Firewalls
- Firewall on every internet connection
- Default admin passwords changed
- Only the traffic you need allowed in
Cyber Essentials, made straightforward.
Cyber Essentials is the UK government's baseline security standard. We are certified ourselves, and we take clients through it too. We put the five required controls in place, gather the evidence, and handle the assessment with you.
Sound familiar?
Why certification stalls
A client asked for it
A tender or client has asked for Cyber Essentials.
Requirements are unclear
You have looked at the requirements and they are unclear.
Badge without the substance
You want the badge, but you want the security behind it too.
The five controls
What the assessment checks
Cyber Essentials is the UK government-backed scheme run by the NCSC. Every certificate covers the same five areas.
Platforms we work with
Secure configuration
- Unused software and accounts removed
- Auto-run switched off
- Device locking on laptops and phones
User access control
- Access matched to each person's job
- Separate admin accounts
- Multi-factor sign-in on every cloud service
Malware protection
- Protection on every device
- Kept up to date automatically
- Only approved apps installed
Security update management
- Supported software only
- Critical and high-risk updates within 14 days
- Old devices replaced before support ends
Two levels
Cyber Essentials or Cyber Essentials Plus
Most organisations start with Cyber Essentials. Plus adds a hands-on technical audit.
| Feature | Cyber Essentials | Cyber Essentials Plus |
|---|---|---|
| How it is assessed | Online self-assessment, reviewed by a certification body | The same, plus a technical audit by an assessor |
| Best for | Showing the basics are in place | Higher-risk contracts and clients wanting independent proof |
| Required by | Many central government and NHS contracts (PPN 014) | Higher-risk government contracts |
| Lasts | 12 months | 12 months |
Good to know
When it is required, and what changed in 2026
When it is required
UK central government departments, their agencies and NHS bodies require Cyber Essentials or Cyber Essentials Plus from suppliers whose contracts involve personal data, government information or ICT systems handling OFFICIAL information (Procurement Policy Note 014, 2025).
Councils, housing associations, larger companies and cyber insurers often ask for it too.
What changed in April 2026
The current requirements (version 3.3) apply to assessments started from 27 April 2026.
- Multi-factor sign-in must be on for every cloud service that supports it. Missing it is an automatic fail.
- Critical and high-risk updates must be installed within 14 days.
- Cloud services can no longer be left out of scope.
The difference
What changes once you're certified
More contracts ask for Cyber Essentials. Getting certified on your own means forms, jargon and guesswork.
- A certificate you can show customers and tender panels
- Basic defences in place against common cyber attacks
- Less admin: policies and settings handled for you
- A clear path to recertify each year without stress
How it works
From gap assessment to certificate
Gap review
We measure your current setup against the five Cyber Essentials controls. You get an honest view of what is missing and how long it will take to fix.
Fix the gaps
We put the missing controls in place: firewalls, patching, access control, malware protection, secure configuration. Nothing decorative, only what counts.
Assessment and renewal
We gather the evidence, handle the paperwork and support you through the assessment. Each year we remind you before renewal and keep you ready.
Pricing
Where this sits in our plans
Fixed monthly price per user, quoted in writing within 24 hours of our first meeting.
| Feature | Essentials | Complete | Co-managed |
|---|---|---|---|
| Cyber Essentials | Add-on | Add-on | Add-on |
Related services
Often paired with this
Questions