The short answer: Cyber Essentials requires five technical controls across every device and cloud service in scope: firewalls, secure configuration, security update management, user access control and malware protection. Since 27 April 2026 the rules are stricter: missing multi-factor authentication on any cloud service that offers it is now an automatic fail, and so is not installing critical or high-risk updates within 14 days. You certify by completing a self-assessment that an independent assessor marks, and the certificate lasts 12 months.
Last updated: 8 October 2026. Checked against the NCSC’s Requirements for IT Infrastructure v3.3 and IASME’s scheme guidance on that date.
In this guide
- What is Cyber Essentials?
- What changed in April 2026
- The Cyber Essentials requirements, control by control
- What has to be in scope
- Cyber Essentials checklist (interactive)
- How to get Cyber Essentials certified
- Cyber Essentials Plus
- Renewal
- Who needs Cyber Essentials?
- Frequently asked questions
What is Cyber Essentials?
Cyber Essentials is the UK government’s baseline cyber security certification. It is run by the National Cyber Security Centre (NCSC) with IASME as the scheme’s delivery partner, and it proves your business has the controls in place to stop the most common internet-based attacks, such as phishing, password guessing and exploiting unpatched software.
There are two levels. Cyber Essentials is a verified self-assessment: you answer a set of questions about your IT and an independent assessor marks them. Cyber Essentials Plus covers the same requirements but adds a hands-on technical audit of your systems.
It is widely used. Government figures show 61,430 certificates were awarded between July 2025 and June 2026: 46,245 at Cyber Essentials and 15,185 at Cyber Essentials Plus.
What changed in April 2026?
The current rules are version 3.3 of the requirements, assessed with the Danzell question set, for anyone who bought an assessment from 27 April 2026. Businesses that opened an account before then can finish under the previous (Willow) questions. The changes that matter most, according to IASME and the NCSC, are:
- MFA is now an automatic fail. Multi-factor authentication is mandatory for every cloud service where it is available, whether it is free, included or a paid extra. Not having it enabled means you fail.
- Cloud services cannot be excluded. Microsoft 365, Google Workspace, your accounting package and any other cloud service that holds organisational data must be in scope.
- Two new auto-fail questions on updates. High-risk and critical updates for operating systems, router and firewall firmware, and applications must be installed within 14 days of release.
- Passwordless sign-in is recognised. The definition now explicitly covers FIDO2 authenticators such as passkeys and security keys.
- More emphasis on backups, and a clearer definition of what counts as a cloud service.
- Each legal entity is named on the certificate, and any excluded infrastructure must be described.
The Cyber Essentials requirements, control by control
These are the five controls you are assessed against, with the specific rules that catch businesses out. The wording in quotation marks is from the NCSC requirements document.
1. Firewalls
Every device in scope must be protected by a correctly configured firewall, either a boundary firewall such as your router or the software firewall on the device itself. The default administrator password on routers and firewalls must be changed to a strong, unique one (or remote administration disabled entirely), administration from the internet must be off unless there is a documented business need, and any inbound rule that is no longer needed must be removed.
2. Secure configuration
Devices and cloud services must be set up securely rather than left on factory settings. That means removing unnecessary software and accounts, turning off auto-run, and requiring a PIN, password or biometric to unlock devices. The password rules are specific:
- With multi-factor authentication, passwords must be at least 8 characters, with no maximum length.
- Without MFA, passwords must be at least 12 characters, or at least 8 characters with automatic blocking of common passwords.
- Devices must lock after repeated failed attempts, or throttle guessing.
3. Security update management
All software in scope must be licensed and supported by its vendor. Updates must be installed “within 14 days of release” where the vendor rates them critical or high risk, or where they fix vulnerabilities with a CVSS v3 score of 7 or above. Unsupported software must be removed or placed in a separate sub-set that cannot reach the internet. In practice this is where old Windows 10 PCs without Extended Security Updates, unsupported servers and forgotten firewall firmware cause failures.
