Cyber Essentials certification remains one of the most effective and affordable ways for UK businesses to strengthen their cyber security. The scheme is government-backed, developed by the NCSC (National Cyber Security Centre) and delivered through IASME, and it is increasingly required in tenders, insurance policies and supply chain contracts.
In this blog post, we outline the two certification levels and provide a step-by-step process to help you get Cyber Essentials certified.
What is Cyber Essentials?
Cyber Essentials is a UK government-backed scheme that helps organisations protect themselves against common cyber attacks. By implementing five basic technical controls, organisations can prevent up to 80% of the most common threats.
Certification shows customers, partners and regulators that you take security seriously and helps you meet contract and insurance requirements.
There are two levels of certification:
- Cyber Essentials – a self-assessment covering the five controls.
- Cyber Essentials Plus – an externally audited version that verifies your implementation. You must achieve Cyber Essentials before progressing to Plus.
The Scheme is updated every year. Read about the latest changes to the Scheme.
The five Cyber Essentials controls
Certification focuses on five technical controls:
- Firewalls
Secure configuration of network devices, blocking unauthorised access and changing default passwords.
Learn more about firewalls - Security update management
Keeping systems patched within 14 days of critical or high-risk vulnerabilities being disclosed.
Learn more about security update management - Malware protection
Using anti-malware software, application allow-listing or sandboxing to prevent harmful code from executing.
Learn more about malware protection - User access control
Managing user accounts, enforcing unique credentials and mandating MFA (multi-factor authentication), particularly for Cloud services and administrative access.
Learn more about user access control - Secure configuration
Removing unnecessary accounts and software, disabling insecure defaults, and locking unattended devices.
Learn more about secure configuration
Cyber Essentials vs Cyber Essentials Plus
Both certifications demonstrate commitment to cyber security, but they differ in scope and assurance:
- Cyber Essentials is assessed via a self-assessment questionnaire. It’s quick and cost-effective, and certification can typically be achieved in a few days if controls are in place.
- Cyber Essentials Plus is assessed via an independent audit. It includes vulnerability scans and hands-on testing to confirm that your systems meet the standard. This provides greater assurance to customers and insurers.
Organisations often start with Cyber Essentials and progress to Plus once they have confidence in their controls. For higher-risk sectors (finance, healthcare, defence, government supply chains), Cyber Essentials Plus is often expected.
Step-by-step guide to Cyber Essentials certification
To help you prepare, here is a clear process for getting certified:
- Download and read the requirements
Access the Requirements for IT Infrastructure and confirm your team understands the requirements. This document is mandatory reading before you begin. - Define your scope
Clearly identify which parts of your IT infrastructure are in scope. This must now include all relevant Cloud services, user devices and systems accessing organisational data. Poor scoping remains one of the most common reasons applications fail. - Review your controls
Map your systems against the five technical controls. Ensure all devices are patched, MFA is fully enforced (especially for Cloud and admin access), default settings are secured and anti-malware defences are effective. - Complete the SAQ (self-assessment questionnaire)
Answer the Question Set honestly and in detail. The SAQ acts as a compliance statement and must be signed by a board member or equivalent. - Submit your application – Send your SAQ to an IASME-accredited certification body such as IT Governance, trading as GRC Solutions. An assessor will review your answers and either issue a pass or request clarification.
- Achieve Cyber Essentials certification
If successful, you will receive your Cyber Essentials certificate and, if eligible, free cyber insurance of up to £25,000. - Progress to Cyber Essentials Plus (optional)
Book an external audit to achieve Cyber Essentials Plus certification. This involves vulnerability scans and a technical review to verify your controls in practice.
Common pitfalls to avoid
Many organisations fail their first attempt because of avoidable mistakes. The most common pitfalls include:
- Weak scoping – Failing to include all Cloud services, remote devices or third-party platforms that are in scope.
- MFA gaps – Not enforcing MFA consistently across all Cloud accounts and privileged users.
- Outdated software – Using unsupported operating systems or unpatched applications.
- Default settings – Retaining factory default passwords or failing to lock down administrative access.
- Incomplete evidence – Providing vague or general answers in the SAQ without demonstrating how controls are implemented.
Address these issues early to avoid delays and retests.
Why Cyber Essentials matters
Cyber Essentials is more than a checklist. For small to medium-sized organisations in particular, it provides:
- Protection against common attacks – Preventing the majority of commodity malware and phishing-driven intrusions.
- Customer trust – Demonstrating due diligence to clients, partners and insurers.
- Market access – Meeting the security requirements of government contracts and supply chain frameworks.
- Cost-effective assurance – Achievable at a fraction of the cost of ISO 27001 or other frameworks.
With cyber insurance premiums continuing to rise and regulators placing greater scrutiny on supply chain resilience, Cyber Essentials certification is an increasingly valuable badge of assurance.
Cyber Essentials checklist
To recap, here is a practical Cyber Essentials checklist:
- Read the Requirements for IT Infrastructure and understand the Question Set.
- Define a clear and complete scope, including all Cloud services.
- Verify your implementation of all five controls.
- Enforce MFA across all Cloud services and privileged accounts.
- Remove unsupported or unpatched software.
- Secure default settings and administrative access.
- Complete and submit the SAQ.
- Progress to Plus by arranging an external audit.
Cyber Essentials certification
As one of the founding Cyber Essentials certification bodies, IT Governance, trading as GRC Solutions, has issued more than 13,000 certificates. Our services range from simple self-certification packages to fully managed consultancy programmes.
Whether you want to self-certify or achieve Cyber Essentials Plus certification, we have the experience, tools and services to help you succeed.
