Cyber Essentials (UK)

Introduction: Cyber Essentials (UK) — An Auditor's Deep Dive

Cyber Essentials is a UK Government-backed cyber security certification scheme designed to help organisations of any size guard against the most common internet-borne cyber attacks. Launched in 2014 and operated on behalf of the National Cyber Security Centre (NCSC) by IASME Consortium as the sole Cyber Essentials Partner (delivery partner since April 2020), the scheme sets out five fundamental technical controls that, when correctly implemented, protect against approximately 80% of common cyber attacks such as phishing, malware, ransomware and password-guessing.

There are two levels of certification. Cyber Essentials is a verified self-assessment against a defined question set, and Cyber Essentials Plus adds an independent, hands-on technical audit performed by a qualified Certification Body assessor. This guide is written from the perspective of a CERT-In empanelled auditor and PCI QSA to give practitioners an accurate, control-by-control roadmap to achieving and sustaining certification. Terminology, control names and the requirement structure reflect the current 'Montpellier' question set and the 'Cyber Essentials: Requirements for IT Infrastructure' document.

What is Cyber Essentials

Cyber Essentials is a baseline cyber hygiene certification that focuses exclusively on technical controls at the boundary and endpoint of an organisation's IT estate. Unlike broader management-system standards such as ISO/IEC 27001, Cyber Essentials does not assess governance maturity, risk management processes or documentation depth. Instead, it verifies that a defined set of technical controls is in place across all internet-facing and end-user systems within scope.

The scheme is built around five technical control themes. Each theme contains specific, testable requirements. The self-assessment (Cyber Essentials) requires an organisation to answer the full question set truthfully, with sign-off by a board-level representative, after which a Certification Body marks the answers. Cyber Essentials Plus retains the same five control themes but validates them through independent technical testing including authenticated vulnerability scans of a sample of devices, tests of malware protection, and simulated phishing/email-based attacks.

Who Must Comply

Cyber Essentials is voluntary for most organisations but is contractually mandatory in several UK Government supply-chain contexts and is increasingly demanded in commercial procurement, insurance and framework qualification.

• Organisations bidding for UK public-sector contracts that specify Cyber Essentials as a condition.
• Managed Service Providers (MSPs) whose clients require supply-chain assurance.
• Businesses that want an affordable, government-recognised demonstration of baseline security.
• Firms seeking to reduce cyber insurance premiums or meet insurer prerequisites.

Structure of Cyber Essentials

The scheme is organised into five technical control themes. Each theme groups a set of specific, testable requirements applied consistently across all in-scope devices — including servers, desktops, laptops, tablets, mobile phones, thin clients and cloud services. The table below summarises the five themes and their core intent.

In addition to the five themes, current question sets embed several cross-cutting requirements: multi-factor authentication (MFA) for cloud services, treatment of Bring Your Own Device (BYOD), account separation for administration, and end-of-life/unsupported software handling. Cloud services — Infrastructure as a Service (IaaS), Platform as a Service (PaaS) and Software as a Service (SaaS) — are all explicitly in scope, with the organisation and the cloud provider holding shared responsibility for the controls.

Master Assessment Checklist

This is the core of the guide. Each of the five control themes is enumerated below with its specific requirements, what an auditor verifies, and the typical evidence expected in a Cyber Essentials or Cyber Essentials Plus assessment. Every requirement area is covered — do not treat any as optional. For Cyber Essentials Plus, expect the assessor to independently verify these through authenticated scanning and live testing rather than relying on declarations.

Control Theme 1 — Firewalls

This theme ensures that every device is protected by a correctly configured firewall (or equivalent network device) between the internal network/device and the internet. It covers boundary firewalls and host-based (software) firewalls, including protection for home and remote workers not sitting behind a corporate boundary firewall.

Control Theme 2 — Secure Configuration

This theme ensures devices and software are configured to minimise vulnerabilities: removing or disabling unnecessary accounts, software and services, changing default credentials, and applying screen-lock/device-lock protections. It also covers auto-run/auto-play restrictions and the treatment of default installations.

Control Theme 3 — Security Update Management

This theme ensures all software remains supported by its vendor, is licensed, and is kept up to date. Critical and high-severity security updates must be applied within a defined window (currently 14 days of release). Unsupported/end-of-life software must be removed from scope or the device removed from the network.

