Cyber Essentials is the UK Government-backed minimum standard of cyber security for organisations of all sizes, developed by the National Cyber Security Centre. Certification shows that a business has five technical controls in place: firewalls, secure configuration, security update management, user access control and malware protection.
What it means
The scheme targets the most common internet-based attacks, such as phishing, password guessing and exploitation of unpatched software. There are two levels. Cyber Essentials is based on a self-assessment questionnaire verified by a certification body. Cyber Essentials Plus assesses the same five controls but adds independent hands-on technical testing.
Certification is renewed annually, so it reflects a recent snapshot rather than a permanent status.
How it works in a UK business
The NCSC notes that a growing number of organisations require suppliers to be Cyber Essentials certified to bid for work, so certification is often a commercial requirement as well as a security one. The NCSC lists basic Cyber Essentials pricing on a tiered basis from £320 plus VAT, with Plus quoted separately.
Preparing usually means confirming device and software inventories, enforcing multi-factor authentication, removing unsupported software and tightening admin rights. A fractional CISO or IT director often leads this work.
Frequently asked questions
What is the difference between Cyber Essentials and Cyber Essentials Plus?
Both cover the same five technical controls. Cyber Essentials relies on a verified self-assessment. Cyber Essentials Plus adds independent technical testing of your systems to check the controls work in practice, which gives customers and insurers higher assurance. Many businesses achieve the basic level first, then progress to Plus.
Is Cyber Essentials mandatory?
It is not a general legal requirement for UK businesses. However, the NCSC says a growing number of organisations require suppliers to hold it in order to bid for work, so in practice it can be a condition of winning contracts, particularly in public sector and regulated supply chains.
Last updated: 5 November 2026