Cyber Essentials is the UK government-backed scheme that shows your organisation has the basic controls in place to stop the most common cyber attacks. There are two levels, and choosing between them is one of the first decisions you’ll make.
What both levels have in common
Both levels assess the same five technical controls:
- Firewalls, to control what traffic can reach your systems
- Secure configuration, so devices and software aren’t left on insecure defaults
- User access control, so people only have the access they need
- Malware protection, to stop malicious software running
- Security update management, so software is patched promptly
The current requirements also expect measures such as multi-factor authentication for cloud services, so it’s worth checking the latest requirements before you start.
Cyber Essentials: a verified self-assessment
At the basic level, you complete a detailed questionnaire about how your organisation meets each control. It’s reviewed by a certification body, and your certificate is valid for 12 months. It’s an efficient way to get your fundamentals in order and demonstrate it to customers.
Cyber Essentials Plus: an independent technical audit
Cyber Essentials Plus covers the same controls, but an assessor tests your systems hands-on. That typically includes checking a sample of devices, scanning for vulnerabilities and testing how your systems handle malicious email attachments and downloads. You’ll need basic Cyber Essentials first, and the Plus audit is usually completed shortly afterwards.
Because it’s independently verified, Cyber Essentials Plus gives customers and partners a higher level of assurance.
Which one do you need?
- Choose Cyber Essentials if you need certification quickly, want a clear baseline, or a customer has asked for it.
- Choose Cyber Essentials Plus if a contract requires it, you handle sensitive data, or you want independent proof your controls actually work.
Many organisations start with Cyber Essentials and move to Plus the following year. Some go on to ISO 27001, which covers information security far more broadly. Our guide to ISO 27001 vs Cyber Essentials explains how they fit together.
How to prepare
The most common reasons organisations struggle are unsupported software, missing security updates, admin rights on everyday accounts and cloud services without multi-factor authentication. A readiness review against the five controls will show you where you stand before you apply.
Our Cyber Essentials certification support takes you from readiness review to certificate, with practical help to close the gaps.
Common reasons organisations fail
Most failed assessments come down to a handful of issues:
- Unsupported operating systems or software still in use, even on a single device
- Security updates not applied within the required timeframe
- Everyday user accounts with administrator rights
- Cloud services without multi-factor authentication
- Default passwords left on routers, firewalls or other devices
- Personal devices accessing company data without the required controls
Each is fixable, but it’s far easier to find them in a readiness review than during the assessment itself.
Staying certified
Certification lasts 12 months, but your IT changes constantly: new starters, new laptops, new cloud services. Build the five controls into everyday processes, such as onboarding, device purchasing and patching, so renewal is a formality rather than a scramble.
Want help getting certified?
Talk to us about Cyber Essentials or Cyber Essentials Plus, or start with AskQ’s free Cyber Health Check.
