In one sentence: Cyber Essentials is a UK government-recommended certification showing your organisation has five basic technical protections in place against common internet attacks.

What it is

The NCSC describes Cyber Essentials as the government-recommended certification scheme, developed by NCSC experts and aligned to five technical controls designed to prevent the most common internet-based cyber security threats.

There are two levels. Cyber Essentials is the basic certification. Cyber Essentials Plus assesses the same five controls but goes a step further by independently testing your systems to verify that the controls work in practice. The scheme is delivered through licensed certification bodies.

How it works

The five controls, as named in the NCSC’s requirements document, are firewalls, secure configuration, security update management, user access control and malware protection.

1. You define your scope: the devices, servers, cloud services and networks that handle your data. Version 3.3 of the requirements, which applies from 27 April 2026 according to ISMS.online, states that cloud services holding your data cannot be excluded.
2. You answer a questionnaire against the five controls and provide evidence if asked.
3. For the basic level the questionnaire is assessed by a certification body. For Plus, an assessor tests your systems.
4. Typical requirements include updating software within 14 days where fixes cover critical or high-risk flaws, MFA on cloud services, and brute-force protection for passwords, as summarised by ISMS.online and Governance Docs.

What it does not do: it is a baseline. It does not cover everything in a full security programme, and it does not replace data protection compliance such as UK GDPR.

Who it affects and how badly

UK organisations of every size, and many suppliers are asked for it. Sole traders to 10 staff use it to win work and tidy up the basics. Firms of 10 to 50, such as accountancy, legal, recruitment and construction businesses, use it to answer client security questionnaires. Schools, charities and councils use it to show a baseline. MSPs and SaaS start-ups use it to prove their own hygiene. Regulated firms treat it as a starting point beside ISO 27001, SOC 2 or NIS2 work.

Worst case without it is more likely to be a failed tender or a stalled sale than a fine, though weak basics also raise breach risk.

Real examples

NCSC and NCA ransomware white paper. The paper says most ransomware incidents are not due to sophisticated techniques, that initial access is usually opportunistic and the result of poor cyber hygiene, and that implementing NCSC guidance would interrupt the majority of attacks. It tells readers to read it alongside the Cyber Essentials programme. Source: https://www.ncsc.gov.uk/paper/ransomware-extortion-and-the-cyber-crime-ecosystem

How to detect it

How to check your own position before you apply:

• List your devices, servers, cloud services and user accounts. If you cannot list them, scope is your first gap.
• Check firewall rules and any open inbound ports on your router or cloud network.
• In Microsoft 365, review Secure Score, Intune compliance and Entra sign-in logs. In Google Workspace, review the security health page.
• Check that every device is receiving updates and that unsupported software is removed.
• Find accounts without MFA, shared logins and leavers whose access remains.

How to fix or prevent it

1. Fix the five controls in order of effort: turn on MFA, apply updates, remove unsupported software.
2. Set up and review firewalls, closing any inbound service you do not need.
3. Remove default accounts and passwords, and turn off unused services.
4. Give each person their own account, with admin rights only where needed, and remove leavers promptly.
5. Switch on anti-malware or application allow listing on every in-scope device.
6. Include your cloud services in scope and configure them securely.
7. Choose a certification body and, once ready, consider Cyber Essentials Plus for independent testing.

Related terms

• cyber essentials plus
• cyber essentials five controls
• iso 27001
• uk gdpr
• multi-factor authentication
• patch management
• vulnerability scanning
• ransomware
• phishing

Browse the full Resources library.

FAQ

What are the five Cyber Essentials controls? Firewalls, secure configuration, security update management, user access control and malware protection.

What is the difference between Cyber Essentials and Plus? Both assess the same five controls, but Plus independently tests your systems to verify they work in practice, according to the NCSC.

Does it cover GDPR? No. It is a technical baseline, not a data protection regulation.

How Wolfcore helps

Wolfcore’s secure-by-design consulting gets you ready for Cyber Essentials Plus, ISO 27001, SOC 2 or NIS2 without the paperwork taking over. See secure-by-design consulting.