Cyber Essentials 2026: The Complete Certification Guide

Cyber Essentials is a UK government-backed cybersecurity certification scheme delivered by IASME on behalf of the NCSC. It defines five technical controls - firewalls, secure configuration, user access control, malware protection, and security update management - that every UK SME should have in place. The certificate is valid for 12 months.

Cyber Essentials remains the UK's most widely-adopted cybersecurity certification scheme. Originally launched in 2014 by GCHQ and the NCSC, it has evolved into a foundational standard for businesses across every sector and size. In 2026, understanding Cyber Essentials is essential not just for compliance, but for vendor qualification, insurance pricing, and customer trust.

This guide walks you through the requirements, certification levels, costs, and practical path to achieving and maintaining certification.

Cyber Essentials is a government-backed, IASME-delivered certification scheme that defines five core security controls required to protect organisational IT systems against common cyberattacks:

1. Boundary firewalls and internet gateways

2. Secure configuration of IT infrastructure

3. User access control and privilege management

4. Malware protection

5. Security update management

The scheme is deliberately simple - not because cybersecurity is simple, but because these five controls prevent the vast majority of attacks that target UK organisations. Cyber Essentials doesn't certify advanced security or compliance with complex frameworks like ISO 27001. Instead, it certifies that you've implemented the hygiene basics.

This focus on fundamentals explains its rapid adoption:

• Some government procurements require Cyber Essentials or Plus where the contract and risk make it proportionate; PPN 014 sets out the approach for in-scope buyers.
• An insurer may consider certification, but cover and pricing depend on its own underwriting terms.
• A customer may request certification from a supplier; check the required entity, scope and level.

The v3.3 requirements apply to applications started from 27 April 2026. Earlier applications can continue under v3.2. Check the version on your assessment account rather than assuming every live account follows v3.3.

Cyber Essentials comes in two certification levels:

Cyber Essentials (CE)

What it is: A self-assessment certification covering the five controls above.

How it works:

• You complete a detailed questionnaire covering each control
• Questions are specific and technical - not vague
• You submit evidence of implementation (policies, screenshots, logs)
• Certified assessors review your submission
• Certification is awarded if you meet the standard

Cost: Fig Group publishes Basic assessment prices from £299.99 + VAT for Micro. Compare like-for-like packages; preparation and remediation cost extra where needed.

Time to certification: Preparation and remediation vary. Fig Group's Basic guarantee applies after receipt of a complete, compliant submission before midday UK time on a UK Business Day, under its terms.

Renewal: Annual (every 12 months)

Who needs it: Most organisations. CE is suitable if you can accurately self-assess your security posture and are comfortable with the responsibility of ongoing compliance.

Cyber Essentials Plus (CE+)

What it is: CE followed by independent technical verification of a representative sample. Plus is not a full penetration test.

How it works:

• You complete the CE questionnaire as above
• An IASME-licensed assessor conducts a technical audit of your systems
• The assessor performs the technical checks specified by the Plus scheme and reports any failures for remediation.
• The assessor interviews key staff (IT manager, network admin)
• Certification is awarded if you meet the standard and pass the technical assessment

Cost: Check the chosen Plus package, scope and published or quoted price; Fig Group publishes its tiers on the Plus page.

Time to certification: Depends on readiness, assessor scheduling and technical results. The Basic six-working-hour guarantee does not cover Plus.

Renewal: Annual

Who needs it: Buyers whose tender, contract or own risk decision calls for independent technical verification. No sector label alone creates a universal Plus duty.

How to Choose

Our recommendation: Check the exact buyer requirement first. Basic may meet a request for Cyber Essentials; choose Plus where the buyer specifies it or independent technical verification is worth the additional assessment for your risk.

The NCSC technical requirements define the pass criteria. The examples below help with preparation; each assessment must follow its account version and agreed scope.

