Cyber Essentials is the UK’s government-backed cybersecurity certification scheme, managed by the National Cyber Security Centre (NCSC) and the Department for Science, Innovation and Technology (DSIT).
Its purpose is to help organisations of all sizes protect themselves against the most common cyber threats by implementing five key technical controls defined as the minimum standard for cyber security.
 
What is Cyber Essentials?
Launched in 2014 as a national initiative to strengthen the UK’s cyber resilience, Cyber Essentials provides a practical framework that enables any organisation – regardless of size or sector – to demonstrate that it has implemented effective measures to defend against common online threats, including malware, phishing, and unauthorised access to data.
Since April 2020, the IASME Consortium has been the sole Cyber Essentials Delivery Partner, responsible for managing the certification process through a nationwide network of licensed Certification Bodies and qualified Assessors.
The core purpose of Cyber Essentials is to establish a clear and practical minimum standard for cybersecurity that organisations must meet to reduce the risk of common incidents such as hacking attacks, malware (including ransomware), phishing, and unauthorised access to systems and data.
To achieve this, Cyber Essentials defines five key technical controls that organizations are required to implement:

1. Firewalls – protecting internet connections by using firewalls to restrict unauthorised access to networks and devices.
2. Secure configuration – ensuring secure configuration of devices and software, removing unused functions, and applying appropriate settings.
3. Security update management – applying updates and security patches in a timely manner to operating systems, applications, and firmware.
4. User access control – managing user accounts and access to data and services according to roles and responsibilities.
5. Malware protection – defending against malicious software by implementing suitable anti-malware solutions and other mechanisms for detection and prevention.

According to NCSC research, organisations implementing these controls are 92% less likely to make a cyber insurance claim than those without them.
 
Certification levels
Cyber Essentials certification demonstrates that an organization has implemented basic yet effective cybersecurity measures and can be considered a trustworthy partner in terms of security.
The scheme offers two levels of certification, depending on the organization’s needs and complexity:
Each certificate is valid for 12 months and must be renewed annually.
 
Tools and Support
To facilitate the certification process, NCSC and IASME provide a range of tools and resources:

• Cyber Essentials Readiness Tool – an interactive online tool that assesses an organisation’s current cyber security posture and generates a tailored action plan for certification preparation
• Cyber Advisor Programme – a network of NCSC-assured consultants offering expert guidance and hands-on support to small organisations in implementing the Cyber Essentials controls
• Cyber Essentials Knowledge Hub – a free, central resource providing up-to-date technical guidance, FAQs, and good practice examples.

 
Cyber Essentials and Supply Chains
One of the key aims of the scheme is to enhance transparency and cybersecurity assurance across supply chains. Many organisations, particularly in the financial, healthcare, and public sectors, now require their suppliers and partners to hold Cyber Essentials or Cyber Essentials Plus certification. This helps reduce third-party risk and ensures a higher level of trust throughout the supply chain.
 
Benefits for organizations
Achieving Cyber Essentials certification provides a range of benefits, including:

• Improved protection against common cyber threats
• Increased trust from customers, clients, and business partners
• Reduced risk and financial impact from low-level attacks
• Enhanced competitiveness and market reputation
• Preferential consideration in UK public sector procurement and partnership opportunities.

 

Cyber Essentials – UK Cyber Security Certification Scheme