Cyber Essentials certification guide

Cyber Essentials certification assesses a defined set of technical security controls across an agreed scope. It can help a UK business demonstrate a baseline to a customer or identify practical weaknesses in its systems. Start by confirming which certificate your buyer needs and which parts of your organisation it must cover.

Cyber Essentials is a government-backed scheme. IASME is the NCSC's official delivery partner, and its licensed certification bodies carry out assessments. The scheme is available to organisations of different sizes; it is not limited to businesses with an internal security team.

The useful outcome is a set of controls that operates consistently. A certificate does not establish that every security risk is controlled or that the organisation meets every legal obligation.

Cyber Essentials and Cyber Essentials Plus

Both levels use the same technical requirements. Cyber Essentials uses a verified self-assessment questionnaire. Your organisation must give accurate answers about the systems and practices in scope, and the certification body reviews them.

Cyber Essentials Plus adds an independent technical audit. IASME describes coverage of a representative set of user devices, all internet gateways and servers with services accessible from the internet. The verified self-assessment is a prerequisite. Agree the audit arrangements and applicable timing with the certification body.

Do not confuse the technical assessment of malware protection and other controls with a staff phishing-awareness campaign. A general claim that CE Plus requires simulated phishing emails to employees misdescribes the assessment. Ask the assessor which tests and access are required for your scope.

If a customer asks for Plus, a basic certificate is not the same assurance. If the customer asks only for Cyber Essentials, decide whether the additional technical verification is useful for your own risk management. Both require continuing maintenance and renewal; passing once does not keep a changing environment compliant indefinitely.

Define scope before buying the assessment

List the organisation, locations, devices, software and cloud services involved. Include remote working and personal devices where relevant to the scheme's scope. Ask who administers each system and who can provide evidence. A managed service provider may implement controls, but you still need an accurate account of what is covered.

Use the current IASME knowledge hub and assessment questions, not an old questionnaire saved from a previous year. Requirements and guidance change. Confirm the question set and requirements that apply to the assessment you purchase.

A scope exception must be defensible. You cannot make an unsupported device safe by leaving it off a spreadsheet. Discuss genuine boundaries and segregation with the certification body before relying on them.

The five control areas in practice

Firewalls

A firewall controls permitted network traffic. Review the devices and gateways protecting the systems in scope, the inbound services allowed and the administrative access routes. Record why each exposed service is needed and who approved it.

The practical check is whether the configuration matches that record. An old remote-access rule or management interface can remain exposed after its business purpose has ended. Close unnecessary access through a controlled change and verify the result. Do not assume every remote administration design is identical; assess it against the current scheme requirements.

Secure configuration

Remove or disable unnecessary accounts, services and software, and replace default credentials. Check configurations on actual devices and cloud services rather than relying on a build document that may have drifted.

A useful preparation exercise compares a newly issued device with one used for several months. If users can alter settings or install software in ways the policy does not allow, identify how that happens and repair the control. Record necessary exceptions and check whether they are compatible with the assessment requirements.

User access control

People should have only the access their work requires. IASME's user-access guidance explains separate user accounts and separation of everyday activity from administrative privileges. Include support-provider accounts in the review.

Review account creation, changes and removal, as well as privileged access. Check the applicable MFA requirements for cloud and internet-accessible accounts and verify enforcement. A policy that asks people to enrol is not proof that every relevant account must use it.

Avoid inventing a universal password-complexity rule. IASME describes different permitted password arrangements depending on additional protections such as MFA or a deny list. Use the current requirements to configure the relevant system, and confirm any platform limitation with the assessor. Stronger controls can be sensible without being mislabelled as the scheme's exact wording.

Malware protection

Check how each device type prevents or detects malicious software, using the approaches permitted by the scheme. A managed mobile device, a desktop and a server may need different evidence. Buying an endpoint product does not prove it is active, current or configured across every relevant device.

Ask the support team to demonstrate health and coverage reports, then investigate missing devices or disabled protection. Use the assessor's requirements to plan Plus testing. Do not treat an unrelated awareness exercise as a substitute for the technical control.

Security update management

Maintain a supported-software inventory covering operating systems, applications, browsers, extensions, firmware and other relevant components. IASME's update guidance requires critical or high-risk updates, and updates for which no severity details are provided, within 14 days of vendor release. Its guidance also describes a CVSS score of 7 or above for the relevant severity threshold.

Track release and installation dates. A monthly maintenance meeting is not evidence that a fourteen-day requirement was met. Test changes promptly, arrange required restarts and define who handles failures before the deadline is missed.

Unsupported software needs a real resolution. That may mean replacement or an assessor-agreed, well-defined segregated scope that prevents internet traffic, rather than a casual claim that an old device is isolated.

Windows 10 needs a support check, not a blanket answer

Ordinary Windows 10 support ended on 14 October 2025. It is inaccurate to describe that as a future event in a 2026 article, or to claim every Windows 10 installation automatically fails certification.

IASME's ESU guidance explains that correctly implemented Extended Security Updates can support compliance while an organisation migrates. Some long-term servicing editions have distinct lifecycles. Check the exact edition, support entitlement, activation and installed updates with the supplier and certification body. A plan to buy support is not evidence that updates are being received.

Use temporary support to schedule a controlled replacement. Include dependent applications, hardware compatibility, testing and the migration owner. Do not let the temporary arrangement become an untracked assumption.

Costs and assessment planning

IASME publishes size-based self-assessment fees on its scheme page. Check the current fee and tax treatment when buying. Plus is quoted according to size and technical complexity. Use a scoped quotation for budgeting rather than a generic price range.

Budget separately for assessment, preparation, remediation and continuing operation. Replacing unsupported equipment or improving account management may cost more than the assessment. Ask what support, reassessment and follow-up are included before comparing proposals.

Do not promise a universal completion time. Build the schedule from the inventory, known gaps, change approvals and assessor availability. If a contract needs the certificate by a deadline, work backwards and tell the buyer early if the scope or remediation creates a risk.

A completed readiness example

Consider a fictional 25-person consultancy using cloud email, laptops and an outsourced support provider. Its initial review finds a forgotten cloud application, two accounts without enforced MFA and a laptop whose support status is unclear.

The business adds the application to its inventory, assigns its owner and checks the applicable authentication settings. IT resolves the two account gaps and verifies sign-in policy enforcement. It identifies the laptop's exact edition and support status, then either demonstrates valid supported operation or replaces it before assessment.

The owner records the evidence and asks the certification body to resolve the remaining scope question. The decision is to submit when those gaps are closed, rather than answering as though a planned repair were already complete. For Plus, the team also agrees the representative device testing and access arrangements.

Check the evidence before submission

Treat these as preparation prompts, not a replacement for the assessment questionnaire. Certification requirements are determined by the scheme and assessor, not this table.

Decide why you need the certificate

A tender or customer may specify a particular level and scope. Read the actual requirement rather than assuming every government contract or insurer has the same rule. Obtain written clarification where an alternative is proposed. Certification also does not guarantee an insurance discount or claim payment.

Our IT compliance service can help organise readiness work, identify gaps and coordinate practical remediation. Arrange a consultation with your current inventory, required certificate and deadline. The certification decision remains with the authorised certification body.