Cyber Essentials FAQs

What changes are included in the April 2026 update?

Cyber Essentials – key changes

Stricter marking requirements

Stricter marking has been introduced for key security controls, including multi-factor authentication (MFA) and security updates. Failure to meet these requirements will result in an automatic assessment failure.

Multi-factor authentication (MFA)

Where MFA or single sign-on (SSO) is available for a cloud service, it must be enabled. If MFA is available but not enabled, the assessment will automatically fail.

Security updates

Organisations must install all high-risk or critical security updates for operating systems, firewalls, routers and applications within 14 days of release. Failure to meet this requirement will result in an automatic assessment failure.

Improved scope definition and certification transparency

The scope section of the questionnaire has been redesigned to provide more flexibility and clarity. Changes include unlimited space to describe the scope, a dedicated section for out-of-scope systems, and support for organisations requiring certificates covering multiple legal entities.

Cyber Essentials Plus – key changes

Verification of security updates across the organisation

IASME has strengthened testing requirements to ensure security updates are applied consistently across the organisation, not just on the devices selected for testing.

If vulnerabilities are found on the initial sample of devices, they must be remediated. A second sample of devices will then be selected. If the same vulnerabilities are found on the second sample, the Cyber Essentials Plus assessment will be recorded as a failure. (New vulnerabilities will be raised as an advisory.)

What is Cyber Essentials?

Cyber Essentials is the UK Government-backed cyber security certification scheme for organisations of all sizes. It is a cost-effective, annually renewable certification based on five technical controls designed to help protect against common internet-based cyber threats.

Why should we get a Cyber Essentials certificate?

• Protection against cyber-attacks: Implementing the five Cyber Essentials controls helps protect against the majority of common cyber-attacks.
• Business opportunities: Certification can help you win new business and may be required for some public sector and government contracts.
• Supply chain assurance: Independent certification demonstrates your commitment to cyber security and provides assurance to customers, partners and suppliers.
• Cyber liability insurance: UK organisations with an annual turnover of less than £20 million and certification covering the whole organisation may be eligible to opt in to cyber liability insurance.

How much does it cost for basic level Cyber Essentials?

The cost of Basic Cyber Essentials depends on the size of your organisation. IASME certification fees start from £320 + VAT for micro-organisations. Our prices start from £420 + VAT, which includes both the IASME certification fee and the assessment services we provide.

What is required for Cyber Essentials certification?

To achieve Cyber Essentials certification, your organisation must complete the IASME Self-Assessment Questionnaire (SAQ). The completed questionnaire must be approved and signed by a board member or other authorised representative of the applicant organisation. The declaration cannot be signed by a third-party supplier such as a managed service provider (MSP). The questionnaire is then independently reviewed by a licensed certification body.

What is required for Cyber Essentials Plus certification?

Cyber Essentials Plus builds on Cyber Essentials and includes a technical audit of the systems within the certification scope. This includes internal and external vulnerability scans, together with remote or on-site testing carried out by the certification body.

Who conducts the assessments for Cyber Essentials and Cyber Essentials Plus?

Only certification bodies licensed by IASME can assess organisations and issue Cyber Essentials and Cyber Essentials Plus certificates. IT Governance (a GRC Solutions company) is one of the founding certification bodies for the scheme, with a team of highly experienced assessors, fast turnaround times and a long track record of delivering Cyber Essentials certifications across organisations of all sizes and sectors.

How long does it take to receive our certificate after submitting the SAQ?

We offer fast turnaround times and short lead times. Cyber Essentials SAQs can usually be assessed on the same day they are submitted, helping organisations achieve certification as quickly as possible.

For Cyber Essentials Plus, additional time is required for the technical testing and vulnerability scans to be completed. We can usually schedule audits within one to two weeks.

What can we expect from the Cyber Essentials application process?

Your Cyber Essentials application is managed through our Cyber Security Portal (CS Portal).

• Consultancy support: if you have purchased a support package, we will email you the details needed to access your support services.
• Account setup: your Cyber Essentials package will be automatically available within your account on the CS Portal.
• Login and confirm your details: log in to the CS Portal and confirm your organisation’s details.
• Scope definition and SAQ completion: define your scope and complete the SAQ.
• Approval and declaration: the completed questionnaire must be approved and signed by an authorised representative of the applicant organisation, such as a board member, director or partner.
• Assessment and feedback: our assessors will review your submission and provide feedback.

If you pass

• Download your certificate, feedback report and insurance documents (where applicable) from BlockMark, the platform used to manage and verify digital certifications. Your certification will be valid for 12 months.

