Cyber Essentials
UK government-backed cyber baseline.
What it means for you
Cyber Essentials is the UK government-backed certification covering five core security controls. Holding it demonstrates a verified baseline of cyber hygiene, and we help clients achieve it too.
- Firewalls, secure configuration and access control
- Malware protection and patch management
- Often required to win contracts and for cyber insurance
- We guide clients through certification and renewal
- 2014Scheme launched, backed by the UK government
- 215k+Certificates awarded since launch (IASME)
- 5Technical controls, verified every year
About the scheme
Cyber Essentials launched in June 2014 and is overseen by the National Cyber Security Centre, with IASME as its delivery partner. More than 215,000 certificates have been awarded. It verifies five technical controls: firewalls, secure configuration, security update management, user access control and malware protection, the fundamentals that stop the majority of common, commodity attacks.
The requirements keep evolving
The current question set, known as Willow, took effect in April 2025. It reframed patching as vulnerability management, giving organisations 14 days to fix serious vulnerabilities, brought all cloud services explicitly into scope and formally recognised passwordless authentication. Annual certification means keeping up with these changes, which is exactly what we do for clients.
Contracts and insurance
Cyber Essentials has been mandatory for suppliers on certain government contracts since October 2014 and is increasingly demanded in private-sector supply chains. Certification through the self-assessment route also includes £25,000 of cyber liability insurance for eligible UK organisations with under £20m turnover. We hold the certification ourselves and take clients through it end to end.
The services this powers
Cyber Essentials, your questions answered
What is the difference between Cyber Essentials and Cyber Essentials Plus?
Cyber Essentials is a board-signed self-assessment reviewed by a qualified assessor. Cyber Essentials Plus covers the same five controls but adds an independent hands-on technical audit, completed within three months of the base certification, that proves the controls actually work. Plus carries more weight in tenders.
Does Cyber Essentials actually stop attacks?
The five controls are designed to block the bulk of common, commodity internet-borne attacks, and government-cited estimates put that at the large majority of basic attacks. It is a baseline rather than complete protection, which is why we layer detection and response on top for most clients.
How often does certification need renewing?
Every twelve months, against whatever the current question set requires. Because requirements evolve, as the April 2025 Willow update showed, we keep client environments continuously compliant rather than scrambling at renewal.
More accreditations
Want Cyber working for your business?
Book a free consultation and we’ll show you how it fits into a joined-up IT, security and print service.