A large share of UK businesses face cyber attacks every year. The government’s Cyber Security Breaches Survey 2025/2026 found that 43% of businesses identified a breach or attack in the previous 12 months, and phishing affected 38% of them.
The solution to many of these everyday attacks is Cyber Essentials. Yet the same survey found that only 17% of businesses had heard of the scheme when asked, and just 5% held the certificate.
In this guide, you’ll learn what Cyber Essentials is, what the requirements look like after the April 2026 update, what it costs, and whether your business needs it.
What Is Cyber Essentials?
Cyber Essentials is a UK government-backed certification that shows your business has five basic security controls in place. The National Cyber Security Centre (NCSC) calls it the minimum standard of cyber security the government recommends for organisations of all sizes.
The scheme was launched in 2014. The NCSC sets the technical requirements, and IASME runs certification as the NCSC’s official delivery partner.
This scheme focuses on common, low-skill attacks, such as phishing emails, password guessing, and malware that exploits unpatched software. It’s not supposed to stop every threat; however, it can close the gaps that attackers often look for first.
There are two levels to this certification:
- Cyber Essentials: a self-assessment questionnaire that an independent assessor checks
- Cyber Essentials Plus: the same controls, plus a hands-on technical audit of your systems
Both certificates last 12 months, so you need to renew every year.
What Are the Cyber Essentials Requirements?
The Cyber Essentials requirements cover five technical controls. The NCSC’s Requirements for IT Infrastructure (v3.3) set out exactly what each one involves. In plain English:
- Firewalls: Every device in scope needs a correctly configured firewall. Change default admin passwords and block unwanted connections.
- Secure configuration: Remove or disable software, accounts, and settings you don’t need; this way, attackers will have fewer ways in.
- Security update management: Keep your software and devices supported and install critical security updates within 14 days of release.
- User access control: Every person on your team should log in with their own account, admin accounts stay separate from everyday accounts, and use multi-factor authentication where available.
- Malware protection: Use anti-malware software or an approved method to stop malicious code from running.
These may sound basic, but as a business owner, it’s easy to miss one or more of these. A survey found that only 24% of businesses reported controls in all five areas.
What Changed in Cyber Essentials in 2026?
From April 2026, every new assessment uses the Danzell question set, which replaced the previous Willow set.
The 5 controls haven’t changed, but the marking is stricter. Here’s what you should know:
Cloud services are in scope: Version 3.3 states that cloud services cannot be excluded, so tools like Microsoft 365, Google Workspace, and your accounting software all count.
MFA on cloud services is now a pass-or-fail point: The requirements say authentication to cloud services must always use MFA. Certification bodies such as Forensic Control explain that leaving MFA switched off on a cloud service that offers it now leads to an automatic fail.
The 14-day patching rule now carries an automatic fail: It’s not new, but missing it now ends the assessment.
Passwordless sign-in counts: Version 3.3 includes FIDO2 in its definition of passwordless authentication, so passkeys and hardware keys can meet the login rules.
If you use Microsoft 365, its built-in security tools can help with several of these points.
What Is the Difference Between Cyber Essentials and Cyber Essentials Plus?
Both check the same five controls. The difference lies in how an assessor verifies them.
With standard Cyber Essentials, you answer an online questionnaire and an independent assessor reviews your answers. With Cyber Essentials Plus, an assessor tests your systems as well. The Plus audit covers a representative sample of user devices, all internet gateways, and servers that offer services to the internet.
You need to pass the standard Cyber Essentials assessment before you can move on to Plus. Plus suits businesses that handle sensitive data, bid for higher-risk contracts, or simply want stronger proof that their controls actually work. Netzen holds Cyber Essentials Plus itself.
Who Needs Cyber Essentials?
UK law doesn’t require every business to hold Cyber Essentials. However, many public sector contracts require it, and private companies could ask their suppliers for it too.
For government work, Procurement Policy Note 014 applies from 24 Feb 2025. It covers central government departments, their agencies, non-departmental public bodies and NHS bodies. Those organisations should ask for Cyber Essentials or Cyber Essentials Plus on contracts that involve:
- Personal information about citizens
- Personal information about government employees, ministers or special advisers
- ICT systems and services that store or process data at the OFFICIAL level
- Information about the day-to-day business of government
Cyber Essentials may also suit your business if:
- You store customer or employee data
- You sit in a larger company’s supply chain
- You want a clear, low-cost starting point for your security
What Are the Benefits of Cyber Essentials?
Cyber Essentials can lower your risk of common attacks, open doors to contracts, and give customers more confidence in how you handle their information.
Fewer serious incidents: Certified organisations are 92% less likely to make a claim for a cyber incident than those without Cyber Essentials.
Better understanding of risk: 85% of certified organisations said the scheme gave them a better understanding of cyber risks.
Access to contracts: Certification opens more opportunities for work, allowing you to bid for public sector work and meet supplier checks from larger clients.
How Can Netzen Help You Prepare for Cyber Essentials?
Preparing your organisation for Cyber Essentials often requires changes across your devices, Microsoft 365 setup, firewalls, and patching routines. Netzen has supported UK businesses with managed IT support since 2005 and holds Cyber Essentials Plus, so we understand what assessors look for.
Our Cyber Security Services can help you find the gaps, fix them, and keep your controls in place. If you’d like help preparing for Cyber Essentials or Cyber Essentials Plus, get in touch with us.