Cyber Essentials: The UK Security Certification for Suppliers

Cyber Essentials is the UK government-backed scheme that certifies an organisation has five basic technical security controls in place. It was launched in 2014, is run by the National Cyber Security Centre (NCSC) with delivery partner IASME, and is designed to protect against the most common internet-based attacks. Many UK government contracts require it, and large UK companies increasingly ask their suppliers for it, including overseas software and IT providers.

There are two levels: Cyber Essentials, based on a verified self-assessment, and Cyber Essentials Plus, which adds hands-on technical testing. The requirements were updated to version 3.3 in April 2026, with a clear rule that cloud services cannot be excluded from scope and that authentication to cloud services must always use MFA. This guide explains the controls, scoping, what changed, the certification process and how software companies can pass first time.

What is Cyber Essentials?

Cyber Essentials sets out a small number of technical controls that, if properly implemented, defend against the majority of common cyber attacks, such as phishing that installs malware, exploitation of unpatched software, and password guessing. The requirements are published by the NCSC in "Cyber Essentials: Requirements for IT Infrastructure". Certification is delivered by IASME, the scheme's delivery partner, through a network of licensed certification bodies.

The scheme is intentionally focused. It does not cover risk management, policies, incident response or business continuity in depth, which frameworks like ISO/IEC 27001 address. It is a baseline, not a complete security programme.

Who should get certified?

• Suppliers to UK central government, where it is required for contracts involving certain personal data and ICT services.
• Suppliers to the Ministry of Defence and some other public bodies with their own requirements.
• Suppliers to large UK companies that include it in supplier security requirements.
• Small and medium businesses wanting an affordable, recognised baseline.
• Overseas software and IT companies, including Indian firms, selling to UK clients. Certification is available to organisations outside the UK.

Is it mandatory or voluntary?

Voluntary in law, but effectively required for many UK public sector contracts and a growing number of private ones. Certificates are valid for 12 months and must be renewed to stay current.

The five technical controls

Control	Main requirements
Firewalls	Boundary firewalls or equivalent on all devices, default administrative passwords changed, inbound rules approved and documented, unneeded rules removed, and administrative interfaces not exposed to the internet unless protected.
Secure configuration	Remove or disable unnecessary accounts and software, change default passwords, disable auto-run, and require authentication before access to devices, with brute-force protection.
Security update management	Use only licensed and supported software, enable automatic updates where possible, and install critical or high-risk updates within 14 days of release.
User access control	Manage accounts through a creation and approval process, give users only the access they need, use separate admin accounts, remove access when no longer needed, use MFA where available and always for cloud services.
Malware protection	Active anti-malware software configured to prevent malware and malicious websites, or application allow-listing with code signing, on all in-scope devices.

The 14-day patching rule

All software in scope must be licensed and supported by the vendor, and removed from devices when it stops being supported. Updates, including vulnerability fixes, must be installed within 14 days of release where they fix vulnerabilities the vendor rates as critical or high risk, or that have a CVSS v3 base score of 7 or above, or where the vendor does not give severity details. The NCSC stresses that updates should be applied as soon as possible and that 14 days is a maximum. Unsupported operating systems, browsers or plugins in scope are a common cause of failure.

Passwords and MFA

All user accounts must require authentication. Where passwords are used, they must be protected against brute force by MFA, throttling that allows no more than 10 guesses in 5 minutes, or locking after no more than 10 failed attempts. Password quality must be managed through MFA, a minimum length of 12 characters, or a minimum length of 8 characters combined with automatic blocking of common passwords. MFA should be used for administrative accounts and accounts accessible from the internet, and authentication to cloud services must always use MFA. The password element of MFA must be at least 8 characters. Version 3.3 clarified that FIDO2 passkeys count as MFA.

