Cyber Essentials is the UK government-backed scheme that sets the minimum standard of cyber security the government recommends for organisations of all sizes. It focuses on the basic controls that stop the most common attacks, such as phishing, password guessing and unpatched software.
If you’ve been asked for it by a customer, or wondered whether it’s worth doing, here’s what’s involved.
The five controls
Cyber Essentials checks five areas of your IT:
- Firewalls: your internet connection and devices are protected from unwanted traffic.
- Secure configuration: devices and software are set up securely, with default passwords changed and unnecessary software removed.
- Security update management: software is supported and kept up to date.
- User access control: people only have the access they need, admin accounts are kept separate, and sign-ins are protected.
- Malware protection: devices are protected against viruses and other malicious software.
Cyber Essentials or Cyber Essentials Plus?
Both check the same controls. Cyber Essentials is a self-assessment: you answer a set of questions about your IT, a board member or director signs it off, and an assessor marks it. Cyber Essentials Plus adds independent technical testing of your systems to check the controls are really in place. Certificates are renewed every year.
What changed in April 2026
A new version of the requirements (v3.3), with a new question set called Danzell, applies to assessments started from 27 April 2026. The main changes for small businesses:
- Cloud services can’t be left out. Services such as Microsoft 365, Google Workspace and online accounting are in scope.
- Multi-factor authentication is a must. Signing in to cloud services must always use multi-factor authentication, and not turning it on where it’s available now fails the assessment automatically.
- 14-day updates are strictly checked. Critical and high-risk security updates must be installed within 14 days of release, for operating systems, firmware and applications, and missing this is now an automatic fail.
- Passkeys count. Passwordless sign-in such as passkeys and FIDO2 security keys is recognised.
- The declaration covers the whole year. The director’s sign-off now covers keeping the controls in place throughout the year, not just on the day.
Why it’s worth doing
- Fewer incidents. The NCSC’s 2025 annual review reports insurer data showing organisations with Cyber Essentials are 92% less likely to make a claim on their cyber insurance.
- Contracts. Central government departments and NHS bodies require Cyber Essentials for higher-risk contracts, such as those involving personal data, and many private customers now ask for it too.
- Free cyber insurance. UK organisations under the turnover limit set by the scheme that certify their whole organisation are entitled to free cyber liability insurance, including an incident response helpline.
- A clear checklist. Even if you never certify, the five controls are a sensible to-do list for any small business.
How to get started
- Download the free question set from the NCSC website and work through it with whoever looks after your IT.
- Use the NCSC’s free readiness tool, and the free 30-minute consultation with an NCSC-assured Cyber Advisor that’s available to small and medium businesses.
- Fix the gaps, especially multi-factor authentication on every cloud account and automatic updates, then apply through IASME or an IASME-licensed certification body.
We help businesses get ready for Cyber Essentials: checking each control, fixing what needs fixing and keeping it in place all year, so renewal isn’t a scramble.
Related articles
- Does your business need an AI acceptable use policy?
- Microsoft 365 sign-in code scam: what the EvilTokens takedown means
- Windows 11 24H2 and Office 2021 have reached end of support
Sources
- NCSC: Cyber Essentials overview
- NCSC: Cyber Essentials resources (requirements v3.3) (27 April 2026)
- IASME: Important update, changes to Cyber Essentials for April 2026 (12 February 2026)
- NCSC Annual Review 2025: Empowering organisations (14 October 2025)
- GOV.UK: PPN 014, Cyber Essentials scheme (17 February 2025)
Details are correct at the time of writing. Check the sources above for any later changes.
Want help with this in your business? Call 01787 209 003, see our cyber security service, or book a free IT consultation.