Control Theme 4 — User Access Control

This theme ensures access to systems and data is granted only to authorised individuals, following least privilege, with a robust account-provisioning and de-provisioning process. It mandates strong authentication, separation of administrative accounts, and multi-factor authentication for cloud services and administrator access.

Control Theme 5 — Malware Protection

This theme ensures devices are protected against malicious software using at least one of three approved mechanisms: anti-malware software, application allow-listing, or (historically) sandboxing. The mechanism must be kept current and configured to prevent execution of malicious code.

Cross-Cutting Requirements

Beyond the five themes, the current question set embeds requirements that span multiple controls. Auditors verify these explicitly.

Scoping

Correct scoping is the single most important decision in a Cyber Essentials engagement, and the most common cause of assessment failure or rework. The preferred and default scope is the whole organisation. A sub-set scope is permitted only where it is a clearly separable business unit or network segment with its own defined boundary — a partial scope reduces the assurance value of the certificate and must be described precisely.

• Whole-organisation scope covers all devices, users, networks and cloud services used to access organisational data and services.
• In-scope assets include all end-user devices (desktops, laptops, tablets, mobile phones), servers, network equipment, and all cloud services (IaaS, PaaS, SaaS).
• Home workers and their devices are in scope when they access organisational data or services; the home router is generally out of scope but a software firewall on the device is required.
• BYOD devices used to access organisational email, documents or applications are in scope (with limited exceptions for read-only voice/multimedia and certain native app access — check the current question set).
• A sub-set scope must be network-segregated (e.g. by VLAN or firewall) from the rest of the organisation and clearly named on the certificate.
• End-of-life/unsupported software must be segregated onto a network with no internet access to be excluded from scope, or it fails the assessment.

Implementation Approach

A structured, phased approach de-risks certification, particularly for Cyber Essentials Plus where independent testing leaves no room for undocumented gaps. The following four phases move an organisation from discovery to sustained compliance.

Phase 1 — Discover and Scope

• Activities: Build a complete asset inventory (devices, servers, cloud services, network equipment); identify all internet connections; map users and administrative accounts; define scope (whole organisation vs justified sub-set); confirm question-set version.
• Deliverables: Asset and cloud-service inventory, scope statement, network diagram, current-state summary.

Phase 2 — Assess Gaps

• Activities: Map current configuration against each of the five control themes and cross-cutting requirements; run internal vulnerability scans; identify unsupported software, missing MFA, default credentials and unpatched systems.
• Deliverables: Gap analysis against the full question set, prioritised remediation plan, risk register of exceptions.

Phase 3 — Remediate

• Activities: Change default passwords; enable and configure firewalls; harden device builds; enable automatic updates and patch within 14 days; deploy/verify MFA on all cloud services; separate admin accounts; deploy malware protection; remove or segregate unsupported software.
• Deliverables: Hardened build/configuration baselines, MFA rollout evidence, patch-compliance reports, updated firewall rule base, remediation closure log.

Phase 4 — Certify and Sustain

• Activities: Complete the self-assessment question set with board sign-off; submit to a Certification Body; for Plus, support the assessor's technical testing; embed ongoing patching, access reviews and configuration control.
• Deliverables: Submitted question set, certificate (CE / CE Plus), annual recertification plan, BAU control-maintenance schedule.

Certification Levels and Assurance Model

Cyber Essentials offers two assurance levels. The self-assessment gives verified assurance (a Certification Body marks the answers), while Plus adds independent technical validation. The table below contrasts the levels along the assurance dimension, functioning as the scheme's maturity/scoring model.

There is no numeric scoring; certification is binary pass/fail against the requirements. However, organisations can benchmark internal maturity to plan improvement. The illustrative maturity ladder below (a CyberSigma planning aid, not an NCSC construct) helps track readiness.

Assessment and Audit Approach

The formal route to certification follows a defined sequence. For Cyber Essentials Plus, the technical audit must occur within three months of the underlying Cyber Essentials certification.

1. Select an IASME-accredited Certification Body and register on the assessment platform.
2. Confirm scope (whole organisation or a defined sub-set) and the applicable question-set version.
3. Complete the self-assessment question set accurately across all five control themes and cross-cutting requirements.
4. Obtain board-level (senior/company director) sign-off attesting the answers are true.
5. Submit for marking; the Certification Body reviews answers and may request clarification or evidence.
6. Remediate any non-conformities identified during marking and resubmit if required.
7. On a pass, receive the Cyber Essentials certificate (valid 12 months).
8. For Plus: schedule the independent audit within three months; the assessor selects a representative sample of devices.
9. The assessor performs authenticated vulnerability scans, tests malware protection, and runs email/web-based attack simulations against sample devices.
10. Any critical/high-severity vulnerabilities or control failures found must be remediated within the defined window to pass.
11. On a pass, receive the Cyber Essentials Plus certificate; plan annual recertification for both levels.

