What is Cyber Essentials? Cyber Essentials is a UK government-backed security certification scheme built on five technical controls that protect against the majority of common internet-based attacks. It is owned by the NCSC (National Cyber Security Centre) and delivered by IASME together with a network of accredited Certification Bodies. It comes in two levels: Cyber Essentials and Cyber Essentials Plus.
Canonical definition: Cyber Essentials is a UK government-backed cybersecurity certification scheme, owned by the NCSC and delivered by IASME, built on five technical controls (firewalls, secure configuration, security update management, user access control, malware protection), renewed annually.
This article explains what Cyber Essentials is from scratch: who stands behind it, what its five controls rest on, how the CE and CE Plus levels differ, and what genuine benefits certification brings.
Cyber Essentials – key takeaways:
- Cyber Essentials is a UK government scheme owned by the NCSC and delivered by IASME and accredited Certification Bodies.
- It rests on five technical controls that, per the NCSC, protect against around 80% of common attacks.
- It comes in two levels: Cyber Essentials (a verified self-assessment) and Cyber Essentials Plus (an independent technical audit).
- Certification is renewed annually, and the current requirements set is version 3.3 (“Danzell”), effective from 27 Apr 2026.
- The main benefits are reducing the risk of common attacks, building customer and partner trust, and meeting contractual requirements.
- Patronusec helps organisations prepare for Cyber Essentials and Cyber Essentials Plus and implement the required controls.
Table of Contents
Who stands behind Cyber Essentials and how does the scheme work?
Behind Cyber Essentials stands the UK government: the scheme is owned by the NCSC (National Cyber Security Centre) and delivered by IASME together with a network of accredited Certification Bodies. The NCSC defines the requirements, IASME administers the scheme, and certificates are issued by accredited Certification Bodies.
The scheme was created to give organisations of every size a simple, proven starting point in cybersecurity. The NCSC is the UK’s technical authority for cybersecurity; it sets what controls an organisation must meet. IASME has been the sole delivery partner since 2020 – it standardises the process and maintains the network of Certification Bodies that carry out the assessment.
The scheme works deliberately simply. An organisation meets five technical controls, then undergoes assessment – depending on the level, this is a verified self-assessment or an independent technical audit. The certificate is valid for a year, after which it requires renewal. The requirements set is updated annually to keep pace with changing threats – the current version is 3.3 (“Danzell”), effective from 27 Apr 2026. By March 2026, over 215,000 Cyber Essentials certificates had been awarded.
The strength of Cyber Essentials lies in its simplicity: it is not an elaborate management system but five concrete technical controls that the UK government identified as a minimum, proven foundation of protection.
What do the five Cyber Essentials technical controls rest on?
Cyber Essentials rests on five technical controls that together block the most common routes of internet-based attack. These are not abstract principles but concrete, verifiable requirements – and it is their simplicity and measurability that make the scheme effective.
The five Cyber Essentials controls:
- Firewalls. Controlling traffic between devices and the internet – firewalls protecting the network boundary and individual devices from unauthorised external access.
- Secure configuration. Removing default, insecure settings – devices and software configured to minimise the attack surface, without unnecessary functions or default passwords.
- Security update management. Timely patching of vulnerabilities – systems and applications updated on time, so known gaps do not stay open to attackers.
- User access control. Limiting privileges to the necessary minimum – accounts with the appropriate level of access, multi-factor authentication where required, no unnecessary administrative accounts.
- Malware protection. Safeguarding against malware – mechanisms blocking the running or installation of malicious software on devices.
These five controls arose from a simple observation: one or more of these basic controls would have stopped most attacks that actually succeeded. That is why the NCSC estimates Cyber Essentials protects against around 80% of common cyber attacks – not all, but the most frequent and cheapest for the attacker.
It is worth noting that the current version 3.3 strengthened requirements for cloud services (IaaS, PaaS and SaaS must be in scope and cannot be excluded), tightened multi-factor authentication requirements and emphasised the role of backups.
The five Cyber Essentials controls do not defend against every attack – they defend against those that are the majority anyway, and do so simply enough for an organisation of any size to afford.
How does Cyber Essentials differ from Cyber Essentials Plus?
Cyber Essentials and Cyber Essentials Plus cover the same five technical controls – the difference lies in how they are verified. Cyber Essentials is a verified self-assessment, while Cyber Essentials Plus adds an independent, hands-on technical audit performed by a Certification Body.
The differences in practice:
- Cyber Essentials (base level). The organisation completes a self-assessment questionnaire, which is then verified by a Certification Body. It confirms the organisation declares and demonstrates meeting the five controls. The price depends on the organisation’s size.