4. User access control
Everyone gets their own account, with only the access their job needs. Administrator accounts must be separate from everyday accounts and must not be used for email or web browsing. Accounts must be removed or disabled when people leave. Above all: “Authentication to cloud services must always use MFA.” Administrator accounts need MFA too.
5. Malware protection
Every device in scope needs protection against malware. For most businesses that means up-to-date anti-malware software that scans files and web pages automatically. Application allow-listing is an accepted alternative on some devices, such as phones that only install apps from an official store.
What has to be in scope?
The default scope is your whole organisation. You can certify a “well-defined and separately managed sub-set” instead, but only if it is separated from the rest of the network by a firewall or VLAN, and a scope that leaves out end-user devices is not acceptable. In scope means:
- Every laptop, desktop, server, tablet and phone that accesses organisational data or services.
- Staff-owned phones and laptops that access work email or files (bring your own device).
- Home and remote workers’ devices, and the routers or firewalls that protect the office.
- Every cloud service that holds or processes your data, which since April 2026 cannot be excluded.
- Thin clients, virtual desktops and anything else users sign in to.
Certifying your whole organisation is also what unlocks the free cyber insurance described below.
Cyber Essentials checklist: check your readiness
Answer the 13 questions below before you buy an assessment. Your readiness score and a list of what to fix update as you go, and the two checks that fail the assessment on their own are flagged. The NCSC also offers a free Cyber Essentials Readiness Tool that gives tailored guidance.
If several lines are a no, that is normal, and it is exactly what a readiness review is for. Our free IT security review checks the access-control side in about twelve minutes.
How do you get Cyber Essentials certified?
Certification is quick once your IT meets the requirements. The steps are:
- Close the gaps first. Use the checklist above or a readiness review. Most of the time and cost is here, not in the assessment.
- Buy an assessment through IASME or a licensed certification body. You receive a login to the online assessment portal and have 6 months to complete it.
- Answer the question set accurately, describing your scope, devices and cloud services. A board-level person must sign off the answers.
- An independent assessor marks it. IASME says most assessors aim to return results within 3 days.
- Fix anything flagged. If you fail, you get two working days to correct and resubmit at no extra cost. After that you reapply and pay again.
- Receive your certificate and your listing on the public register, valid for 12 months.
The fee is set centrally by organisation size, from £320 plus VAT for up to 9 employees to £600 plus VAT for 250 or more. Our Cyber Essentials cost guide has the full fee table, the cost of Cyber Essentials Plus and what we charge for a supported certification.
UK organisations with turnover under £20 million that certify their whole organisation can opt in to £25,000 of cyber liability insurance at no extra cost, including a 24-hour incident response helpline, according to IASME.
How is Cyber Essentials Plus different?
Cyber Essentials Plus is the same set of requirements, verified by an assessor testing your systems rather than just reading your answers. You must hold the basic certificate first, and IASME says the Plus audit must be completed within 3 months of it. The tests in the current NCSC test specification are:
- An external vulnerability scan of your internet-facing systems.
- An authenticated internal scan of a sample of devices to confirm patching.
- Checks that malware protection works, including on email and web downloads.
- Checks that multi-factor authentication is configured on cloud services.
- Checks that administrator and user accounts are properly separated.
Any single failed test fails the assessment. Under IASME’s 2026 rules, if the patching tests fail, the retest checks a new random sample of devices as well as the original ones, and a second failure revokes the basic certificate too.
How does Cyber Essentials renewal work?
Cyber Essentials and Cyber Essentials Plus certificates expire after 12 months, and there is no automatic renewal. You complete a fresh assessment against whichever question set is current at the time, so each year’s renewal can include new rules, as April 2026’s MFA change did. IASME notes that a renewed certificate runs for 12 months from the date you submit, not from the old expiry date, so there is no benefit in renewing early, but letting it lapse can break a contract that requires continuous certification.
