Cyber Essentials Certification 2026 — The UK's Baseline Cybersecurity Standard for SMEs

1. What is Cyber Essentials?

Cyber Essentials is a UK government-backed cybersecurity certification scheme, launched in 2014 and managed by the National Cyber Security Centre (NCSC). It was designed to provide organisations with a structured baseline of cybersecurity controls that protect against the vast majority of common internet-borne cyber attacks — phishing, malware, password attacks, and exploitation of known vulnerabilities.

The scheme is deliberately pragmatic: rather than addressing every conceivable threat, it focuses on the five technical controls that, when properly implemented, protect against approximately 80% of commodity cyber attacks. This makes it achievable for organisations of any size, including micro-businesses and charities, without requiring a dedicated security team.

There are two levels of Cyber Essentials certification:

• Cyber Essentials (CE) — self-assessment questionnaire, verified by an NCSC-accredited certification body
• Cyber Essentials Plus (CE+) — independent technical audit that tests the controls you claimed in the self-assessment

2. Who Needs It — Mandatory and Recommended

Cyber Essentials certification is mandatory for a specific category of UK government suppliers, and strongly recommended for any organisation that handles sensitive data or wants to demonstrate a credible cybersecurity posture to clients and insurers.

3. Two Certification Levels: CE and CE+

4. The 5 Cyber Essentials Technical Controls

The five controls address the most common attack vectors used in commodity cyber attacks. They are deliberately achievable — most SMEs can implement all five with existing IT resources, without specialist security consultants.

• 1. Firewalls A boundary firewall or router must be configured to block inbound connections to services that are not explicitly required for business purposes. Default passwords on firewalls and routers must be changed. Network access rules must be documented and reviewed regularly. Personal firewalls must be enabled on devices that connect to the internet directly (e.g. laptops used outside the office network).
• 2. Secure Configuration Remove or disable unnecessary software, user accounts, and services on all in-scope devices. Apply vendor security settings and harden default configurations — default “out of the box” settings are typically insecure. Admin accounts must be used only for administrative tasks, not day-to-day browsing or email. Auto-run must be disabled to prevent malicious code executing automatically from removable media.
• 3. User Access Control Standard user accounts (not admin accounts) must be used for day-to-day work. Admin rights must only be granted where explicitly necessary for a specific role. All accounts must use strong passwords of at least 8 characters (14+ recommended), or multi-factor authentication. Accounts belonging to individuals who have left the organisation must be removed or disabled promptly — within 24 hours of departure is best practice.
• 4. Malware Protection Anti-malware software must be installed on all in-scope devices and configured to scan files automatically. Signature databases must be updated at least daily. Alternatively, application whitelisting (allowing only approved applications to run) or sandboxing for high-risk activities is accepted. Mobile device management (MDM) on company mobile devices can satisfy this control if properly configured.
• 5. Patch Management Operating systems and all applications on in-scope devices must be patched within 14 days of a critical or high-severity security patch becoming available. Auto-updates must be enabled where the vendor supports them. Software that is no longer supported by the vendor (“end of life”) must be removed from in-scope devices — you cannot patch software for which patches no longer exist.

5. Scope of Assessment

The scope of a Cyber Essentials assessment covers all devices and software within your “internet-connected boundary”. This typically means every device that connects to the internet, all cloud services used for business, and any internet-facing servers or services operated by your organisation.

Defining your scope

1. Map all internet connections — identify every point where your organisation's networks and devices connect to the public internet
2. Include cloud services — SaaS applications (Microsoft 365, Google Workspace, Salesforce, etc.) used for business are in scope
3. Include home working devices — company-issued devices used at home are in scope; BYOD devices used for work email or data are also in scope
4. List all in-scope locations — if you have multiple offices, all must be included unless you can demonstrate they are entirely separate networks

6. Costs and Certification Bodies

Certification bodies must be accredited by IASME (the scheme owner on behalf of NCSC). Well-known CREST-member certification bodies include IASME Consortium, Pentest People, NCC Group, and many regional IT security consultancies. Costs vary between providers, so it is worth obtaining two or three quotes.

7. How to Prepare — 8-Week Plan

Most SMEs can achieve Cyber Essentials certification within 8 weeks if they follow a structured preparation approach. The steps below assume you are starting from a typical SME baseline — some patching done, basic antivirus in place, but no formal security programme.

8. Cyber Essentials vs NIS Regulations vs ISO 27001

UK organisations often ask how Cyber Essentials relates to other cybersecurity frameworks. The three main standards serve different purposes and different audiences — they are complementary rather than competing.

For most UK SMEs, the practical path is: Cyber Essentials first, then ISO 27001 if enterprise contracts require it, and NIS Regulations compliance if you are formally designated as an Operator of Essential Services. CE is not a prerequisite for the others, but the five controls it requires form a solid foundation that reduces the uplift needed for more comprehensive frameworks.