1. Firewalls

Control the boundary between in-scope devices or networks and the internet. Remove unnecessary inbound access, change default administrative passwords and document any permitted remote administration. An ordinary privately owned home router is outside the scheme boundary; an organisation-supplied router is in scope. A VPN, a particular appliance and universal outbound allow-listing are not mandatory architecture choices.

2. Secure configuration

Remove or disable unnecessary software, services and accounts, change default credentials and use supported settings on in-scope devices and services. Configuration baselines and drift monitoring can help at scale, but a named configuration-management product is not required. Document what is in scope and what you actually checked.

3. User access control

Give each user an appropriate account and restrict administrative privileges to those who need them. Apply the current scheme's MFA requirements to in-scope services and accounts, including cloud services; check how the service offers MFA and whether a paid option is required. Separate routine and administrative activity where applicable. PAM and quarterly access reviews are useful additional practices, not universal scheme tests.

4. Malware protection

Use an allowed malware protection approach on in-scope devices and keep it effective. Endpoint detection, web filtering and central alerting can add protection, but no named product or SIEM is a prerequisite for Basic certification.

5. Security update management

Keep in-scope operating systems, applications, firmware and devices supported. Apply high-risk or critical security updates within the scheme's 14-day window after release; address unsupported products and other applicable update questions under the account version. A monthly-only patch window cannot replace the 14-day requirement where it applies. Vulnerability scans can help find gaps but are not a universal Basic assessment test.

Logging, incident response, supplier reviews, encryption and data classification may be essential to an organisation's wider security or legal obligations. They should not be presented as extra Cyber Essentials control themes. Cyber Essentials Plus adds independent technical checks of the baseline; it is not a comprehensive penetration test.

1. Define scope and account version. Identify the legal entity, devices, networks and cloud services covered. Applications started before 27 April 2026 can continue under v3.2; newer applications use v3.3.

2. Prepare against the five controls. The free NCSC question set helps identify questions and possible gaps. Time and remediation depend on the actual environment.

3. Choose a route and package. Check the IASME certification-body finder for licence scope, or use an official self-led purchase route. Compare assessment fees separately from preparation, consultancy and tooling.

4. Submit and sign off. Complete the assessment portal questionnaire. An authorised senior person provides the required declaration. An assessor may ask for clarification or corrections.

5. Complete Plus testing if required. Plus needs a valid matching Basic certificate and technical assessment within the scheme window. Agree sample, access and scheduling with the Plus body; a combined package can include the Basic step.

6. Check the award and renewal date. Use the IASME certificate search to verify a certificate and its exact dates. Plan renewal and ongoing control maintenance separately.

The assessment fee is only one component. Fig Group's current Basic Micro fee starts at £299.99 + VAT, and Plus has its own published tiers. Other providers and supported packages may have different prices. Ask for a written quote showing VAT, organisation size, support, feedback and Plus scope.

Readiness work, remediation, staff time and optional tools depend on your starting position. A sole trader with supported devices may have little additional expenditure; a complex estate may need substantial changes. There is no defensible universal year-one investment, renewal cost or preparation duration. Budget from your inventory and identified gaps rather than a generic range.

Check the five controls and your account version, identify gaps, choose the right Basic or Plus route for your buyer requirement, then submit when the answers and controls are ready. Fig Group's Basic guarantee starts after receipt of a complete, compliant submission before midday UK time on a UK Business Day, subject to certification terms. Preparation, remediation, feedback on non-compliant answers and Plus scheduling are separate from that clock.

Fig Group's platform simplifies Cyber Essentials compliance through:

Use ongoing security hygiene to prepare for the next point-in-time certification assessment.

Cyber Essentials is a useful baseline and is required by some specific buyers and contracts. Check the applicable tender and insurer terms before treating certification as a procurement or pricing condition.

Start with the current question set and your actual scope. Preparation time depends on the controls and remediation needed; the assessment clock begins only under the chosen provider's stated conditions.