- Cyber Essentials Plus (higher level). Covers the same five controls but adds independent, hands-on technical testing – the Certification Body itself verifies that the controls actually work, through a hands-on audit. The price depends on the size and complexity of the network.
The key difference comes down to the level of assurance. The self-assessment in Cyber Essentials rests on the organisation’s (verified) declaration, whereas Cyber Essentials Plus provides independent technical proof that the controls genuinely work. For many customers and business partners, CE Plus is the expected level, because it gives assurance based on a test, not on a declaration.
Patronusec Insight: In our project experience, organisations outside the UK often ask whether Cyber Essentials makes sense for them. It does – for two reasons. First, the five controls are a universal, proven foundation of security hygiene, independent of geography. Second, it is increasingly a contractual requirement: UK counterparties and public-sector bodies expect CE or CE Plus from suppliers. We treat Cyber Essentials not as an end in itself but as an entry point into a wider compliance programme – the five controls naturally overlap with the requirements of ISO 27001 or PCI DSS, so the work put into CE pays off in later certifications.
What benefits does Cyber Essentials certification bring?
Cyber Essentials certification brings three main benefits: a genuine reduction in the risk of common attacks, building customer and partner trust, and meeting increasingly frequent contractual requirements. On top of that comes an organising value – CE forces the implementation of basic security hygiene many organisations lack.
The concrete benefits:
- Risk reduction. The five controls protect against around 80% of common attacks – a measurable reduction in the likelihood of the most frequent incidents at a relatively low cost.
- Customer and partner trust. The certificate is an external, verifiable signal that the organisation takes security seriously – building credibility in commercial relationships.
- Meeting contractual requirements. More and more contracts, especially with the UK public sector and large organisations, require CE or CE Plus from suppliers – the certificate opens access to those markets.
- A foundation for wider compliance. The five controls overlap with the requirements of ISO 27001 and PCI DSS – CE is a natural first step in a compliance programme, not a separate, one-off effort.
- Simplicity and predictable cost. Unlike elaborate management systems, CE is achievable quickly and at a predictable cost, which makes it accessible to organisations of any size.
The sum of these benefits makes Cyber Essentials one of the best-scaling value-to-cost ratios in cybersecurity – a low entry threshold, concrete protection and genuine market value.
FAQ – What is Cyber Essentials
Is Cyber Essentials mandatory?
Cyber Essentials is not universally mandatory by law, but it is often required contractually – especially by the UK public sector and large organisations expecting it from suppliers. For many firms it is effectively a condition of access to certain markets and tenders, even if it does not stem from a general statutory obligation.
How many controls does Cyber Essentials cover?
Cyber Essentials covers five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. The same five controls apply at both levels – base (CE) and higher (CE Plus). What differs is the method of verification, not the scope of controls.
How often must Cyber Essentials be renewed?
Cyber Essentials is an annually renewable certification. The certificate is valid for a year, after which the organisation must undergo reassessment against the current requirements set. That set is updated annually by IASME in collaboration with the NCSC – the current version is 3.3 (“Danzell”), effective from 27 Apr 2026.
Does Cyber Essentials protect against all attacks?
No. The NCSC estimates Cyber Essentials protects against around 80% of common cyber attacks – the most frequent and cheapest for the attacker. It does not protect against advanced or targeted attacks, which require additional, deeper measures. CE is a solid hygiene foundation, not a complete defence strategy.
Does Cyber Essentials make sense for a firm outside the UK?
Yes, for two reasons. First, the five controls are a universal foundation of security hygiene, independent of geography. Second, CE or CE Plus is often required contractually by UK counterparties and public bodies. For firms working with the UK market, the certificate opens access to contracts, and for others it is a valuable starting point in security.
How does Patronusec help with Cyber Essentials?
Patronusec helps organisations prepare for Cyber Essentials and Cyber Essentials Plus: we review the infrastructure against the five controls and the current requirements version, identify gaps before assessment and support implementing the missing controls. We also help embed CE in a wider compliance programme (ISO 27001, PCI DSS), so the work pays off in later certifications.
Recommended reading
A reading path for Cyber Essentials:
- Cyber Essentials and CE Plus – 5 things to do and what to avoid – practical preparation for certification.
- Who is Cyber Essentials for, who is CE Plus for and what links them to ISO 27001 and PCI DSS – choosing the level and mapping to other standards.
- A business continuity plan in 5 steps – an element of the organisation’s wider resilience.
Cyber Essentials – free consultation
Patronusec helps organisations prepare for Cyber Essentials and Cyber Essentials Plus – from reviewing the infrastructure against the five controls, through identifying gaps, to implementing the missing safeguards and embedding CE in a wider compliance programme. Book a free consultation.