Scope: cloud, BYOD and home working

• Cloud services: version 3.3 defines cloud services and states clearly that they cannot be excluded from scope. The applicant is always responsible for ensuring controls are implemented, though the cloud provider may implement some, depending on whether the service is infrastructure, platform or software as a service.
• Bring your own device: personal devices that access organisational data or services are in scope, except devices used only for native voice, native text messaging and MFA apps.
• Home and remote working: corporate and BYOD devices used for home working are in scope; home routers supplied by internet providers are generally out of scope, so device firewalls must be configured instead.
• Sub-sets: an organisation can limit scope to a segregated sub-set, but it must be clearly defined and separated, and the certificate will say what it covers.

Who implements controls in the cloud

The NCSC distinguishes three types of cloud service and explains who typically implements each control. The applicant remains responsible for making sure every control is in place, whoever implements it.

Control	IaaS (e.g. virtual servers)	PaaS (e.g. serverless, web apps)	SaaS (e.g. email, file sharing)
Firewalls	You and the provider	Provider, sometimes you	Provider
Secure configuration	You and the provider	You and the provider	You and the provider
Security update management	You and the provider	You and the provider	Provider
User access control	You	You	You
Malware protection	You and the provider	Provider, sometimes you	Provider

The important point for software companies is that user access control, including MFA, is always the customer's job. Even for well-known SaaS tools, you must configure accounts, roles and MFA yourself.

Web applications and software development

Publicly available commercial web applications are in scope by default, while custom-built components of web applications that an organisation develops are out of scope of the certification. That does not mean custom applications are unimportant: the NCSC says the best way to reduce application vulnerabilities is sound development and testing in line with commercial good practice, and version 3.3 points to the UK Software Security Code of Practice for further detail. Buyers of custom software may therefore ask for both Cyber Essentials and evidence of secure development, such as code review, dependency scanning and penetration testing.

What changed in version 3.3

According to the NCSC's April 2026 requirements document, version 3.3:

• Adds a formal definition of cloud services.
• Updates the definition of passwordless authentication to include FIDO2.
• States definitively that cloud services cannot be excluded from scope.
• Introduces the UK Software Security Code of Practice in the software development section.
• Removes references to "untrusted connections" in scope criteria.
• Emphasises the importance of backing up data.

Commentators report that the accompanying assessment question set treats failing to enable available MFA on cloud services as a failure. Applicants should use the question set in force when they start their assessment.

Cyber Essentials Plus

Cyber Essentials Plus has the same requirements but adds independent technical verification. An assessor tests a sample of devices and accounts, typically including an external vulnerability scan, internal vulnerability scans of sampled devices, tests that malware protection blocks test files delivered by email and web, checks that MFA is configured on cloud services, and checks of account privileges. It must be completed within a set period after achieving basic Cyber Essentials. Some government and defence contracts require Plus.

The certification process

1. Define scope: whole organisation or a segregated sub-set, including all cloud services.
2. Prepare: review the requirements and fix gaps, especially patching, MFA and unsupported software.
3. Complete the self-assessment online, answering questions on each control, signed off by a board-level or equivalent person.
4. Assessment: a certification body reviews answers and may ask for clarification or evidence.
5. Certification: a certificate valid for 12 months, listed on the public register.
6. Cyber Essentials Plus (optional): book the technical audit within the required window.
7. Renew annually.

Cost and timeline

Basic Cyber Essentials has a fixed assessment fee that varies by organisation size, set by IASME, and is affordable for small businesses. Cyber Essentials Plus costs more because of the technical audit, and price varies by certification body and the number of devices sampled. Preparation time depends on the starting point: a well-run small company may be ready in days, while one with unsupported systems or no MFA may need weeks. Check IASME's current pricing before budgeting.

Government contract requirements

Since 2014, UK central government has required suppliers bidding for certain contracts, particularly those involving the handling of personal information and the provision of some ICT products and services, to hold Cyber Essentials. Some departments and the Ministry of Defence set higher requirements, such as Cyber Essentials Plus or additional standards, depending on the contract's risk. The requirement is set out in each procurement, so suppliers should read tender documents carefully and allow time to certify before the bid deadline. Holding a current certificate also avoids last-minute work every time a new opportunity appears.