If you fail or we need more information

• Review the feedback provided by your assessor.
• If you have purchased consultancy support, our experts can help you address any areas that are not compliant.
• Update your SAQ and resubmit it, together with a signed declaration, within two working days.

For Cyber Essentials Plus, additional testing is carried out on the in-scope devices and networks. This testing must be completed within three months of achieving Cyber Essentials certification.

Your application must be completed within six months of purchase.

Where can we display our Cyber Essentials certificate?

Guidance on using the Cyber Essentials certification badge is available through BlockMark. This includes information on displaying the badge on your website, marketing materials, letterheads and email signatures.

How do we renew our Cyber Essentials certificate?

Cyber Essentials certification is valid for 12 months. To remain certified, organisations must complete the certification process each year. Annual recertification helps demonstrate that your cyber security controls remain effective and up to date against common cyber threats.

Our Cyber Essentials and Cyber Essentials Plus packages are annual subscription services that automatically renew in accordance with our terms and conditions. If you do not have an active subscription, you will need to purchase a new package to recertify.

If you do not renew your certification, your organisation will no longer be certified under the Cyber Essentials scheme. You may no longer be eligible to bid for contracts that require a valid Cyber Essentials certificate, and your organisation will be removed from the IASME directory of certified organisations once your certificate expires.

What is included in Cyber Essentials Certification?

Cyber Essentials Certification includes completion of the Self-Assessment Questionnaire (SAQ) and independent assessment by a licensed certification body.

This package is ideal for organisations certifying the whole organisation and those with a good understanding of the five Cyber Essentials security controls. It is intended for organisations that do not require additional consultancy support.

Our Cyber Essentials packages include the cost of your certification, as set out by IASME. Additional charges are for extra services delivered. You will be allocated your own dedicated cyber security consultant, and general guidance will be provided.

If you require additional help with your application, we recommend one of the following support options:

• Get A Little Help: includes two hours of consultancy support.
• Get A Lot Of Help: includes one full day of consultancy support.
• Remote Consultancy Support: flexible consultancy support available by the hour via the CS Portal, email or Microsoft Teams.

Whichever option you choose, please ensure you select the correct package for your organisation’s size: this must reflect the total number of employees across the entire organisation, regardless of the certification scope.

Defining the scope

The scope defines which parts of your organisation’s IT environment are included in the certification. The simplest option is to certify the whole organisation.

If only part of the organisation is being certified, the scope must be based on network boundaries and the systems connected to them. It cannot be defined by locations, departments, products or people. Cyber Essentials requires a clear technical definition of what is included and excluded from the assessment.

How do we determine which IP addresses need to be tested for Cyber Essentials Plus?

Cyber Essentials Plus requires all in-scope internet-facing systems and services managed by your organisation to be included in the external vulnerability scan. These systems are identified using their public IP addresses.

If you are unsure which IP addresses need to be included, our Remote Consultancy Support service can help you determine the correct scope.

What should we do if we have more than 20 IP addresses?

Our Cyber Essentials Plus packages include an external vulnerability scan for up to 20 IP addresses. If your organisation has more than 20 IP addresses that need to be tested, additional IP address scanning can be purchased.

How do we determine how many workstations, mobile devices and build types need to be tested for Cyber Essentials Plus?

Cyber Essentials Plus includes testing of a representative sample of the devices and systems within your certification scope. This may include desktops, laptops, tablets, smartphones, servers and cloud-hosted systems.

The number of devices tested depends on the operating systems, versions and build types used within your organisation.

The assessor must randomly select the devices to be tested.

What should we do if we have more than ten sample devices?

Our Cyber Essentials Plus packages include testing for up to ten sample devices. If more than ten devices need to be tested to meet the scheme’s sampling requirements, additional device testing must be purchased.

Should we apply for Cyber Essentials certification in addition to our ISO 27001 certification?

Yes. Cyber Essentials and ISO 27001 are complementary certifications and many organisations choose to achieve both.

• Foundation for cyber security: Cyber Essentials focuses on five key technical controls that help protect against common cyber attacks and can provide a strong foundation for an organisation’s wider security programme.
• Independent technical testing: Cyber Essentials Plus includes hands-on technical testing of your systems and security controls, providing additional assurance that they are operating effectively.
• Customer and contract requirements: many private sector, public sector and government organisations require suppliers to hold Cyber Essentials or Cyber Essentials Plus certification.
• Demonstrates cyber security commitment: holding both Cyber Essentials and ISO 27001 can provide customers, suppliers and other stakeholders with greater confidence in your organisation’s approach to cyber security.

Together, the certifications provide both technical security controls and a comprehensive information security management system.