Cyber Essentials FAQs: Your 2026 Questions Answered

What changes were included in the April 2026 update?

Cyber Essentials – key changes

Stricter marking requirements

Stricter marking has been introduced for key security controls, including multi-factor authentication (MFA) and security updates. Failure to meet these requirements will result in an automatic assessment failure.

Multi-factor authentication (MFA)

Where MFA or single sign-on (SSO) is available for a cloud service, it must be enabled. If MFA is available but not enabled, the assessment will automatically fail.

Security updates

Organisations must install all high-risk or critical security updates for operating systems, firewalls, routers and applications within 14 days of release. Failure to meet this requirement will result in an automatic assessment failure.

Improved scope definition and certification transparency

The scope section of the questionnaire has been redesigned to provide more flexibility and clarity. Changes include unlimited space to describe the scope, a dedicated section for out-of-scope systems, and support for organisations requiring certificates covering multiple legal entities.

Cyber Essentials Plus – key changes

Verification of security updates across the organisation

IASME has strengthened testing requirements to ensure security updates are applied consistently across the organisation, not just on the devices selected for testing.

If vulnerabilities are found on the initial sample of devices, they must be remediated. A second sample of devices will then be selected. If the same vulnerabilities are found on the second sample, the Cyber Essentials Plus assessment will be recorded as a failure. (New vulnerabilities will be raised as an advisory.)

What is Cyber Essentials?

Cyber Essentials is the UK Government-backed cyber security certification scheme for organisations of all sizes. It is a cost-effective, annually renewable certification based on five technical controls designed to help protect against common internet-based cyber threats.

Why should we get a Cyber Essentials certificate?

• Protection against cyber-attacks: Implementing the five Cyber Essentials controls helps protect against the majority of common cyber-attacks.
• Business opportunities: Certification can help you win new business and may be required for some public sector and government contracts.
• Supply chain assurance: Independent certification demonstrates your commitment to cyber security and provides assurance to customers, partners and suppliers.
• Cyber liability insurance: UK organisations with an annual turnover of less than £20 million and certification covering the whole organisation may be eligible to opt in to cyber liability insurance.

How much does it cost for basic level Cyber Essentials?

The cost of Basic Cyber Essentials depends on the size of your organisation. IASME certification fees start from £320 + VAT for micro-organisations. Our prices start from £420 + VAT, which includes both the IASME certification fee and the assessment services we provide.

What is required for Cyber Essentials certification?

To achieve Cyber Essentials certification, your organisation must complete the IASME Self-Assessment Questionnaire (SAQ). The completed questionnaire must be approved and signed by a board member or other authorised representative of the applicant organisation. The declaration cannot be signed by a third-party supplier such as a managed service provider (MSP). The questionnaire is then independently reviewed by a licensed certification body.

What is required for Cyber Essentials Plus certification?

Cyber Essentials Plus builds on Cyber Essentials and includes a technical audit of the systems within the certification scope. This includes internal and external vulnerability scans, together with remote or on-site testing carried out by the certification body.

Who conducts the assessments for Cyber Essentials and Cyber Essentials Plus?

Only certification bodies licensed by IASME can assess organisations and issue Cyber Essentials and Cyber Essentials Plus certificates. IT Governance (a GRC Solutions company) is one of the founding certification bodies for the scheme, with a team of highly experienced assessors, fast turnaround times and a long track record of delivering Cyber Essentials certifications across organisations of all sizes and sectors.

How long does it take to receive our certificate after submitting the SAQ?

We offer fast turnaround times and short lead times. Cyber Essentials SAQs can usually be assessed on the same day they are submitted, helping organisations achieve certification as quickly as possible.

For Cyber Essentials Plus, additional time is required for the technical testing and vulnerability scans to be completed. We can usually schedule audits within one to two weeks.

What can we expect from the Cyber Essentials application process?

Your Cyber Essentials application is managed through our Cyber Security Portal (CS Portal).

