Cyber Essentials and Cyber Essentials Plus explained

What is Cyber Essentials?

Cyber Essentials is a UK government-backed certification that sets a minimum standard of cyber security for organisations of any size. It launched in 2014. Today the National Cyber Security Centre (NCSC) sets the requirements, and IASME has delivered the scheme as the NCSC’s delivery partner since 2020, through a network of licensed certification bodies.

It targets the most common internet-based threats. As the NCSC puts it, most attacks are basic: “the digital equivalent of a thief trying your front door to see if it’s unlocked”.

It is also increasingly a condition of doing business. The NCSC says a growing number of organisations require suppliers to be certified before they can bid for work, and IASME says it is now required in a large number of central government contracts.

There are two levels: Cyber Essentials and Cyber Essentials Plus.

What are the five technical controls?

The same five controls apply at both levels. The current requirements, version 3.3 from April 2026, set them out like this:

1. Firewalls. Only secure and necessary network services can be reached from the internet.
2. Secure configuration. Computers and network devices are set up to reduce vulnerabilities and run only the services they need.
3. Security update management. Software is licensed and supported, and high-risk or critical updates are installed within 14 days of release.
4. User access control. Accounts go only to authorised people, and each account can reach only what that person needs for their role.
5. Malware protection. Known malware and untrusted software are stopped from running or reaching your data.

The controls apply to cloud services as well as office devices. Since April 2026, cloud services that hold or process your data can’t be left out of scope, and signing in to them must use multi-factor authentication (MFA) wherever it is available.

What is the difference between Cyber Essentials and Cyber Essentials Plus?

The controls are exactly the same. What changes is how they are checked.

What’s involved	Cyber Essentials	Cyber Essentials Plus
Questionnaire	Online self-assessment, signed off by a board member and marked by an independent assessor	The same questionnaire
Technical audit	None	Internal and external vulnerability scans, plus hands-on tests of a sample of devices
Assurance	Baseline	Higher, because an assessor has checked the controls work
Price	From £320 + VAT, depending on organisation size	Quoted individually

For Plus, the assessor tests a random sample of user devices (typically around 10 per cent), all internet gateways and all servers that people on the internet can reach without logging in. They then decide whether more testing is needed. The audit can be carried out remotely or on site.

The April 2026 changes made Plus stricter. If devices fail on security updates, the retest covers a new random sample as well as the original one, so updating only the tested machines no longer works. A second failure revokes the self-assessment certificate too.

How long does a certificate last?

Cyber Essentials and Cyber Essentials Plus certificates expire after 12 months. IASME removes organisations from its list of certified organisations if they haven’t certified in the past year, and you answer the full question set again each time.

A certificate describes your position on the day it is issued. Since April 2026, the director who signs the declaration also accepts that the organisation must keep the controls in place for the whole certification period.

Some answers are automatic fails. You won’t pass if you have:

• unsupported software in scope;
• cloud services without MFA, where MFA is available;
• high-risk or critical updates left uninstalled for more than 14 days.

How do you check a supplier’s certificate?

A logo on a website isn’t proof. Check the record instead:

1. Search IASME’s certificate search by the organisation’s name or certificate number. It lists certificates issued in the last 12 months, with the level, certification date and expiry date.
2. Check the level. Cyber Essentials and Cyber Essentials Plus are different certificates.
3. Check the expiry date. If it is close, ask when they will recertify.
4. Check the scope. A certificate can cover the whole organisation or a defined part of it. For assessments under the April 2026 rules, the digital certificate shows a detailed scope description and the legal entities covered, so you can confirm that the company you contract with is included.

Organisations that need to check many suppliers can apply to use IASME’s Supplier Check platform.

How Enhanced Group can help

Enhanced Group holds Cyber Essentials Plus Placeholder: certificate number and expiry date (Q02), so our own systems go through the technical audit described above.

For clients, we deploy and manage security tools that protect against malware, ransomware and phishing, and we make use of the security features in Microsoft 365. For AC Services, we introduced Microsoft Intune device management so that security policies can be applied consistently. Placeholder: confirm whether we help clients prepare for Cyber Essentials certification (Q13)

To talk about your own security, book a consultation or see our cyber security services.