What is Cyber Essentials? UK Plain-English Guide 2026

WHAT IS CYBER ESSENTIALS?

Cyber Essentials is a UK Government-backed cyber security certification scheme, managed by the NCSC (National Cyber Security Centre) and assessed through IASME-approved certification bodies. It was designed to help organisations of all sizes protect themselves against the most common and damaging cyber attacks.

The scheme defines five core technical controls that, when properly implemented, protect against the vast majority of cyber attacks hitting UK businesses today. Achieving certification demonstrates to clients, partners, and government customers that your organisation takes cyber security seriously.

WHY WAS CYBER ESSENTIALS CREATED?

The UK Government introduced Cyber Essentials in 2014 in response to the growing volume and sophistication of cyber attacks on UK businesses. Research consistently shows that the majority of successful attacks exploit basic, preventable vulnerabilities - things like unpatched software, weak passwords, and misconfigured systems.

Cyber Essentials gives businesses a practical, achievable baseline of controls that make them significantly harder to attack. It is not a silver bullet, but it is an important first step.

THE FIVE CYBER ESSENTIALS CONTROLS

The scheme focuses on five specific technical areas:

• Firewalls - Boundary firewalls and internet gateways that control what traffic can enter and leave your network.
• Secure Configuration - Ensuring devices and software are configured securely, with unnecessary features and default accounts disabled.
• User Access Control - Ensuring user accounts are managed carefully, with people only having access to what they need for their role.
• Malware Protection - Protecting devices against viruses and malicious software through anti-malware tools and application controls.
• Patch Management - Keeping devices, operating systems and software up to date with the latest security patches and updates.

WHAT CHANGED WITH THE DANZELL APRIL 2026 UPDATE?

In April 2026, IASME updated the Cyber Essentials requirements under what is known as the Danzell update. The key changes affect organisations certifying or renewing from that point onwards:

• Multi-factor authentication (MFA) - now required for all cloud services and remote access, not just administrator accounts
• Account separation - the distinction between administrator and standard user roles is assessed more strictly
• Patching timelines - high-risk vulnerabilities must be patched within 14 days of a patch becoming available
• Mobile devices - smartphones and tablets are more explicitly in scope across all five controls
• Malicious content filtering - controls against malicious code in email and web traffic are assessed more rigorously
• External vulnerability exposure - your internet-facing attack surface is considered more carefully during assessment

If you last certified before April 2026, your next renewal will be assessed against the updated standard. We walk you through the changes at the start of every engagement. Read our full Danzell 2026 guide →

WHO NEEDS CYBER ESSENTIALS?

Cyber Essentials certification is mandatory for any UK business bidding for government contracts that involve handling personal data or providing certain technical products and services. Beyond the legal requirement, there are strong commercial reasons for any business to hold certification:

• Many large enterprise clients and supply chains now require it from suppliers
• It demonstrates cyber maturity to clients, partners and investors
• It provides meaningful protection against common cyber attacks
• Eligible UK organisations receive free cyber liability insurance up to £25,000 on certification
• It is the foundation for other certifications including DCC Level 0 and ISO 27001

CYBER ESSENTIALS VS CYBER ESSENTIALS PLUS

There are two levels of Cyber Essentials certification:

• Cyber Essentials - Self-assessed. You complete an online questionnaire answering questions about your five controls, which is verified by an approved assessor. Use our CE readiness checklist to check your controls before you start.
• Cyber Essentials Plus - Independently verified. An IASME-approved assessor conducts a technical audit to verify that your controls are correctly and effectively implemented. Use our CE Plus readiness checklist to prepare before your audit.

Both levels are valid for 12 months and result in an IASME-issued certificate listed on the IASME public register. Plus provides a higher level of assurance and is increasingly required by government and enterprise clients. Read our CE vs CE Plus comparison →

HOW TO GET CYBER ESSENTIALS CERTIFIED

Certification is carried out through IASME Approved Certification Bodies like Vincent Cyber Defence. The process involves scoping your IT environment, assessing your current controls, completing the questionnaire with guidance, and receiving your certificate on passing.

Our process is designed around first-time pass - we identify gaps before you formally submit, so there are no surprises and no wasted time.

HOW LONG DOES IT TAKE?

The timeline depends on your organisation's current security posture and how quickly you can implement any required changes. Once your controls are in place, the process moves quickly - once submitted, assessments are typically completed within 1-2 business days. Some organisations may need a few weeks to address gaps first. We work to your deadlines and can prioritise if you have an urgent tender requirement.

HOW MUCH DOES CYBER ESSENTIALS COST?

Cyber Essentials is priced by organisation size. All prices are fixed and include the IASME certification fee - there are no hidden extras:

• Micro (0-9 employees): £320 + VAT
• Small (10-49 employees): £440 + VAT
• Medium (50-249 employees): £500 + VAT
• Large (250+ employees): £600 + VAT

Eligible UK organisations also receive free cyber liability insurance up to £25,000 automatically on certification - no separate application needed. See our pricing page for full details. See what Cyber Essentials costs →