• Consultancy support: if you have purchased a support package, we will email you the details needed to access your support services.
• Account setup: your Cyber Essentials package will be automatically available within your account on the CS Portal.
• Login and confirm your details: log in to the CS Portal and confirm your organisation’s details.
• Scope definition and SAQ completion: define your scope and complete the SAQ.
• Approval and declaration: the completed questionnaire must be approved and signed by an authorised representative of the applicant organisation, such as a board member, director or partner.
• Assessment and feedback: our assessors will review your submission and provide feedback.

If you pass

• Download your certificate, feedback report and insurance documents (where applicable) from BlockMark, the platform used to manage and verify digital certifications. Your certification will be valid for 12 months.

If you fail or we need more information

• Review the feedback provided by your assessor.
• If you have purchased consultancy support, our experts can help you address any areas that are not compliant.
• Update your SAQ and resubmit it, together with a signed declaration, within two working days.

For Cyber Essentials Plus, additional testing is carried out on the in-scope devices and networks. This testing must be completed within three months of achieving Cyber Essentials certification.

Your application must be completed within six months of purchase.

Where can we display our Cyber Essentials certificate?

Guidance on using the Cyber Essentials certification badge is available through BlockMark. This includes information on displaying the badge on your website, marketing materials, letterheads and email signatures.

How do we renew our Cyber Essentials certificate?

Cyber Essentials certification is valid for 12 months. To remain certified, organisations must complete the certification process each year. Annual recertification helps demonstrate that your cyber security controls remain effective and up to date against common cyber threats.

Our Cyber Essentials and Cyber Essentials Plus packages are annual subscription services that automatically renew in accordance with our terms and conditions. If you do not have an active subscription, you will need to purchase a new package to recertify.

If you do not renew your certification, your organisation will no longer be certified under the Cyber Essentials scheme. You may no longer be eligible to bid for contracts that require a valid Cyber Essentials certificate, and your organisation will be removed from the IASME directory of certified organisations once your certificate expires.

What is included in Cyber Essentials Certification?

Cyber Essentials Certification includes completion of the Self-Assessment Questionnaire (SAQ) and independent assessment by a licensed certification body.

This package is ideal for organisations certifying the whole organisation and those with a good understanding of the five Cyber Essentials security controls. It is intended for organisations that do not require additional consultancy support.

Our Cyber Essentials packages include the cost of your certification, as set out by IASME. Additional charges are for extra services delivered. You will be allocated your own dedicated cyber security consultant, and general guidance will be provided.

If you require additional help with your application, we recommend one of the following support options:

• Get A Little Help: includes two hours of consultancy support.
• Get A Lot Of Help: includes one full day of consultancy support.
• Remote Consultancy Support: flexible consultancy support available by the hour via the CS Portal, email or Microsoft Teams.

Whichever option you choose, please ensure you select the correct package for your organisation’s size: this must reflect the total number of employees across the entire organisation, regardless of the certification scope.

Defining the scope

The scope defines which parts of your organisation’s IT environment are included in the certification. The simplest option is to certify the whole organisation.

If only part of the organisation is being certified, the scope must be based on network boundaries and the systems connected to them. It cannot be defined by locations, departments, products or people. Cyber Essentials requires a clear technical definition of what is included and excluded from the assessment.

How do we determine which IP addresses need to be tested for Cyber Essentials Plus?

Cyber Essentials Plus requires all in-scope internet-facing systems and services managed by your organisation to be included in the external vulnerability scan. These systems are identified using their public IP addresses.

If you are unsure which IP addresses need to be included, our Remote Consultancy Support service can help you determine the correct scope.

What should we do if we have more than 20 IP addresses?

Our Cyber Essentials Plus packages include an external vulnerability scan for up to 20 IP addresses. If your organisation has more than 20 IP addresses that need to be tested, additional IP address scanning can be purchased.

How do we determine how many workstations, mobile devices and build types need to be tested for Cyber Essentials Plus?

