Cyber Essentials and
Cyber Essentials Plus
Cyber Essentials is a UK Government-backed certification scheme that helps you protect your organisation against the most common cyber attacks. It is widely used in UK supply chains and is often a requirement for tenders.
Technical controls - the scheme focuses on the most common routes attackers use.
Certification levels - Cyber Essentials (self-assessed) and Cyber Essentials Plus (tested).
Reduction in common attacks - organisations with Cyber Essentials are far less likely to suffer a breach.
TECHNICAL FRAMEWORK
The 5 Cyber Essentials controls
The scheme focuses on five practical controls that reduce the most common ways attackers get in.
Firewalls
Use firewalls (or equivalent) to create a barrier between your devices and the internet, and to reduce exposure of internal services.
Secure configuration
Remove or disable unnecessary accounts, services and software. Set devices up securely so they are harder to compromise.
User access control
Make sure people only have the access they need. Use strong authentication and reduce admin privileges.
Malware protection
Protect against viruses and other malware using anti-malware tools, application controls, and safe browsing practices.
Security update management
Keep operating systems, apps and firmware updated so known vulnerabilities are patched quickly.
COMPARISON
Cyber Essentials vs Cyber Essentials Plus
Both levels cover the same five controls. The difference is the level of assurance.
Cyber Essentials
Self-assessed- Questionnaire-based assessment
- Evidence and checks are primarily based on your answers and supporting information
- A strong baseline for SMEs and a common requirement in tenders
Cyber Essentials Plus
Independently tested- Includes an external technical assessment
- More confidence for customers, regulators and supply chains
- Designed to validate that the controls are actually working in practice
BUSINESS BENEFITS
Why businesses achieve Cyber Essentials
Certification helps win tenders, reduce commercial risk, and demonstrate practical cyber maturity to clients and partners.
Win work and pass supplier checks
Cyber Essentials is widely recognised across UK supply chains. It helps you demonstrate that you take cyber security seriously and meet a minimum standard.
Reduce real-world risk
The controls focus on the most common attack routes: weak configurations, unpatched systems, malware and excessive access.
Build a security baseline you can maintain
Certification is not a one-off project. We help you keep the standard year-round so renewals are straightforward.
Make security practical for non-technical teams
You get clear actions and a defined scope. No jargon-heavy frameworks, just sensible controls that reduce risk.
Want help getting certified?
We will review your current setup, close the gaps against the five controls, and guide you through Cyber Essentials or Cyber Essentials Plus. You get a clear plan, fast progress, and a standard you can maintain.
COMMON QUESTIONS
Frequently asked questions
Note: Statistics and scheme details are based on publicly available guidance from the UK National Cyber Security Centre (NCSC).