Cyber Essentials and
Cyber Essentials Plus
Cyber Essentials is a UK Government-backed certification scheme that helps you protect your organisation against the most common cyber attacks. It is widely used in UK supply chains and is often a requirement for tenders.
technical controls
The scheme focuses on the most common routes attackers use.
certification levels
Cyber Essentials (self-assessed) and Cyber Essentials Plus (tested).
reduction in common attacks
Organisations with Cyber Essentials are less likely to suffer a cyber breach.
TECHNICAL FRAMEWORK
The 5 Cyber Essentials controls
The scheme focuses on five practical controls that reduce the most common ways attackers get in.
Firewalls
Use firewalls (or equivalent) to create a barrier between your devices and the internet, and to reduce exposure of internal services.
Secure configuration
Remove or disable unnecessary accounts, services and software. Set devices up securely so they are harder to compromise.
User access control
Make sure people only have the access they need. Use strong authentication and reduce admin privileges.
Malware protection
Protect against viruses and other malware using anti-malware tools, application controls, and safe browsing practices.
Security update management
Keep operating systems, apps and firmware updated so known vulnerabilities are patched quickly.
COMPARISON
Cyber Essentials vs Cyber Essentials Plus
Both levels cover the same five controls. The difference is the level of assurance.
Cyber Essentials
SELF-ASSESSED- Questionnaire-based assessment
- Evidence and checks are primarily based on your answers and supporting information
- A strong baseline for SMEs and a common requirement in tenders
Cyber Essentials Plus
INDEPENDENTLY TESTED- Includes an external technical assessment
- More confidence for customers, regulators and supply chains
- Designed to validate that the controls are actually working in practice
FAQs
Do we need Cyber Essentials or Cyber Essentials Plus?
If you need a recognised baseline quickly (often for tenders), Cyber Essentials is a great starting point. If your customers want stronger assurance, or you want the extra confidence of independent testing, Cyber Essentials Plus is the next step.
How long does it take?
Timelines depend on how close your current setup is to the standard. Many SMEs can get ready quickly once the key gaps are identified and fixed. We focus on momentum without disruption.
What do you actually do?
We help you get ready by reviewing your current setup, closing the gaps against the 5 controls, and guiding you through the certification process. If you want ongoing support, we help you maintain the standard year-round.
Does this cover our whole business?
Cyber Essentials applies to the scope you certify (typically your devices, users and internet-facing services). We help you define a sensible scope and avoid surprises during assessment.
Want help getting certified?
We will review your current setup, close the gaps against the five controls, and guide you through Cyber Essentials or Cyber Essentials Plus. You get a clear plan, fast progress, and a standard you can maintain.