Cyber Essentials Plus includes testing of a representative sample of the devices and systems within your certification scope. This may include desktops, laptops, tablets, smartphones, servers and cloud-hosted systems.

The number of devices tested depends on the operating systems, versions and build types used within your organisation.

The assessor must randomly select the devices to be tested.

What should we do if we have more than ten sample devices?

Our Cyber Essentials Plus packages include testing for up to ten sample devices. If more than ten devices need to be tested to meet the scheme’s sampling requirements, additional device testing must be purchased.

Should we apply for Cyber Essentials certification in addition to our ISO 27001 certification?

Yes. Cyber Essentials and ISO 27001 are complementary certifications and many organisations choose to achieve both.

• Foundation for cyber security: Cyber Essentials focuses on five key technical controls that help protect against common cyber attacks and can provide a strong foundation for an organisation’s wider security programme.
• Independent technical testing: Cyber Essentials Plus includes hands-on technical testing of your systems and security controls, providing additional assurance that they are operating effectively.
• Customer and contract requirements: many private sector, public sector and government organisations require suppliers to hold Cyber Essentials or Cyber Essentials Plus certification.
• Demonstrates cyber security commitment: holding both Cyber Essentials and ISO 27001 can provide customers, suppliers and other stakeholders with greater confidence in your organisation’s approach to cyber security.

Together, the certifications provide both technical security controls and a comprehensive information security management system.

What happens if we fail Cyber Essentials Plus?

If Cyber Essentials Plus is failed, IASME will revoke the underlying Cyber Essentials certificate. To re-certify, you must complete Cyber Essentials again and then book a new Plus assessment based on that submission.

If we fail both device samples in Cyber Essentials Plus, will our certificate be cancelled?

Yes. If the second device sample fails, the overall Plus assessment fails and IASME will revoke the Cyber Essentials certificate.

If the same critical vulnerability appears in the second scan, do we get time to fix it?

No. If the same high or critical vulnerability from the first scan is found again in the second scan, the assessment will fail immediately. There is no remediation window for the second sample.

If the second scan finds different vulnerabilities, do we still fail?

No. If new vulnerabilities are found in the second scan but the original ones were fixed, the assessment can still pass. Any new issues would be listed as advisories.

Is the 14-day patching rule a hard requirement?

Yes. High-risk and critical patches must be applied within 14 days of release. Missing this deadline results in an automatic failure of Cyber Essentials.

What if applying a critical patch would break business-critical software?

In that scenario, the affected system must be isolated from the Internet, placed on a restricted subnet and have no inbound or outbound connectivity. This is the only acceptable mitigation.

What if we don’t have vulnerability scanning software?

At a minimum, you must have automated patch management in place to meet the 14-day requirement. Without vulnerability scanning, it’s unlikely that a clean Plus scan will be achieved.

Can we use our existing vulnerability tools like Qualys during a Cyber Essentials Plus audit?

Yes. If you already use an approved scanning tool, reports may be accepted and the Cyber Essentials Plus assessor may ask to see the platform live rather than installing a separate scanning agent.

How are dependency vulnerabilities such as OpenSSL issues handled?

If the dependency is required by a fully supported application and cannot be patched directly, it may be excluded. You will need to declare this using the required IASME documentation.

Is MFA (multifactor authentication) mandatory for all Cloud services?

Yes. If MFA is available, it must be enabled. This applies even if MFA or SSO (single sign-on) is only available on a higher paid licence tier.

Is the cost of licensing still a valid reason for not enabling MFA or SSO?

No. Cost is no longer an acceptable reason. If MFA or SSO is available, it must be enabled.

Is single sign-on mandatory?

No. SSO itself is not mandatory. However, if a Cloud service doesn’t offer MFA but does support SSO with a provider such as Microsoft or Google, SSO must be used.

What if MFA is available but can’t be enforced by policy?

MFA must still be enabled. If enforcement is not possible, organisations must manually check and confirm that all users have enabled MFA.

Is SMS still an acceptable MFA method?

Yes. SMS remains an acceptable form of MFA under the current version of Cyber Essentials.