Firewalls and secure configuration in more detail

For the firewall control, every device must be protected by a correctly configured firewall or network device with firewall functionality. Default administrative passwords must be changed to strong ones or the interface disabled, inbound firewall rules must be approved and documented with a business need, unapproved services must be blocked by default, and rules no longer needed must be removed promptly. For cloud services, data flow policies can achieve the same effect. For secure configuration, unnecessary user accounts and software must be removed or disabled, default passwords changed, auto-run features disabled, and users authenticated before accessing data or services. Users must present a credential such as a biometric, password or PIN before using a device, with protection against repeated guessing.

Benefits

• Access to UK public sector and supply chain contracts.
• Protection against the most common attacks.
• A clear, affordable baseline for small organisations.
• A foundation for ISO/IEC 27001 and other frameworks.

Common reasons for failure

• Unsupported software, such as old operating systems, in scope.
• Critical patches older than 14 days.
• Cloud services without MFA for all users.
• Admins using their admin accounts for email and browsing.
• Excluding cloud services or BYOD from scope.
• Default passwords on routers and devices.

Practical tips for software companies

• Enforce MFA across identity provider, cloud consoles, code repositories, email and SaaS tools.
• Use device management to enforce updates, disk encryption and anti-malware on laptops.
• Keep an inventory of devices, software and cloud services, and remove unsupported items.
• Separate admin accounts from daily accounts, including for cloud consoles.
• Patch servers and containers automatically, and rebuild images regularly.
• Back up data, as v3.3 emphasises, and test restores.

We build and maintain web and SaaS platforms with MFA everywhere, automated patching and least-privilege access through our maintenance and support and web application development services.

How it relates to other frameworks

Framework	Relationship
ISO/IEC 27001	Full management system; Cyber Essentials covers a subset of technical controls.
Essential Eight	Australian baseline mitigation strategies with maturity levels.
CIS Controls	Broader prioritised control set; IG1 overlaps strongly.
UK GDPR	Requires appropriate security; Cyber Essentials is common evidence.
NIS2	EU cybersecurity directive with much broader duties.

Real-world example

An Indian software company bidding for a UK local authority contract needs Cyber Essentials Plus. Its preparation finds three laptops on an unsupported OS version, a code repository without enforced MFA and a forgotten test server with an exposed admin panel. It upgrades the laptops, enforces MFA through its identity provider for all cloud services, decommissions the test server, sets automatic patching with a seven-day target, and passes both the self-assessment and the technical audit within six weeks.

Next steps

1. Read the v3.3 requirements.
2. Inventory devices, software and cloud services.
3. Fix MFA, patching and unsupported software.
4. Complete the self-assessment.
5. Plan Cyber Essentials Plus if buyers need it.

Frequently asked questions

What is Cyber Essentials?

A UK government-backed certification showing an organisation has five basic technical security controls in place.

What is the difference between Cyber Essentials and Cyber Essentials Plus?

Cyber Essentials is a verified self-assessment; Plus adds independent hands-on technical testing.

How long is a certificate valid?

12 months, after which the organisation must reassess to keep a current certificate.

Can non-UK companies get Cyber Essentials?

Yes. Organisations outside the UK can be certified.

What changed in April 2026?

Version 3.3 defined cloud services, confirmed they cannot be excluded from scope, included FIDO2 in passwordless authentication, introduced the Software Security Code of Practice and emphasised backups.

How quickly must patches be applied?

Critical and high-risk updates, including CVSS 7 or above, within 14 days of release.

Is MFA required?

Authentication to cloud services must always use MFA, and MFA should be used for admin and internet-facing accounts.

Are personal devices in scope?

Yes, if they access organisational data or services, except devices used only for native voice, text and MFA apps.

Is Cyber Essentials required for UK government contracts?

Many central government contracts involving certain personal data and ICT services require it.

Is Cyber Essentials the same as ISO 27001?

No. It covers a small set of technical controls; ISO 27001 is a full information security management system.

Are custom web applications covered?

Publicly available commercial web applications are in scope by default; custom-built application components are out of scope, though secure development is still recommended.