Understand the difference between Cyber Essentials and Cyber Essentials Plus, what the five technical controls require, and how to prepare for assessment.
Cyber Essentials is the UK government-backed certification scheme designed to protect organisations against the most common cyber attacks. It is a prerequisite for many UK government contracts and an increasingly common requirement in the private sector. This guide explains what it involves, how it differs from Cyber Essentials Plus, and how to prepare.
Cyber Essentials is a UK government-backed scheme, managed by the National Cyber Security Centre (NCSC) and delivered through accredited certification bodies. It focuses on five technical controls that, when properly implemented, protect against the vast majority of common cyber attacks.
The scheme has two levels: Cyber Essentials (self-assessment, verified by a certification body) and Cyber Essentials Plus (independent technical verification by an assessor). Both result in a certificate valid for 12 months.
Cyber Essentials certification is mandatory for UK government contracts involving the handling of certain personal data or the provision of some technical products and services. It is also required by many NHS and public sector organisations.
Cyber Essentials involves completing a self-assessment questionnaire covering the five technical controls. The questionnaire is reviewed and verified by a certification body. It is the faster and lower-cost option, typically achievable in 2 to 4 weeks.
Cyber Essentials Plus includes everything in Cyber Essentials, plus an independent technical assessment conducted by an accredited assessor. The assessor tests your systems against the five controls, including vulnerability scanning and simulated phishing tests. It provides stronger assurance and is required for higher-value government contracts.
Most organisations pursue Cyber Essentials first, then upgrade to Plus when required by a contract or when they want stronger assurance for customers.
The most common reason organisations fail Cyber Essentials is unsupported software, operating systems, applications, or firmware that no longer receive security updates. All software in scope must be supported and up to date.
Multi-factor authentication (MFA) is now required for all cloud services and remote access under the updated Cyber Essentials requirements. Many organisations fail because MFA is not consistently enforced across all accounts.
Firewall configuration is another common failure point. Default passwords must be changed, unnecessary services must be disabled, and inbound connections must be restricted to only those required for business purposes.
Boundary firewalls and internet gateways configured to block unauthorised inbound connections. Default passwords changed and unnecessary services disabled.
Devices and software configured securely, unnecessary software removed, default passwords changed, auto-run disabled.
User accounts with the minimum necessary privileges. Administrative accounts used only for administrative tasks. MFA required for cloud services.
Protection against malware, anti-malware software, application allowlisting, or sandboxing, depending on the risk profile.
All software kept up to date. High-risk patches applied within 14 days. Unsupported software removed from scope or replaced.
Define the scope of your assessment, which devices, software, and services are included.
Review your current configuration against the five controls and identify gaps requiring remediation.
Address identified gaps, update software, configure firewalls, enforce MFA, and remove unsupported systems.
Complete the Cyber Essentials questionnaire accurately and submit to your certification body.
The certification body reviews your submission. For Cyber Essentials Plus, an assessor conducts technical testing.
Receive your Cyber Essentials or Cyber Essentials Plus certificate, valid for 12 months.
Netru methodology