What Cyber Essentials is

Cyber Essentials is a UK government-backed certification scheme that sets a minimum standard of cyber security for organisations of any size. It checks that you have five technical controls in place: firewalls, secure configuration, security update management, user access control and malware protection. Together they protect against the most common attacks launched over the internet by low-skilled attackers, such as phishing, password guessing and the exploitation of known, unpatched flaws.

The scheme is owned by the National Cyber Security Centre (NCSC), which writes the technical requirements. IASME is the NCSC's Cyber Essentials Delivery Partner. It runs the assessment platform and licenses a network of Certification Bodies that mark assessments and carry out audits. Apexward Group is one of those Certification Bodies.

The two levels

There are two levels of certification, and both test the same five controls.

• Cyber Essentials is a verified self-assessment. You answer an online question set about your IT, a board member or equivalent signs a declaration that the answers are true, and an assessor at a Certification Body marks it.
• Cyber Essentials Plus adds an independent technical audit. An assessor scans and tests a sample of your devices and cloud accounts to check the controls actually work. You must hold Cyber Essentials first, and the audit must be completed within three months of that certificate.

See Cyber Essentials and Cyber Essentials Plus compared.

The current version

The requirements are updated once a year. The current version is Requirements for IT Infrastructure v3.3, with the question set IASME calls Danzell. It applies to assessment accounts created from 27 April 2026. The main changes are in What changed in Danzell and v3.3.

What the five controls ask for, in brief

• Firewalls: every in-scope device sits behind a correctly configured firewall, either a boundary firewall on a network you control or the software firewall on the device itself. See Firewalls.
• Secure configuration: unused accounts and software are removed, default passwords are changed, auto-run is off and devices lock. See Secure configuration.
• Security update management: all software is licensed and supported, and critical or high-risk updates are installed within 14 days of release. See The 14-day update rule.
• User access control: each person has their own account, admin rights are kept to separate accounts, leavers are removed and multi-factor authentication (MFA) is on for cloud services. See User access control.
• Malware protection: anti-malware software or application allow listing is active on every in-scope device. See Malware protection.

What is in scope

By default the assessment covers all of the IT your organisation uses to do its business: offices, home workers, laptops, phones, servers and cloud services. Personal devices that reach work data or services are included. You can certify a separately managed, segregated part of the organisation instead, but you must justify that choice, end-user devices must be included, and cloud services can never be excluded. See Whole organisation or a sub-set.

Why organisations certify

• Some UK government contracts, and many private-sector supply chains, ask suppliers to hold Cyber Essentials or Cyber Essentials Plus.
• Working through the controls closes the gaps that most opportunistic attacks rely on.
• UK-based organisations that certify their whole organisation and have a turnover under £20 million are entitled to the cyber liability insurance included with certification.

Cost and validity

IASME's fee for a Cyber Essentials assessment starts at £320 plus VAT and rises with the size of your organisation. See Cyber Essentials fees. A certificate is valid for 12 months, after which you assess again against the question set current at the time. See Certificate validity and renewal.

What it does not cover

Cyber Essentials is a baseline, not a full security programme. It does not assess backups, incident response, staff training or bespoke application security, although the NCSC strongly recommends backing up your data. The certificate shows your position on the date it was issued, so the controls need to be kept up all year.

Where to start

1. Decide what your scope will be.
2. List your devices, operating systems, software and cloud services.
3. Check each of the five controls against that list and fix the gaps.
4. Read How certification works before you apply.

To see where you stand before you apply, try the readiness checker.