

Missing evidence

Netra AI

Works from the organisation’s own records to suggest evidence that is missing and draft SOPs. It never changes status on its own.

MSPs managing many clients

Partner Portal

MSSPs and vCISOs see every client’s readiness from one login.

Netra organises the work and evidence for Cyber Essentials. It is not a Certification Body, does not award certificates, does not run the Plus vulnerability scans or technical tests, and does not by itself establish that an organisation meets the scheme. Confirm with your Certification Body which requirements version applies to your assessment.

Common questions

More questions about Netra

Related frameworks

View all frameworks
Security

Cyber Essentials v3.2

Keep your v3.2 readiness work easy to review

Security

CIS v8.1

Give your security safeguards a clear operational home

Security

NCSC CAF v3.2

Make resilience outcomes easier to assess and evidence

See Cyber Essentials in Netra

See how Netra connects your framework requirements with tasks, evidence and audit follow-up.