The short answer
Cyber Essentials is the UK government-backed certification scheme developed by the NCSC and delivered by IASME. It covers five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. Certificates last 12 months.
What is Cyber Essentials?
Cyber Essentials is a UK certification scheme developed by the National Cyber Security Centre (NCSC). The government describes it as its recommended minimum cyber security standard for organisations of all sizes. IASME is the NCSC’s Cyber Essentials Delivery Partner and manages the network of certification bodies that assess organisations.
What are the five Cyber Essentials controls?
- Firewalls
- Secure configuration
- Security update management
- User access control
- Malware protection
What is the difference between Cyber Essentials and Cyber Essentials Plus?
| Cyber Essentials | Cyber Essentials Plus |
|---|---|
| A verified self-assessment. A senior person confirms the answers and an assessor from a certification body reviews them. | The same requirements plus a technical audit of a representative set of user devices, all internet gateways and all internet-facing servers. |
| Fixed price by organisation size. | Priced by the certification body based on the size and complexity of your network. Cyber Essentials is a prerequisite. |
How much does Cyber Essentials cost?
IASME’s published prices for the Cyber Essentials self-assessment, excluding VAT:
| Organisation size | Price |
|---|---|
| 0 to 9 employees | £320 |
| 10 to 49 employees | £440 |
| 50 to 249 employees | £500 |
| 250 or more employees | £600 |
Cyber Essentials Plus is quoted separately by each certification body.
How long does a Cyber Essentials certificate last?
Twelve months. Both certificates must be renewed every year, and you have to answer every question again. A renewed certificate runs for 12 months from the date you submit, not from the old expiry date. Once you apply, you have six months to complete the assessment.
What changed in April 2026?
Version 3.3 of the requirements, and the matching “Danzell” question set, apply from 27 April 2026. The previous “Willow” question set applies to assessments bought before that date. The changes include:
- Multi-factor authentication is mandatory on all cloud services where it is available. Missing it is an automatic fail.
- New automatic-fail questions on installing high-risk or critical updates within 14 days.
- Cloud services can no longer be excluded from scope, and the requirements now define what a cloud service is.
- FIDO2 is added as an accepted passwordless authentication method.
- An updated declaration for directors, and a second Cyber Essentials Plus failure now revokes the self-assessment certificate.
Do you need Cyber Essentials for government contracts?
Often, yes. Procurement Policy Note PPN 014, which applies from 24 February 2025 and replaces PPN 09/14 and PPN 09/23, covers central government departments, executive agencies, non-departmental public bodies and NHS bodies. For contracts that involve citizens’ or government staff’s personal data, ICT systems handling OFFICIAL information, or government business information, suppliers need Cyber Essentials or Cyber Essentials Plus (or equivalent controls) and must recertify every 12 months for the life of the contract.
Does Cyber Essentials include free cyber insurance?
IASME offers free cyber liability insurance to organisations that certify their whole organisation, are domiciled in the UK or a Crown Dependency and have turnover under £20 million. The cover is £25,000, underwritten by AIG, with a £1,000 excess, and you have to opt in. Higher limits are available at extra cost.
Asking a supplier for its certificate? See our questions to ask a technology supplier.
Sources
- NCSC: Cyber Essentials overview
- NCSC: Cyber Essentials requirements for IT infrastructure v3.3 (April 2026)
- NCSC: Cyber Essentials resources
- IASME: Cyber Essentials
- IASME: Cyber Essentials FAQs
- IASME: changes to Cyber Essentials for April 2026
- IASME: cyber liability insurance
- gov.uk: PPN 014 Cyber Essentials scheme
This is general information, not legal or professional advice. Rules change, so check the sources and take advice for your situation. Spotted something out of date? Email hello@asand.io.