Short answer
No EDR subscription is prescribed. Configure supported endpoint malware protection, enabled updates and applicable malicious-code and website protections, then verify it operates across in-scope devices. Vulnerability scanning and advanced EDR detection may improve assurance, but buying EDR alone does not establish Cyber Essentials compliance.
Why this matters
Technical-control questions decide whether the self-assessment can be approved. Cyber Essentials is not a paper-only exercise: the applicant must be able to show that secure configuration, patching, access control, malware protection, and firewalls are implemented in the actual environment.
The strongest submissions use evidence from device management, endpoint security, vulnerability scanning, identity controls, and asset registers. If a control is implemented manually, the organisation should still be able to explain ownership, frequency, and how exceptions are handled.
What to check next
- Apply every qualifying high-risk, CVSS v3 7+ or unspecified-severity fix within 14 days of release.
- Remove unsupported software or agree the permitted isolated subset with the assessor.
- Keep endpoint protection, firewall rules, and admin accounts documented.
Official sources and related Fig Group guidance
For scheme-level confirmation, use the official NCSC and IASME resources. Fig Group links to these sources so Cyber Essentials buyers can verify the scheme, delivery partner and certificate record independently.