What is Cyber Essentials?
A UK government backed certificate that proves your business has the basic protections in place against the most common cyber attacks.
Cyber Essentials was developed by the UK government and is overseen by the National Cyber Security Centre (NCSC). IASME runs the scheme as the NCSC's delivery partner and licenses the certification bodies that carry out assessments.
You answer a set of questions about how your business protects its devices, accounts and network. A qualified assessor reviews your answers. If you meet the requirements, you receive a certificate that lasts 12 months.
Who needs it? Many UK government contracts require Cyber Essentials, and more larger businesses and insurers now ask for it before they work with you. Even when nobody asks, the five controls block the attacks that hit small businesses most often.
The five technical controls
Everything in the assessment tests one of these.
Firewalls
Put a properly configured firewall between your devices and the internet, and change default admin passwords on routers.
Secure configuration
Remove software and accounts you do not use, change default settings and lock devices with a PIN or password.
Security update management
Keep every operating system, app and piece of firmware supported, and install critical and high risk updates within 14 days.
User access control
Give people only the access they need, keep admin accounts separate and turn on multi-factor authentication for every cloud service.
Malware protection
Stop malicious software running, using anti-malware or by only allowing approved apps to run.
What changed in April 2026
IASME introduced a new question set called Danzell, with version 3.3 of the requirements, for assessment accounts opened from 26 April 2026. These are the changes that catch businesses out most often.
- MFA on all cloud services. If a cloud service offers multi-factor authentication and you have not turned it on, you fail automatically.
- Cloud services always in scope. You cannot leave Microsoft 365, Google Workspace or other cloud services out of your assessment.
- Missing the 14 day update window is an automatic fail. Critical and high risk updates for operating systems, firmware and applications must be installed within 14 days of release.
- Fuller scope descriptions. You now need to describe what is in scope and what is not, and name each legal entity covered.
Read my full breakdown of the Danzell changes.
How to get certified
- Check your readinessRead the free question set and compare it to your setup. My Guided Cyber Essentials does this with you, question by question.
- Fix the gapsClose anything that would fail, starting with MFA, updates and unsupported software.
- Book your assessmentCertification is carried out by an IASME licensed certification body. You pay the fixed IASME fee for your business size.
- Complete the questions onlineYou have six months from purchase to submit your answers.
- Get your resultMost assessors return a result within three working days. If something needs correcting, you get two working days to fix it.
What it costs
IASME sets the assessment fee by business size. For micro businesses (0 to 9 employees) the fee is £320 plus VAT, rising to £600 plus VAT for organisations with 250 or more staff. See the full price breakdown.
A quick self check
If you answer no to any of these, you would likely fail today.
- Is multi-factor authentication turned on for every cloud account, including email?
- Are all laptops, phones and servers running a supported operating system?
- Do critical and high risk updates get installed within 14 days?
- Do staff use standard accounts day to day, with admin rights kept separate?
- Have default passwords on routers and firewalls been changed?
- Does every device lock with a PIN or password?
- Is every device protected by anti-malware, or set to run only approved apps?
The question most people ask next
Do staff working from home count?
Yes. Any laptop, phone or tablet used for work is in scope, wherever it is used. Home broadband routers supplied by an internet provider are not in scope, so the firewall built into each device does that job instead. Not sure how that applies to your team? Ask me and I'll tell you.
Step by step guides for each control
- Firewalls. Is it safe to use public Wi-Fi for work?
- Secure configuration. How do I list every device and service my business uses?
- Security update management. How do I make sure security updates install? and What do I do about devices that no longer get updates?
- User access control. How do I turn on multi-factor authentication?, Why should staff use separate admin accounts?, How do I stop staff reusing passwords? and How do I remove access when someone leaves?
Not sure where you stand? Take the free cyber security check and get a PDF of your results.
Frequently asked questions
How long does Cyber Essentials take?
Once you are ready, answering the questions takes most small businesses a few hours. Most assessors return a result within three working days. Fixing gaps beforehand is what takes the time, so start with a readiness check.
How long does a Cyber Essentials certificate last?
12 months. You need to renew every year to stay on the list of certified organisations.
How much does Cyber Essentials cost?
IASME sets the fee by size. It is £320 + VAT for 0 to 9 employees, £440 for 10 to 49, £500 for 50 to 249 and £600 for 250 or more.
Is Cyber Essentials mandatory?
It is not a legal requirement, but many UK government contracts require it and more private sector buyers and insurers ask for it.
What happens if I fail?
If your answers need correcting, you get two working days to fix them without paying again. Miss that window and you need a new assessment.
Do I need Cyber Essentials Plus?
Only if a customer, contract or insurer asks for it, or you want independent proof your controls work. Plus must be completed within three months of your Cyber Essentials certificate.
Got a question about your setup?
Send me one quick question and I'll give you a straight answer in plain English, usually within one working day. Prefer to talk it through? Book a free 30 minute call.