Cyber Essentials in plain words: the UK scheme, and how to pass
Cyber Essentials is the UK's baseline security certificate, backed by the NCSC. Here's what the five controls ask, the difference with Cyber Essentials Plus, who requires it, and how to get through the assessment.
In 30 seconds
- What
- A UK government-backed certification, run for the NCSC by IASME. It checks five technical controls that stop the most common internet attacks.
- Two levels
- Cyber Essentials: a verified self-assessment, signed off by a board member and marked by a certification body. Cyber Essentials Plus: the same controls, tested hands-on by an assessor.
- Five controls
- Firewalls, secure configuration, security update management, user access control, malware protection.
- Who asks
- UK central government and NHS buyers, for contracts that handle personal data or government information. Private customers can write it into contracts too.
- Validity
- 12 months. You renew every year, against the requirements in force at the time.
- Current version
- Requirements v3.3, in effect since 27 April 2026. Cloud services can't be left out of scope, and they always need MFA.
What Cyber Essentials is
Cyber Essentials is a UK government-backed certification scheme. The NCSC owns the technical requirements, and IASME runs the scheme as the NCSC’s delivery partner, through a network of licensed certification bodies.
It covers five technical controls that protect against the most common internet attacks: phishing, password guessing, and exploits of known, unpatched flaws. It doesn’t ask for a management system or written policies; it checks how your computers, accounts and cloud services are set up.
The five controls
- FirewallsEvery device that connects to the internet sits behind a firewall. Default admin passwords changed, inbound connections blocked unless a rule is approved and documented.
- Secure configurationUnused accounts and software removed, default passwords changed, auto-run turned off, users authenticated and devices locked.
- Security update managementSoftware licensed and supported. Critical and high-risk updates installed within 14 days of release.
- User access controlAccounts only for those who need them, separate admin accounts, MFA where available and always on cloud services.
- Malware protectionAnti-malware software (Windows, macOS) or application allow-listing, active and up to date on every device in scope.
What’s in scope
Either the whole IT used to run your business, or a well-defined and separately managed part of it. Laptops, phones, servers, network devices and cloud services in that boundary are in scope, including staff-owned devices that access company data. Since version 3.3, cloud services that hold your data can’t be excluded.
The rules that trip people up. Any unsupported software in scope fails the assessment: an old Windows version, a router the vendor no longer patches. The 14-day update rule applies to every device in scope. MFA is mandatory on every cloud service, including the small ones nobody remembers signing up for.
Cyber Essentials or Cyber Essentials Plus
Cyber Essentials
You answer a self-assessment questionnaire online. A board member, or equivalent, signs off the answers, and a certification body marks them.
- Checked by
- An assessor reviews your answers
- Validity
- 12 months
Cyber Essentials Plus
The same self-assessment, then a technical audit: internal and external vulnerability scans and hands-on checks on a sample of your devices.
- Checked by
- An assessor tests your systems
- Validity
- 12 months
Question set "Danzell" applies to assessments bought since 27 April 2026, against requirements v3.3. Assessments started earlier may follow v3.2.
Who asks for it
- UK central government. Procurement Policy Note 014 (February 2025) applies to central government departments, their agencies, non-departmental public bodies and NHS bodies. They expect Cyber Essentials or Plus where a supplier handles personal data of citizens or officials, runs ICT that stores government information, or handles information on government business. Suppliers recertify every 12 months. The note also says the scheme shouldn’t be required on every contract by default.
- Defence. Ministry of Defence contracts have their own cyber requirements through the Defence Cyber Protection Partnership: read the contract.
- Private customers. Some write it into their contracts or questionnaires. Ask what they accept: Cyber Essentials, Plus, or an equivalent certificate.
How certification works
- BeforeScopeDecide what's covered and check the five controls against it.
- OnlineAnswersFill in the questionnaire; a board member signs it off.
- Plus onlyTestsScans and device checks by the assessor.
- Each yearRenewalRecertify before the 12 months are up.
The timeline depends on what already passes. If your updates, MFA and admin accounts are in order, the assessment itself is short; replacing unsupported devices usually takes longest.
For UK health providers: the NHS DSPT
The Data Security and Protection Toolkit (DSPT) is NHS England’s online self-assessment. Every organisation with access to NHS patient data and systems must complete it, and the NHS Standard Contract makes it a contractual requirement. It’s an annual assessment: publish at least one by 30 June each year.