Are on-premises systems required to use MFA?

Only if the system can be accessed from outside the network. Internal-only systems do not require MFA.

How should MFA and SSO be evidenced during a Plus assessment?

Cyber Essentials Plus assessors prefer to see MFA working in practice. If SSO is used and MFA is not prompted, conditional access policies may be reviewed to confirm enforcement.

Are all Cloud services that store business data in scope?

Yes. Any Cloud service that stores or processes business data is in scope.

How should we handle shadow IT such as marketing using Canva or Mailchimp?

Where possible, services should be managed centrally using SSO. If that’s not possible, regular access and MFA reviews must be carried out on those services.

Are services without MFA still allowed?

Yes, but only if MFA is genuinely unavailable either natively or through SSO. This must be declared in the self-assessment.Devices, BYOD, contractors and VDI

How are BYOD (bring your own device) and contractor-owned devices treated?

If a device is used to access business data, it is in scope. This includes devices accessing data via VDI (virtual desktop infrastructure) or virtual machines.

Is web-only access with MFA enough for contractors?

No. If the endpoint device accesses organisational data, both the device and the VDI or virtual machine environment are in scope.

How can BYOD mobile devices be managed securely?

Mobile work profiles can be used to separate work and personal data. This allows policies to be applied to work data without managing the entire device.

Can a software firewall be used as the network boundary?

Yes, but only for home workers or shared office environments. In controlled office networks, the boundary must be defined using network firewalls or VLANs (virtual local area networks).

What if we use a serviced or hot-desk office where we do not control the network?

You can still pass Cyber Essentials Plus if each laptop has an enabled software firewall. In that setup, the device firewall becomes the boundary.

Are social media accounts like LinkedIn in scope?

Yes. Corporate social media accounts are always in scope, even if managed by a third party.

How is partial scope shown on the certificate?

Partial scope is clearly marked on the certificate. There is no longer a character limit on the scope description, allowing greater clarity.

Can subsidiaries or franchises certify independently?

Yes. Separate entities, including those with their own Microsoft tenant, can certify independently without exclusions if they operate separately.

Is Cyber Essentials still a point-in-time assessment?

The assessment is still conducted at a point in time, but directors now explicitly declare responsibility for maintaining controls throughout the year.

Will assessors check compliance during the year?

No. There are no interim checks between certifications. Compliance is self-declared and enforced at renewal.

How often should we review controls internally?

Quarterly reviews are recommended for access, MFA and assets. Patch management should be monitored weekly or daily because of the 14-day rule.

Has the standard Cyber Essentials questionnaire changed to require evidence uploads?

No. The standard Cyber Essentials assessment remains a text-only questionnaire. Evidence is only required for Plus.

Are passkeys and FIDO2 acceptable under Cyber Essentials?

Yes. Passwordless methods such as passkeys and FIDO2 are considered compliant forms of MFA.

How should password requirements be answered if we use MFA or passkeys?

Stating that MFA or passwordless authentication is used is a compliant response. Regular password expiry and complex rules are not required.

Has the sample selection or timing changed for Cyber Essentials Plus?

Yes. Details of random device sampling are now provided closer to the assessment start date, typically three days before.

Are internal pre-scans included in the first vulnerability scan?

IASME is still refining this process. Pre-scanning may be limited to onboarding devices rather than identifying vulnerabilities.

Do administrators need separate accounts?

Yes. Admin users must have separate accounts for administrative tasks and daily use. Shared admin accounts are not permitted.

Are extended security updates, such as Windows 10 ESU, acceptable?

Yes. As long as the vendor is still providing security updates, either free or paid, the device remains compliant.

Are there specific changes for AWS, Azure or Google Cloud?

No. Infrastructure and platform Cloud services must still meet the existing Cyber Essentials requirements and may be tested during Cyber Essentials Plus.

Is IASME improving consistency between assessors?

Moderation has increased and guidance is improving. However, different assessors may still interpret responses slightly differently as requirements evolve.