Evidence Request List

Prepare the following categorised evidence in advance. For Cyber Essentials Plus, the assessor will also generate live evidence during testing.

• Scope and asset: asset inventory, cloud-service inventory, network diagram, scope statement, sub-set segregation evidence (if applicable).
• Firewalls: firewall/router inventory, rule base export, default-password change records, remote-management/MFA evidence, host firewall status reports.
• Secure configuration: build/hardening baselines, installed-software inventory, GPO/MDM policy exports, screen-lock and auto-run configuration, account lists.
• Security update management: OS/application version inventory mapped to vendor lifecycle, patch-deployment reports with dates, licence/support records, firmware update logs.
• User access control: JML procedure, unique-account directory export, admin-account list and separation policy, MFA configuration per cloud service, access-review records, leaver de-provisioning tickets.
• Malware protection: anti-malware deployment and definition-update reports, application allow-list configuration, tamper-protection settings, mobile/MDM app-control policy.
• Governance: board sign-off attestation, policies (remote working, BYOD, password/authentication), previous certificate (for recertification/Plus).

Roles and Responsibilities

KPIs to Track

• Percentage of in-scope devices with critical/high patches applied within 14 days.
• Percentage of cloud services and administrator accounts with MFA enforced (target 100%).
• Number of unsupported/end-of-life software instances in scope (target zero, or fully segregated).
• Percentage of devices with malware protection active and up to date.
• Number of open inbound firewall rules without documented justification (target zero).
• Mean time to disable a leaver's accounts after departure.
• Percentage of devices with default/guessable passwords remaining (target zero).
• Percentage of user accounts operating under least privilege (no unnecessary admin rights).
• Number of non-conformities raised at last assessment and time to close them.
• Days remaining until certificate expiry / recertification readiness status.

Readiness Checklist

• Complete asset and cloud-service inventory produced and scope defined and agreed.
• All internet connections protected by a correctly configured boundary firewall.
• Default administrative passwords changed on all firewalls, routers and devices.
• Host-based firewalls enabled on home/remote-working devices.
• Unnecessary accounts, software and services removed or disabled.
• Device lock (screen lock with re-authentication) enforced on all devices.
• All operating systems and applications supported and licensed (no end-of-life in scope).
• Critical and high-severity updates applied within 14 days across the estate.
• MFA enabled on all cloud services and all administrator accounts.
• Administrative accounts separated from standard accounts and not used for web/email.
• Least-privilege access enforced with a working joiner-mover-leaver process.
• Malware protection deployed, active, tamper-protected and up to date on all in-scope devices.
• BYOD and remote-working policies documented and technically enforced.
• Board-level sign-off obtained for the self-assessment attestation.
• Certification Body engaged and (for Plus) technical audit scheduled within three months.

Common Gaps

• Incorrect or over-narrow scoping — attempting to exclude servers, business units or cloud services that are genuinely in scope.
• MFA not enabled on all cloud services and administrator accounts (a frequent Plus failure).
• Unsupported/end-of-life operating systems or applications still connected to the network.
• Critical patches not applied within the 14-day window; no evidence of patch dates.
• Default or shared credentials remaining on devices, network equipment or applications.
• Administrator accounts used for everyday tasks such as email and web browsing.
• Home and BYOD devices overlooked, with no host firewall or malware protection.
• Malware protection disabled or without tamper protection, allowing users to switch it off.
• Inbound firewall rules left open without documentation or business justification.
• Leaver accounts not disabled promptly, and no periodic access review.
• Treating cloud providers' certifications as covering all controls, ignoring the organisation's share of responsibility.
• Board sign-off obtained without the signatory understanding the truthfulness of answers.

Cyber Essentials Mapped to Other Frameworks

Cyber Essentials provides a technical baseline that maps cleanly onto broader frameworks. It is not a substitute for a management system but is an excellent foundation and can accelerate wider compliance.

Frequently asked questions

Need help with Cyber Essentials?

CERT-In empanelled, PCI QSA senior auditors can take you from reading about it to compliant — with a scoped, guided programme.