- What it measures. Performance against the National Data Guardian’s 10 data security standards. Since September 2024, NHS trusts, integrated care boards and some other bodies follow a version aligned with the NCSC’s Cyber Assessment Framework (CAF); other organisations keep the standard version.
- Statuses. Standards Met, Standards Not Met (published with an improvement plan), Approaching Standards (for social care organisations, and after an approved improvement plan), and Standards Exceeded.
- Where Cyber Essentials fits. Cyber Essentials Plus isn’t mandatory for the DSPT. Holding it means some toolkit questions are skipped, and outside the CAF version, Standards Met plus a current Cyber Essentials Plus certificate gives Standards Exceeded.
QoBot prepares the DSPT evidence the same way: what you have, what’s missing, and a step-by-step guide for each gap. The submission stays yours.
Getting Cyber Essentials: who does what
What QoBot does
- Helps you set the scope: the whole organisation or a separately managed part, cloud services included.
- Goes through the five controls with you and lists what fails, device by device.
- Drafts the self-assessment answers from what's true in your company, with the evidence behind each one.
- Writes step-by-step guides for each fix: MFA, updates, admin accounts, firewall rules.
- Prepares you for the Plus tests and reminds you before the certificate expires.
What your team does
- A board member, or equivalent, signs off the answers.
- Your IT person or provider applies the fixes, with QoBot's guides.
- You choose a certification body and book the assessment.
- For Plus, you give the assessor access to the sampled devices.
Lebrun Transports' scope: the whole company, with Microsoft 365 and the booking platform. 3 controls pass, 2 need work: 4 laptops run an unsupported Windows version, and MFA is off for the booking platform. This week:
- Karim (IT): turn on MFA for the booking platform · guide ready · ~30 minYour turn
- Karim (IT): upgrade or retire the 4 unsupported laptops · list ready · ~2 hYour turn
- Sophie (MD): review and sign off the self-assessment answers · ~20 minNeeds you
FAQ
What's the difference between Cyber Essentials and Cyber Essentials Plus?
Both check the same five controls. For Cyber Essentials you answer a self-assessment questionnaire, a board member signs it off and a certification body marks it. For Plus, an assessor also tests your systems: vulnerability scans and checks on a sample of your devices. If your Cyber Essentials certificate is less than 3 months old, IASME says you don't repeat the self-assessment for Plus.
Is Cyber Essentials mandatory?
No law requires it in general. UK central government departments, their agencies and NHS bodies expect it from suppliers on contracts that handle personal data or government information (Procurement Policy Note 014). Defence contracts have their own cyber requirements: check the contract.
Who issues the certificate?
A certification body licensed by IASME, the NCSC's Cyber Essentials delivery partner. IASME publishes its fees by organisation size; for Plus, the certification body gives you a quote.
Can QoBot certify us?
No. Only a certification body can award Cyber Essentials or Cyber Essentials Plus. QoBot gets you ready: scope, gap list, fixes as guides, and draft answers you check before submitting.
We already have ISO 27001. Do we still need Cyber Essentials?
If a buyer asks for it, yes: they're separate certificates. ISO 27001 covers much more ground, so most of the work is usually in place; Cyber Essentials checks specific technical settings, such as updates within 14 days and MFA on cloud services, that your ISO scope may not cover. See ISO 27001 in plain words.
We're based in the EU and sell to UK public bodies. Does it apply to us?
The requirement follows the contract, not where you're based. If a UK government or NHS buyer asks for it, the same scheme and certification bodies apply.
Sources
- Cyber Essentials: overviewNCSC · the five controls, Cyber Essentials and Plus, IASME as delivery partnerOfficial page
- Cyber Essentials: Requirements for IT Infrastructure v3.3NCSC · April 2026, effective 27 April 2026 · scope, cloud services, 14-day updates, MFAOfficial text
- Cyber Essentials: frequently asked questionsIASME · Plus audit, 12-month validity, 3-month ruleOfficial page
- PPN 014: Cyber Essentials SchemeGOV.UK, Cabinet Office · 17 February 2025, replaces PPN 09/14 and 09/23Official text
- Data Security and Protection ToolkitNHS England · who must complete it, 30 June deadline, statusesOfficial page
- DSPT: changes and the Cyber Assessment FrameworkNHS England · CAF-aligned version since September 2024Official page
- DSPT: frequently asked questionsNHS England · Cyber Essentials Plus in the toolkitOfficial page
This page explains the rules in plain words. It isn't legal advice: for a borderline case, ask a lawyer. Report an error