Put the expiry date in the diary a month ahead, check the new question set for changes, and fix anything new before you start the assessment.
Who needs Cyber Essentials?
Cyber Essentials is voluntary for most businesses, but it is increasingly a condition of winning work:
- Central government suppliers. Under Procurement Policy Note 014, contracts that involve citizens’ personal information or government ICT systems require Cyber Essentials or Cyber Essentials Plus, renewed every year of the contract.
- Defence suppliers. The Ministry of Defence expects certification across its supply chain where defence information is handled.
- NHS suppliers. Under the NHS Data Security and Protection Toolkit guidance, a current certificate is accepted evidence for suppliers of IT systems that process identifiable data. Care providers should see our DSPT guide for care homes.
- Larger customers. Organisations that sign the government’s Cyber Resilience Pledge commit to checking Cyber Essentials coverage across their supply chains and taking a risk-based approach to requiring it.
- Regulated professions. Law firms are not required to hold it by the SRA, but it is a sensible way to show clients and insurers that you take security seriously. See does the SRA require Cyber Essentials?
There is a financial case too. The government states that organisations with Cyber Essentials are 92% less likely to make a claim on their cyber insurance than those without it, according to a joint statement from DSIT and major UK banks.
ATS Connection is Cyber Essentials certified and we take businesses through Cyber Essentials certification every year, from readiness review to submission, through an independent certification partner. The controls then stay in place as part of our managed cyber security.
Frequently asked questions
What are the five Cyber Essentials requirements?
Firewalls, secure configuration, security update management, user access control and malware protection. Each has specific rules, such as MFA on all cloud services and installing critical updates within 14 days.
What changed in Cyber Essentials in April 2026?
From 27 April 2026 the Danzell question set and version 3.3 of the requirements apply. MFA on cloud services became an automatic fail if missing, cloud services can no longer be excluded from scope, and two new auto-fail questions check that high-risk updates are installed within 14 days.
How long does it take to get Cyber Essentials?
IASME says most assessors aim to return results within 3 days. The time that varies is fixing gaps beforehand, which can take anything from a few days to several weeks depending on your IT.
How long is a Cyber Essentials certificate valid?
12 months. You then complete a new assessment against the current question set to renew.
Is MFA mandatory for Cyber Essentials?
Yes. Multi-factor authentication must be enabled on every cloud service where it is available. Since April 2026, not having it enabled is an automatic fail.
Do staff-owned phones count for Cyber Essentials?
Yes, if they access organisational data or services such as work email. They must meet the same requirements, or be kept out of scope by preventing them from accessing work data.
What happens if you fail Cyber Essentials?
You get two working days to fix the issues and resubmit at no extra cost. If you still fail, you must reapply and pay the fee again.
Can I do Cyber Essentials myself?
Yes. Any organisation can buy an assessment and complete it directly. Many small businesses use an IT partner because the difficult part is making the IT compliant and answering the questions accurately, not the form itself.
Sources
- NCSC: Cyber Essentials overview
- NCSC: Cyber Essentials Requirements for IT Infrastructure v3.3
- NCSC: Cyber Essentials resources
- IASME: Changes to the Cyber Essentials scheme, April 2026
- IASME: Cyber Essentials FAQs
- IASME: Important update, changes to Cyber Essentials for April 2026
- IASME: The importance of renewing your Cyber Essentials certification
- IASME: Cyber Essentials and Cyber Essentials Plus, what is the difference?
- NCSC: Cyber Essentials Plus test specification
- GOV.UK: Cyber Essentials management information
- GOV.UK: PPN 014, Cyber Essentials scheme
Free • 12 minutes • Written PDF report
Who actually holds the keys to your systems?
List the systems your business runs, answer plain-English questions about how they are controlled, and get a report with a red, amber and green rating for every area and what to fix first. Nothing on your systems is touched.
Cyber Essentials certified · Microsoft Partner · rated 5.0 on Google